fix(LTX25-DEVICE-SEAM-SIBLING): the third question, and a leakage bucket that is a property rather than a spelling (#659, #660)

[localai-bot]

Implements the committed spec .agents/specs/ltx25-device-seam-sibling.md.

Issues: #659, #660. Campaign: #644.

The two defects

#659 — the seam was adopted, its companion guard was not. 11cc1d589 routed
LTX-2.5's device question through the platform seam and asked two of the three
questions its own cited precedent asks. src/vllm/entrypoints/model_loader.cpp:97
also asks plat.supports_model_architecture(architecture), which exists so a
PARTIAL backend can decline by name. src/vllm/platforms/metal.cpp:70 and
src/vllm/platforms/tenstorrent.cpp:52 are the only two overriders and both
declare {"OPTForCausalLM", "Qwen3ForCausalLM"}. On those builds a device = 1
LTX-2.5 load was refused by name and had become a queue bind that dies later
inside a kernel. CUDA is unaffected, which is why it is invisible on the gate box.

#660 — the gate that certified it is a token grep.
scripts/check-device-leakage.py's kcuda bucket is \bkCUDA\b.
src/vllm/multimodal/minimax_h3_video.cpp:225 (pre-change) wrote
static_cast<vt::DeviceType>(device) against kCUDA = 1 and scored zero,
while tests/vllm/models/test_minimax_h3_video_fold.cpp:162 spelled the token
honestly and was counted. The gate read the confession and missed the act.

The load-bearing claim: dev_cast is a property, not a spelling

A bucket that grepped static_cast<vt::DeviceType> would close the one site we
found and be the same defect one spelling later. The bucket is anchored on the
target type, matched over the whole comment-stripped text, and is asserted
RED for ten spellings that are not in the tree, each individually:

Mutant	Spelling planted	Added
M20	C-style (vt::DeviceType)d
M21	functional vt::DeviceType(d)
M22	intermediate int + unqualified static_cast<DeviceType>(raw)
M23	brace vt::DeviceType{d} (unnamed temporary)
M24	cast split across two lines by clang-format
M29	C-style past the parameter-declaration discriminators, with a literal )1, a signed literal )-1 and an identifier operand	review
M30	global-scope static_cast<::vt::DeviceType>(raw)	review
M31	elaborated static_cast<enum vt::DeviceType>(raw)	review
M32	list-init in a declaration, vt::DeviceType dt{raw}	review
M33	pointer punning *reinterpret_cast<vt::DeviceType*>(&raw)	review

Each goes RED with DSR REGRESSION in bucket 'dev_cast': 1 > baseline 0 — except
M29, which appends its three operand kinds to the same false-positive fixture and
so reds at 1 >, then 2 >, then 3 > baseline 0, proving the discriminators
cost none of them.

M22 is the one that separates "anchored on the target type" from "anchored on
the operand": the thing cast is neither a literal nor the parameter, and the
qualifier is dropped.

Negatives, so the bucket stays usable: M25 (static_cast<int>(t) and
static_cast<size_t>(t) — the safe direction, and how the seam indexes its own
registry — do not count), M26 (prose and string literals do not count), M27 (the
platform registry walk is allowlisted at exactly one; a second cast in that
file still fails), M28 (DSR-ALLOW exempts a dev_cast and is printed loudly),
M29 (a parameter declaration is not a cast).

Negative M34 (review): a function definition whose return type is
DeviceType is not a conversion. Not hypothetical — the first cut of M32's
declaration form accepted ( as well as { and produced three false positives
on the real tree, including MiniMaxH3VideoDeviceType and
ResolveExplicitDeviceType. The declarator form takes { only, which costs
nothing real because vt::DeviceType dt(raw) is ill-formed.

Residual blind spots, recorded in the checker's own docstring because a
checker's message is the authority on what it enforces: casts through a type
alias, a macro, or a template parameter; bit_cast/memcpy/union punning
(the pointer-cast spelling is now caught — these three are not, because no
spelling of the target type appears at the site); conversions inside the
unscanned src/vt/ device leg; and the fact that nothing type-checks the
operand, so the bucket flags every cast to DeviceType and relies on
DSR-ALLOW for a legitimate wire-format decode — which is also why a pointer
target counts, since const_cast<DeviceType*>(p) removes const rather than
converting, and buys its exemption the same way.

metal.cpp / tenstorrent.cpp run no diffusion model

Checked before assuming, per spec §5. Searched their own vocabulary over
src/vllm/platforms/{metal,tenstorrent}.cpp and src/vt/{metal,tenstorrent}/
with OPTForCausalLM as a positive control in the same command: the control
hit 3 times, ltx|minimax|h3|diffus|video hit 0. The guard refuses nothing that
works today, so §6's NEEDS_DECISION stop condition is not triggered.

