record(LTX25-DEVICE-RESIDENCY): the ltx2 span_slack bound has no load allowance, and the quantity swung 171x on one binary (#1576)

[localai-bot]

Records #1576, a gate that a busy runner can flip, before it becomes an intermittent
nobody can attribute. One appended .agents/issue-index.md row. No code.

It is not currently red. build-test-cpu is green on main in run
32464632413 at
483cd3198: 100% tests passed, 0 tests failed out of 584, with
test_ltx2_video Passed in 201.56 s. Saying that plainly is part of the record,
because a filed gap that reads like a live red gets triaged as one.

What was measured

6b48edb2c (GATE-CI-RED-REPAIR) repaired test_ltx2_video and introduced a
wall-clock containment bound in the same change:

const double span_bound = std::min(kSpanSlackPerRecord * leaves.size(),
                                   0.5 * leaf_seconds);
CHECK_MESSAGE(span_slack <= span_bound, ...);

kSpanSlackPerRecord is 250 µs per leaf record, raised to 3 ms under either
sanitizer. There is an explicit allowance for instrumentation and none for CPU
load.

Measured at origin/main 6b48edb2c on a detached worktree, CPU-only, x86_64,
BUILD_RC=0, the same binary in both samples:

sample	box state	artifacts.frames slack	bound	verdict
full 102-case run, ctest -j 1	load 82-110	3.223 ms of a 4.935 ms leaf (65.3%)	250 µs	fails, 13x over
same case alone, -tc=	load ~90	18.8 µs of a 2.98 ms leaf (0.63%)	250 µs	passes, 13x under

A 171x swing in the asserted quantity on one tree and one binary. For scale
on the same commit, test_ltx2_video runs 201.56 s on the CI runner and took
2863.35 s on that box.

Why it is worth a record rather than a fix

The bound is a fixed absolute time charged per instrument boundary, compared
against a leaf that can be a few milliseconds long. Whether it holds is therefore
a property of scheduler latency, not of the phase instrumentation it exists
to gate. The sanitizer arm already concedes the quantity is environment-sensitive;
contention moves it the same way and gets no allowance.

The cost is attribution rather than the red itself: a reviewer who sees this fail
cannot separate a genuine phase-instrumentation regression from a loaded runner.
That is #433's class, which this tree has already paid for.

Deliberately not fixed here. A bigger constant only moves the threshold at
which the same ambiguity appears, and the candidate repairs — assert the
containment relation rather than a duration, derive the budget from measured
per-boundary cost on the running host, or gate the case on a quiescence
precondition and report "not measured" instead of "failed" — are an instrument
decision owned by the LTX-2.5 residency lane, not by the row that found it. The
index row names LTX25-DEVICE-RESIDENCY as owner; whether it also belongs under
that spec's ## Owed is that lane's call, and I have not edited their spec.

Gate

scripts/agent-preflight.sh --fail-on-skip: ZERO skips, RANGE_COUNT=1,
commit-trailers ok and commit-style ok, both RUN against
origin/main 5d548d003.

One gate fails and it is inherited: test_cpu_x86_llamacpp_floor. Its
test_a_contended_leg_is_discarded_and_never_summarised expects exit 2
(GIVING_UP) and gets exit 4, which scripts/cpu-x86-llamacpp-floor.sh:127
emits as NO_QUIET_WINDOW; the host was at load 86-118 throughout, so the
quiet-window wait trips before the discard path is reached. The harness is
behaving correctly and the self-test is what assumes a quiet host. agent-record
— the CI job that runs this same file at ci.yml:271 — is green on main in the
run linked above, and this branch touches no code at all.

An earlier revision of this row failed check-agent-record with
table has 8 pipes; expected 5, because the doctest counts were quoted verbatim
with their | separators inside a table cell. Fixed by writing them with commas.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5 [claude-code]