feat(LTX25-PHASE-RESIDUE): three phase anchors, held by position rather than by a tolerance (#1668)

[localai-bot]

FOLLOWING_AGENTS_PROTOCOL

The LTX-2.5 phase table reported its residue as one number. #1711 landed the gap
decomposition that split it into the intervals between consecutive leaves, and
the largest regions it named had no anchors. This adds the three #1668 owes:
load.dit_config between load.dit and load.video_vae, artifacts.mux over
the result assembly and mux argv build after the last named leaf, and
denoise.update over the sampler's post-process and Euler step, counted by a
new Ltx2ConditioningTrace::sampler_updates. The fourth item #1668 listed,
Record::instrument_seconds, had already landed as be432e8e3 (#1711), so the
issue's own text is partly stale and this does not redo it.

Neither ratio moved, and nothing re-proposes the withdrawn bound

## Design 3 of the row's spec records that residue <= 2 * instrument went
red 4 times in 45 at the table bound and 28 in 160 on a standalone probe, and
that a 20-run sample of that quantity saw none of the tail that decided the
gate. Both wall-clock ratios stay exactly as they were: leaves >= 0.95 * wall,
kSpanSlackPerRecord = 0.03, min_coverage >= 0.5 and all three
denoise_min_coverage=0.75 call sites are byte-identical to base. The only
numeric edit in the tests is {0.0} becoming {0.0, 0.0}, which adds the
second part's entry rather than widening anything.

So the new gate carries no constant. CheckSeamAnchor asserts POSITIONS: the
anchor is emitted once, is not a span, is not nested, opens at or after its
predecessor's end, closes at or before its successor's start, and no other leaf
lies inside the window it claims. artifacts.mux has no successor, so its
far-side clause is the stronger one that nothing follows it — it is the last
leaf of its render. An anchor left open across the next leaf marks that leaf
nested and removes it from sum_leaf_seconds altogether, which is why closing
before the next open is the load-bearing part rather than tidiness.

denoise.update is held by the record count against a counter the RENDER
maintains, for the reason video_decode_chunks is: a denominator derived from
the phase table cannot falsify a phase table. It is nested on purpose, so the
sum does not move and only the decomposition of denoise gains a name.

sampler_updates agrees with dit_evaluations on the first-order arm, so that
arm cannot tell a real counter from an alias. The res_2s arm can, and is in the
gate for it: Ltx2Res2sDenoisingLoop never reaches this statement, so it counts
7 and 11 evaluations against zero updates.

What the gate does NOT prove, measured rather than assumed

A position is not a magnitude, and this is filed as #1884 by the change that
introduced the gate. Collapse either anchor onto its own Close() — the shape
of a refactor that hoists work out from under an anchor — and the full suite
stays green at 102 of 102 cases. Every clause survives a zero-width window, the
containment one vacuously, because a window with no interior contains nothing.
It hands about 229 us back to the residue on a fixture whose whole residue is
about 1.2 ms, while the anchor that was meant to name it measures 16.5 us. The
(4b) gap gate cannot see it either, because the collapse splits one gap into
two and leaves their sum alone.

It is disclosed rather than closed, and the records say precisely what may not
close it: any floor whose denominator is the INSTRUMENT, the wall, or a
written-down number of seconds. Each of those asks how many seconds a seam
SHOULD hold, and ## Design 3 is the measured record that the honest answer is
a property of the box rather than of the tree.

That ban does not reach every magnitude clause, and the next traceable
hypothesis is named rather than left open: the anchor's own extent against the
SEAM its two neighbours define, both measured in the same run — near 1 honest,
near 0 collapsed, with the region being named as the denominator instead of the
instrument. It is recorded in the spec, the issue index and #1884 as a candidate
needing its own constant, its own cross-box distribution, its own red-first
measurement and its own fresh review.

This is the third appearance of one shape. test_ltx2_video already records the
first for decode.audio.mel, and #1568 is the second one level down.

Evidence

Red first, and captured: the anchors absent (emitted 0 time(s)), then the
counter at zero, then each assertion failing before it passed. Seven mutations,
each with its anchor asserted UNIQUE before it was applied, its application
verified by hash, its build's exit code checked, and the tree restored and
re-hashed byte-for-byte. Six are guarantees and all six red; the seventh is the
#1884 hole and is green by disclosure. The harness rejected three earlier
mutations of its own first — one non-unique anchor, one semantic no-op that read
green, one that did not compile — which is why it checks those things.

Reachability is proven by deleting each production call site in a tree that
still compiles: both red. The anchors sit in Ltx2VideoEngine::Load and
::Generate, which the loader path the gate uses, the C ABI and the server all
reach.

Not load-flaky, which is the property a structural gate should have and the
reason the instrument-relative bound was withdrawn: 8 runs of 8 green at loadavg
25.98 to 37.92, on one binary, while a second build saturated the box.

Three fresh reviews, each followed by a repair. The first falsified four claims
the tree made about itself — including the assertion that any wrong placement
fails outright, which is false for the placement that names nothing — and
reproduced the #1884 collapse on both anchors at once. The second found that
repair had replaced a correct citation with src/capi/vllm_c.cpp:1667, a blank
line, and that the prohibition protecting #1884 was worded so broadly it
forbade the candidate discriminator recorded beside it. The third found that
contradiction still standing in the ### M7 section that ## Stop conditions
cites as its authority, and in #1884's own forge body. All are repaired; nothing
in any repair changed an assertion.

What this does not do

#1567 and #1568 are UNBLOCKED and neither is closed. #1567 wants the res_2s
arm's anchor, which needs a hook rather than a statement and which no gate in
this tree renders, so landing it beside the first-order arm would land dead
code; the zero it reads is now asserted, so any hook that lands has a counter to
check against. #1568 wants the seconds-transfer gate; denoise.update's
part_min_coverage is 0.0 and the note beside it carries the measured reason
rather than a number, because the honest share and the transfer overlap and any
floor that reds one reds the other. #1439 stays open and is not touched.

The row still has no matrix row. Its spec said whoever landed #1668 would create
it; that is declined with a reason recorded in ## Now, because #1567, #1568,
#1570, #1572 and now #1884 are open under this spec, and a row announcing DONE
would contradict five of its own entries.

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5 [claude-code]