Baseline: every line touched, with its reason

scripts/device-leakage-baseline.json — one added line, no changed value:

+    "dev_cast": 0,

total stays 32 and every other bucket is byte-identical. The key is
required because load_baseline() reads every entry in BUCKETS; the value is
0 because the H3 site is repaired rather than absorbed, and the platform
registry walk is allowlisted with a stated reason rather than counted. No number
in this file goes up. (A peer measured that --write-baseline refuses to raise
the baseline but that hand-editing the JSON higher makes the checker PASS — so
this diff being two lines and visible is the only real defence, and it is stated
here for the reviewer to check by md5 against the base for every other key.)

The one judgement call

supports_model_architecture is asked with the family string (ltx-2.5,
minimax-h3), not an HF architectures[0] class name. The diffusion lanes are
reached through LoadVideoEngine/VideoModelParams::family and never read an
architectures entry, so the family slug is the only stable identifier they
have — and it is the string the user actually typed, which is what the refusal
names. It does mean the seam's key space now mixes HF class names with family
slugs. They cannot collide. Flagged rather than buried.

A disagreement between the dispatch brief and the spec, resolved in the spec's favour

The brief said test_minimax_h3_video_fold.cpp:161-164 must stay green
unchanged. The spec's §4.2 enumerates the contract as 0 → kCPU, -1 and
2 throw, and separately requires that on a CPU-only build 1 is refused.
Line 162 asserted MiniMaxH3VideoDeviceType(1) == kCUDA — precisely the cast's
answer — and cannot survive the change. It is now build-conditional and asserts
both arms rather than skipping either: == accelerator where one is
registered, refused-by-name where none is. 161/163/164 are untouched.

The review upheld this and corrected the other half of it — see the review
section below: the build-conditional form was right, but the predicate choosing
between its arms asked two of the three questions and so red on a correct
refusal.

Relatedly, that file's CUDA-load case registered a backend and no
platform — it could, because the cast never asked whether the build had an
accelerator. It supplies both halves now. That is the defect being visible, not
a harness concession: a build with a CUDA backend registered and no CUDA platform
is not a build that runs on CUDA.

Out of scope, held to

• No change to what CUDA does. supports_model_architecture defaults to true,
  so CUDA and CPU selection is byte-unchanged; the existing suite passing
  unchanged on this box is the gate for that.
• No other baseline key touched.
• No change to the H3 video engine's model behaviour — device resolution only.
• src/vllm/multimodal/video_engine.cpp untouched (video_engine.cpp reaches Windows with unguarded POSIX stat — reddens windows-msvc-* on EVERY open PR #664 / PR fix(#664): the video registry's existence probes stop reaching Windows with POSIX stat #677 own it).

Review repair (findings from the review of 094ac9e4)

The review returned FAIL with sound core work: it reproduced every green and
every claimed mutation, verified branch orthogonality, confirmed the baseline
diff by hash, and independently planted three fresh spellings that each went RED.
Four findings, all repaired here.

F1 (High) — the bucket missed the purest form of the defect, and the test that
was supposed to rule that out could not see it.

(vt::DeviceType)d    -> dev_cast 1, RED     (what M29 asserted)
(vt::DeviceType)1    -> dev_cast 0, GREEN   <-- MISSED
(vt::DeviceType)-1   -> dev_cast 0, GREEN   <-- MISSED

The C-style alternative's trailing lookahead admitted only [A-Za-z_(], and 1
is a digit. A C-style cast of an integer literal — the device named by its
raw enum value — is exactly what this bucket exists to police, so the one form it
could not see was the one form it was for.

What makes it High rather than a nit: this PR asserted that the M29
discriminators cost nothing, and they cost this — while M29's own "did not cost
the real thing" assertion used an identifier operand, so the test could not
detect the gap it was written to rule out. A guard that certifies itself is the
exact disease this row exists to fix, reproduced inside the row's own instrument.
M29 now pins the literal first, then the signed literal, then the identifier,
all in the same file as the false-positive fixture.

Re-derived rather than taken on report: over src/vllm + include/vllm, 720
files, with \bDeviceType\b = 162 matches as a positive control in the same
command, admitting 0-9+- adds zero hits and loses none. The only raw match
under either pattern is platform.cpp:85's allowlisted registry-walk inverse.

F3 (Medium) — the docstring under-reported, and three cast keywords were dead.
Four more plain spellings read GREEN in scanned files. Each was compile-checked
as legal C++ before being called a blind spot, and each is now closed (see the
M30–M33 rows above). The pointer target is what makes the keyword list honest:
reinterpret_cast, const_cast and dynamic_cast to a scoped enum are
ill-formed — compile-checked, all three rejected, with static_cast as a live
control that compiles — so before this change those three keywords could only
ever have matched code that does not build. They created an appearance of
coverage the pattern did not have. Matching a pointer target makes them live
rather than dropping them.

F2 (Medium) — the row added a test that FAILS on the build class #659 exists to
serve. test_minimax_h3_video_fold.cpp's have_accelerator asked two of the
three questions (device_type() != kCPU && TryGetBackend() != nullptr). On Metal
or Tenstorrent both are true, so the test took the == accelerator arm while the
source correctly refused, and the refusal surfaced as an uncaught exception.
Proven by mutation, not deduced — a DecliningPlatform registered in the XPU
slot, production code untouched:

	result
before (2-question predicate)	:247 ERROR: CHECK( MiniMaxH3VideoDeviceType(1) == accelerator ) THREW … "DECLINES the architecture 'minimax-h3'" — 6 cases, 5 passed / 1 failed, 137 assertions, FOLD_EXIT=1
after (3-question predicate)	6 cases, 6 passed / 0 failed, 137 assertions, FOLD_EXIT=0

So the row shipped a false RED on precisely the partial-backend build it was
written to protect — invisible on the CPU and CUDA boxes that run the gates,
which is this row's own thesis about #659 turned against its own test. The
predicate is now three-way and asserts which refusal, because a right refusal
for a wrong reason is a wrong diagnosis that reads as a right one.

F4 (Low) — an assertion that only checked absences. The "COMPLETE backend is
not refused" case checked that DECLINES and supports_model_architecture were
absent and never positively asserted that the load reached the missing
checkpoint, so it would pass on any other wrong failure. Mutation (an unrelated
Fail() planted after the capability clause): the two absence checks both
passed and only the new assertion caught it — 4 cases, 3 passed / 1 failed;
24 assertions, 23 passed / 1 failed; the failure at :178 on the /nonexistent/
path. ltx2_video.cpp restored and verified by sha256.

F6 — the decline consequence inverts the cited precedent (recorded in the
spec, no code change). model_loader.cpp:97's capability question lives on the
kAuto path, whose answer to a decline is to fall through to :103 and serve
on CPU; metal.cpp:65-69 states that policy in as many words. Both diffusion
lanes instead throw. That is correct — device = 1 is an explicit
accelerator request, and model_loader.cpp:71-72 already says an explicit
accelerator must fail loudly rather than silently serve on CPU — but this PR
described the change as mirroring the precedent, and it mirrors the question
while inverting the consequence. Both halves are the seam's own, taken from two
different paths of it. Also recorded: vulkan.cpp does not override
supports_model_architecture, so a partial Vulkan build still binds and dies.
Residual, not this row's to fix.

New-branch orthogonality

Each of the five new capabilities REDs its own mutant and no other; the
unmutated suite REDs none. Checker restored and sha256-verified after every one.

Capability removed	RED
digits/sign in the C-style lookahead (F1)	M29
global-scope :: in the qualifier (F3-a)	M30
elaborated enum in the qualifier (F3-b)	M31
the named declarator list-init (F3-c)	M32
the pointer target (F3-d)	M33

M34 is proven the same way in reverse: re-admitting ( to the declarator form
makes it RED at 4 != 0.

Landing: rebuilt onto origin/main, twice, and one keyed record RETIRED rather than reapplied

The branch was rebuilt, not just merged, because four of its commits could never
have landed. 78f401796, b73d4576f, 966e4883f and 79ebbce42 carried
Assisted-by: AGENT:claude-opus-5[1m] [claude-code]. Brackets are the TOOL slot;
scripts/check-commit-trailers.py:20's grammar has no bracket in the model token,
so the strict per-commit walk CI runs over base..head fails on all four no
matter what the tip looks like. Only those four message lines were rewritten. The
pre-merge tree is byte-identical to the previous head bf8bb745b — the same tree
object 6ab028f8c — and the branch topology is unchanged, so this is the same
change with four commit messages repaired.

The conflict was .agents/roadmap_v1.md, and the resolution is to write
NOTHING there. Main's version was taken wholesale, per the keyed-record rule.
Then the scoped edits were not reapplied, and that is the finding rather than an
omission. Both edits lived in the ## Open issues table, and
#840 (POLICY-ISSUE-INTAKE)
moved that whole table out to the new append-only .agents/issue-index.md. Under
that regime a row is appended and never edited; GitHub holds the open and closed
state, so closing #659 and #660 costs the index no edit at all. This branch's
in-place annotation of those two rows is exactly the FIXED IN FLOW shape that
spec retired, and a union driver would have duplicated it rather than merged
it. The evidence it carried is not lost — it is in this row's spec, which is the
surface that owns it.

Proved by comparison rather than by eye:

record	diff vs origin/main
.agents/roadmap_v1.md	0 lines
.agents/issue-index.md	0 lines
scripts/check-issue-index-append-only.py --base origin/main --head HEAD	OK: issue index append-only (0 rows removed, 0 edited)

LTX25-DEVICE-SEAM-SIBLING has no portfolio row in roadmap_v1.md either —
checked with ENG-WEIGHT-OFFLOAD at 2 hits as a positive control in the same
command — so there is no lifecycle write owed and docs/STATUS.md /
docs/BENCHMARKS.md stay untouched. The spec's ## Now now says all of this,
because it previously claimed a table that no longer exists.

origin/main then moved again, mid-gate. It is a shared ref in a shared
checkout, and a peer session's fetch advanced it from 4a4ab89cb to 62406c30e
while this branch was building. The tell was a git diff origin/main HEAD that
grew from 11 files to 24 and showed this branch deleting
docs/WEIGHT-OFFLOAD.md, which it has never touched. Nothing was wrong with the
branch; the denominator moved. Everything below is therefore measured against
refs/pinned/main671, a local ref pinned at 62406c30e, so the gate and the push
agree on one tree. The second merge was conflict-free and the two record checks
above were re-run against the new tip rather than inherited.

Diff, measured rather than copied: 11 files, +1733 / -13 against
62406c30e. (The body previously said 12 / +1706 / -15; the twelfth file was
roadmap_v1.md, which is the file this section explains away.)

Where the rebuilt history is. Rewriting four commit messages makes the new
history a non-descendant of the old head, so publishing it on
row/LTX25-DEVICE-SEAM-SIBLING needs a force update of that ref. This session
does not hold that authority and did not work around it. The gated head is
7502004aa, pushed with a plain non-forcing push to
row/LTX25-DEVICE-SEAM-SIBLING-REBUILD. Everything measured in this body is
measured on that SHA. The operator repoints this pull request at it — either by
force-updating the row branch to 7502004aa, or by moving the pull request to
the rebuild branch — before landing. The old head bf8bb745b carries the same
tree and four commit messages that cannot pass check-commit-trailers.py.

scripts/device-leakage-baseline.json re-checked against the new tip: one added
line, "dev_cast": 0, total still 32, every other bucket byte-identical.

Anchors re-derived at the merged tree, asserted UNIQUE

Every path:NN this row cites was re-resolved by pattern, and each pattern was
required to match exactly once in its file — existence is not enough, because
an anchor that still resolves can resolve to the wrong thing. 31 citations across
the spec and the row's own source comments. Five did not hold, and they split two
ways:

anchor	was	is	whose drift
model_loader.cpp:97 (the capability clause)	:97	:98	main's
model_loader.cpp:71-72 (explicit-accelerator polarity, F6)	:71-72	:72-73	main's
minimax_h3_video.h:63 (the preserved public contract)	:63	:69	already stale at bf8bb745b
ltx2_video.cpp:545-548 (the "refusal to fake it" argument)	:545-548	:562-565	already stale at bf8bb745b
minimax_h3_video.cpp's citation of ltx2_video.cpp:549-580	:549-580	:566-610	already stale at bf8bb745b

Three of the five rotted inside this pull request, shifted by its own later
commits — which is the recorded-anchor failure mode this repository already has a
name for, and nothing but re-derivation notices it. All five are corrected.

The spec's own scanned-file figure was re-derived too, since it carries a SHA
precisely because it rots: 776 files at this merge, controls
\bDeviceType\b = 163 and \bkCUDA\b = 18. kCUDA is unchanged and
DeviceType moved by one — the invariant that section claims — against +11 on the
count, the thing it predicts. Two measurement traps are now written beside the
number because each made a correct recorded figure read as wrong: the controls
are counted over the comment-and-string-stripped text (raw source gives
177 / 82), and the enumeration must be the checker's own rglob, since a
git ls-tree walk filtered by string prefix swallows include/vllm.h and returns
777.

Mutation table — every guarantee neutralised, rebuilt, and re-run

Mutated, not read. Each row records whether it built, because a mutation that
fails to compile reads as a passing test and has produced false verdicts on this
campaign before. Every file was restored and verified by sha256 after each
mutation, and git status --porcelain carried no product-file entry afterwards.

#	guarantee	mutation	built?	verdict
MU1	#659: ltx2_video refuses device = 1 by name when the platform declines the architecture	if (false && !platform.supports_model_architecture(kLtx2VideoFamily))	YES	RED — test_diffusion_device_seam exit 1, 4 cases / 3 passed / 1 failed, 24 assertions / 19 passed / 5 failed
MU2	#660: MiniMaxH3VideoDeviceType resolves through the seam, not by integer cast	the pre-change defect restored verbatim: return static_cast<vt::DeviceType>(device);	YES	RED — test_minimax_h3_video_fold exit 1, 6 cases / 5 passed / 1 failed; FATAL ERROR at test_minimax_h3_video_fold.cpp:232, "device 1 must be refused when this build cannot honour it"
MU3	#659, H3 arm: the sibling lane asks the third question too	if (false && !platform.supports_model_architecture(kMiniMaxH3VideoFamily))	YES	RED — test_diffusion_device_seam exit 1, 4 cases / 3 passed / 1 failed
MU4	F4: the COMPLETE-backend case positively asserts the load reached the missing checkpoint	an unrelated Fail() planted after the capability clause	YES	RED — exit 1, 24 assertions / 23 passed / 1 failed; the single failure is :178, CHECK( msg.find("/nonexistent/ltx2-dit-that-is-never-opened.safetensors") != npos ). Both absence checks passed, exactly as F4 claims
MU5	#660: the dev_cast bucket is what the checker's suite is testing	RE_DEVTYPE_CAST replaced with a pattern matching nothing	n/a (Python)	RED — tests/scripts/test_device_leakage.py: 30 failed, 24 passed
MU6	#660 forward: the shipped gate now sees the act, not only the confession	the original defect restored in product source, checker unmodified	n/a (Python)	RED — dev_cast=1, total 33, ERROR: DSR REGRESSION in bucket 'dev_cast': 1 > baseline 0, exit 1

MU6 is the one that proves the row's thesis rather than its implementation. The
old kcuda token grep scored that exact line zero; the shipped bucket fails
the build on it.

Gate

CPU build, no CUDA, -j6, on the pinned tree 62406c30e + this branch.

cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DVLLM_CPP_CUDA=OFF
cmake --build build -j6
ctest --test-dir build -j4 --output-on-failure

axis	value
CONFIGURE_EXIT	0
BUILD_EXIT	0
edges built	1416 / 1416 — a full rebuild, not an incremental one
Building CXX / Linking CXX (positive controls)	930 / 480
: error:	0
warning:	1, and it is ninja: warning: premature end of file — zero compiler warnings
No space left	0
BFD assertion	0
ctest -N	478 registered
CTEST_EXIT	0
result	100% tests passed, 0 tests failed out of 478

Two tests did not run, both Skipped by their own guards and both pre-existing:
test_modelopt_mixed_precision_checkpoint and test_voxtral_e2e.

The counts moved because main moved: ctest -N was 456 when this body last
recorded it and is 478 now, across 31 commits of origin/main.

Nothing was charged to this branch. The full suite is green on this box, so
none of the known-flaky set (test_op_parity, test_openai_conformance,
test_serve_low_tools, test_cpu_threadpool) needed a serial re-run: all of them
passed under -j4.

scripts/agent-preflight.sh returns 9 red, and every one is demonstrated to
be main's rather than argued to be:

red	proof
check-release-binary-contract, check-release-workflow, check-test-registration, test_check_release_binary_contract, test_release_manifest, test_release_pipeline, test_check_test_registration	all seven re-run on a pristine origin/main worktree at 62406c30e and all seven exit 1 there. They read .github/workflows/ci.yml, and git diff origin/main HEAD -- .github/ is empty — positive control: the 11 files that DO differ are listed above
test_cpu_x86_llamacpp_floor	the recorded load artifact (#618). Its own message is the evidence: AssertionError: 4 != 2 with load=133.92 147.59 112.07 — exit 4 is NO_QUIET_WINDOW, the harness declining to measure, not a floor that was measured and missed
role-undeclared	a session-state gate, not a tree gate. Cleared: claimed role=helper row=LTX25-DEVICE-SEAM-SIBLING

Green in the same run and worth naming, because they are the ones this change
could have broken: check-agent-record, check-now-current, doc-checkpoint range, issue-index append-only, audit-live-rows, and the trailer and
commit-style suites.

Two instrument notes recorded rather than smoothed over, because both are the
shape that produces a false verdict here:

• The build directory's .ninja_log was corrupt (ninja: warning: premature end of file; recovering), so ninja silently re-did 821 test objects on every
  invocation and no build was ever recorded as finished. Deleting it is why the
  gate above is a genuine 1416-edge full build rather than an incremental one —
  an incremental green is not a clean green.
• The session scratchpad is shared between agents, and a foreign writer
  touched build.log two minutes after this session's build had written its
  exit sentinel. A build log whose mtime is later than its own sentinel is not
  this session's log. Every figure above comes from a private log directory
  instead.

Not merged with the newest main, deliberately. origin/main advanced three
times during this gate (4a4ab89cb → 62406c30e → b3d0f3ed5), and chasing it
means never finishing a gate. The gate above is on 62406c30e.
git merge-tree --write-tree origin/main HEAD against b3d0f3ed5 exits 0, so
the newer tip is conflict-free; the three commits it adds touch none of this
branch's 11 files. A clean merge-tree is not a merge that builds, which is the
operator's own rerun to make.

Build directory deleted after the run.

## Nothing lands dead (8f49ac3be, landed mid-gate)

The policy arrived on main while this was gating, so it is answered rather than
ignored. Nothing here lands unreached.

• ltx2_video.cpp's guard sits inside Ltx2VideoEngine::Load, which is what
  LoadVideoEngine and the video C ABI call. test_diffusion_device_seam enters
  through Ltx2VideoEngine::Load(mp) — not by hand-constructing an internal.
• MiniMaxH3VideoDeviceType has exactly one production call site,
  minimax_h3_video.cpp:343 in MiniMaxH3VideoEngine::Load.
• The proof the policy asks the reviewer for is already in the table above:
  MU1 and MU4 neutralise the production call site and the focused gate goes
  RED. A gate that stayed green without it would be measuring a class rather
  than a capability.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5 [claude-code]

[localai-bot]

F5 repaired, re-merged onto 33f570ea9, anchors re-derived

Head moves from 074ef1420. Three commits: the checker repair, the merge, the anchor/record round.

F5 — the docstring named the target type, the pattern named one sigil

The review's finding was one spelling. Deriving it from the property rather than from the example turned up nine, all of which write the target type at the conversion site — the very thing the docstring said the bucket is anchored on — and all of which scored 0:

spelling	why it slipped	before	after
reinterpret_cast<vt::DeviceType&>(raw)	reference target; the standard defines it as M33's pointer pun	0	1
static_cast<vt::DeviceType const>(d)	east const	0	1
static_cast<vt::DeviceType const&>(t)	east const + reference — compiles with no warning, so it survives -Werror where the prvalue form trips -Wignored-qualifiers	0	1
(vt::DeviceType const)d	east const, C-style	0	1
(vt::DeviceType)*cursor	trailing class admitted a sign, not a dereference — and this is the wire-decode spelling the docstring itself names as the expected DSR-ALLOW case	0	1
(vt::DeviceType)~mask	same hole	0	1
(vt::DeviceType)!flag	same hole	0	1
reinterpret_cast<vt::DeviceType**>(p)	\*? is one star	0	1
std::bit_cast<vt::DeviceType>(raw)	the docstring's own reason ("no spelling of the target type appears at the conversion site") is false for it	0	1

Every one is compile-verified legal — g++ -std=c++20 -Wall -Wextra -fsyntax-only, exit 0, individually — because a "miss" that does not compile is not a miss.

Three edits: the named-cast target takes cv-qualifiers on either side of the name and a run of */&; the C-style trailing class admits *~!; bit_cast joins the cast keywords.

What stays blind, and why the docstring now says so per-entry

& is deliberately not admitted after a C-style ): ) & and ) && are ref-qualifiers on a member declarator, which is exactly the false positive the trailing guard exists to reject, and it cannot tell void note (vt::DeviceType*) & from a pun. So the C-style pointer pun *(vt::DeviceType*)&x remains blind and is now named as blind with the reason true of it. The old blind-spot list gave one shared reason to three entries and that reason was false for one of them; each entry now carries its own.

Measured, with the positive control in the same command

Over 760 files in src/vllm + include/vllm on the merged tree, \bDeviceType\b = 162 matches as the positive control:

files examined                 : 760
POSITIVE CONTROL \bDeviceType\b: 162 matches over the same file set
dev_cast raw hits  SHIPPED     : 1
dev_cast raw hits  REPAIRED    : 1
NEW  (repaired - shipped)      : 0
LOST (shipped - repaired)      : 0
    = src/vllm/platforms/platform.cpp:85: static_cast<DeviceType>

dev_cast stays 0, total stays 32, device-leakage-baseline.json untouched this round.

M35-M40, each sub-spelling asserted individually

RED-before is real rather than narrated: with the pattern reverted in-process to its pre-repair value, M35-M39 all go RED while M20, M33 and M40 stay GREEN — so a blanket failure cannot pass for five findings.

M35  reverted-pattern verdict = RED    expected RED    -> ok
M36  reverted-pattern verdict = RED    expected RED    -> ok
M37  reverted-pattern verdict = RED    expected RED    -> ok
M38  reverted-pattern verdict = RED    expected RED    -> ok
M39  reverted-pattern verdict = RED    expected RED    -> ok
M20  reverted-pattern verdict = GREEN  expected GREEN  -> ok
M33  reverted-pattern verdict = GREEN  expected GREEN  -> ok
M40  reverted-pattern verdict = GREEN  expected GREEN  -> ok

M40 is the negative the widening could have cost: pointer- and reference-returning declarations, ref- and rvalue-ref-qualified members with a space before the paren, volatile members, std::vector<vt::DeviceType*> — all still 0.

Re-merge

29 behind, merge-tree conflicted. One conflict, tests/CMakeLists.txt: main added test_ltx2_image_cond at the same insertion point this row added test_diffusion_device_seam. Both pure additions, both kept, main's block byte-for-byte first. git diff 33f570ea9 -- tests/CMakeLists.txt is exactly this row's seven lines.

Keyed records were not taken on the auto-merge's word. .agents/roadmap_v1.md: 264 keys on both sides, 0 added, 0 removed, exactly #659 and #660 changed, 0 differing non-table lines. docs/USAGE.md differs by exactly this row's one paragraph. FEATURES.md / STATUS.md / BENCHMARKS.md untouched, so #769's duplicated Safetensors direct load key is neither fixed nor multiplied.

Anchors

9f2b9bb9a moved tenstorrent.cpp's supports_model_architecture :52 → :55. All four citations corrected, re-derived on the merged tree. metal.cpp:70, interface.h:263, model_loader.cpp:97 re-derived and still hold. All 103 distinct path:NN anchors in this row's files resolved mechanically; the only non-resolving ones are upstream Python paths and the two examples/*/main.cpp citations that carry @ fc636c76 and are provenance rather than drift. #794 is not widened here. minimax_h3_video.cpp:221-226 — the line this row removes — is now anchored on the spec's base SHA 11cc1d589, where git show resolves it to the exact static_cast.

[localai-bot]

Rebuilt and gated at 7502004aa — this pull request needs its head repointed

The conflict and the red are both fixed, but the fix cannot reach this pull
request's head without a force update of row/LTX25-DEVICE-SEAM-SIBLING, which
this session does not hold authority for and did not work around. The gated head
is 7502004aa on row/LTX25-DEVICE-SEAM-SIBLING-REBUILD, pushed with a
plain non-forcing push. The body above describes that SHA.

Two separate reasons this could not have landed as bf8bb745b.

1. .agents/roadmap_v1.md conflicted. It is a keyed record, so main's version was
   taken wholesale — and the scoped edits were then not reapplied, because
   Issue intake is a merge lock, and 33 of its 185 rows name no owner, so filing an issue defers the fix #840 moved the ## Open issues table to the append-only
   .agents/issue-index.md, where a row is appended and never edited. Both
   record files are now byte-identical to main (0-line diff each) and
   check-issue-index-append-only.py is green.
2. Four commits — 78f401796, b73d4576f, 966e4883f, 79ebbce42 — carried
   Assisted-by: AGENT:claude-opus-5[1m] [...]. Brackets are the TOOL slot, so
   the strict per-commit walk CI runs over base..head fails on all four
   regardless of the tip. Only those four message lines were rewritten; the
   pre-merge tree is byte-identical to bf8bb745b (same tree object
   6ab028f8c) and the topology is unchanged.

A third, which is why the body above was rewritten rather than patched: the
previous body itself failed the trailer contract — no bare
FOLLOWING_AGENTS_PROTOCOL paragraph and no trailer block. Since
squash_merge_commit_message = PR_BODY, that is the landed commit message, and
CI runs check-commit-trailers.py --message-file --filled on it. Worth knowing
for every other pull request here: a markdown --- rule anywhere before the
trailer block silently kills them, because git interpret-trailers treats ---
as the patch separator and stops reading.

Gate on 7502004aa: CONFIGURE_EXIT=0, BUILD_EXIT=0, a full 1416-edge
rebuild, 0 : error:, 0 No space left, 0 BFD assertion, ctest -N 478,
CTEST_EXIT=0, 100% tests passed, 0 tests failed out of 478. Six mutations, all
of which built and all of which went RED. Details in the body.

Merge-tree against the current origin/main (b3d0f3ed5) exits 0, so the rebuild
branch is conflict-free against a tip three commits newer than the one it was
gated on; those three commits touch none of its 11 files.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5 [claude-code]

[localai-bot]

Closing in favour of #898, which is this branch rebuilt onto current main.

Four commits here (78f401796, b73d4576f, 966e4883f, 79ebbce42) carry Assisted-by: AGENT:claude-opus-5[1m] [...]. The brackets are the tool slot only, so the model id is malformed, and CI walks trailers per commit over PR_BASE..PR_HEAD — those four fail regardless of what the tip looks like. A message cannot be corrected in place without rewriting history, and no force variant is used on this repository, so the branch was replaced rather than force-updated.

The content is unchanged. The pre-merge tree object is byte-identical to bf8bb745b — same tree 6ab028f8c — and the topology is unchanged. Only the four Assisted-by: lines differ. I verified the replacement range myself rather than taking the report: check-commit-trailers, check-doc-checkpoint, and check-commit-style all exit 0 over merge-base..7502004aa.

Two findings from the rebuild that outlive this PR:

A markdown --- rule anywhere before the trailer block silently destroys the trailers. git interpret-trailers treats --- as the patch separator and stops reading there. Since squash_merge_commit_message = PR_BODY, that makes a PR body with a horizontal rule fail the trailer contract while looking correct to a reader. This PR body had no trailer block at all, which is a separate defect, now fixed in #898.

Three of the five stale file:line anchors were already stale at bf8bb745b — shifted by this PR's own later commits, not by main. minimax_h3_video.h:63→:69, ltx2_video.cpp:545-548→:562-565, and an in-source citation :549-580→:566-610. Anchors rot inside a single PR, which is why #898 asserts each one matches exactly once rather than merely existing.

FOLLOWING_AGENTS_PROTOCOL