Found by review of #661 (row LTX25-RETIRE-DEAD-ARMS) as finding F5, and filed rather than fixed there because it needs its own red-first change.
What is gated today
Ltx2UnportedPipelineFeature now separates two kinds (spec ltx25-retire-dead-arms.md §1.6):
- a reachable refusal — a product path constructs the condition and throws, so a caller can trip it (
kTemporalUpsampler, kBetaScheduler);
- a declared-out-of-scope marker — nothing a caller can send reaches it, and its message says
DECLARED, NOT REQUESTABLE (kLoraFusion, kInt8ConvRot, kMultiGpuParallelism).
tests/vllm/models/test_ltx2_pipeline.cpp, case "ltx2 every out-of-scope feature is refused BY NAME", gates that split. The review confirmed it is not tautological in the direction it tests — both directions were mutated and both fire: adding marker to the reachable kBetaScheduler REDs it, and dropping marker from kLoraFusion REDs it.
What is not gated
It gates the text of the message, not the property the text claims. Nothing asserts reachability itself, so the two can diverge silently:
Add a real product call site for kLoraFusion — say, a lora_path load extra that constructs the fusion condition and throws. Change nothing else. The ledger test still passes, because kLoraFusion's message is unchanged and still contains DECLARED, NOT REQUESTABLE. The shipped error now tells a caller "no request field or load extra asks for this" immediately after they asked for it through a load extra.
That is the same class of defect the row closed: a message asserting a property of the code that the code no longer has. It is worse here than in the original because the false claim is in a refusal the user reads at the moment they are being refused.
The model to copy
test_ltx2_video.cpp, "ltx2 video: every accepted load extra is READ by something", is anti-tautological and is the shape to follow. It does not compare kKnownLoadExtras against a copy of the list kept in the test — it parses the accepted set out of the product's own unknown-extra refusal, which is built from kKnownLoadExtras itself, and then counts the names. Adding an eleventh key to the array REDs it (mutation-verified). The list in the test cannot be right by construction, because it is checked against the array the product actually uses.
The equivalent here needs the ledger's reachability claim to be derived from the tree rather than restated in the test — e.g. deriving each enumerator's product call sites (src/, include/, examples/, excluding tests/) and requiring the derived set to be non-empty for exactly the enumerators whose message omits the marker. test_ltx2_video's "the recorded reader anchors are the ones in the source" case (added by #661) is a working precedent for deriving a claim from a source file inside a doctest suite.
Done when
Related: #644, #611, #604.
Found by review of #661 (row
LTX25-RETIRE-DEAD-ARMS) as finding F5, and filed rather than fixed there because it needs its own red-first change.What is gated today
Ltx2UnportedPipelineFeaturenow separates two kinds (specltx25-retire-dead-arms.md§1.6):kTemporalUpsampler,kBetaScheduler);DECLARED, NOT REQUESTABLE(kLoraFusion,kInt8ConvRot,kMultiGpuParallelism).tests/vllm/models/test_ltx2_pipeline.cpp, case "ltx2 every out-of-scope feature is refused BY NAME", gates that split. The review confirmed it is not tautological in the direction it tests — both directions were mutated and both fire: addingmarkerto the reachablekBetaSchedulerREDs it, and droppingmarkerfromkLoraFusionREDs it.What is not gated
It gates the text of the message, not the property the text claims. Nothing asserts reachability itself, so the two can diverge silently:
That is the same class of defect the row closed: a message asserting a property of the code that the code no longer has. It is worse here than in the original because the false claim is in a refusal the user reads at the moment they are being refused.
The model to copy
test_ltx2_video.cpp, "ltx2 video: every accepted load extra is READ by something", is anti-tautological and is the shape to follow. It does not comparekKnownLoadExtrasagainst a copy of the list kept in the test — it parses the accepted set out of the product's own unknown-extra refusal, which is built fromkKnownLoadExtrasitself, and then counts the names. Adding an eleventh key to the array REDs it (mutation-verified). The list in the test cannot be right by construction, because it is checked against the array the product actually uses.The equivalent here needs the ledger's reachability claim to be derived from the tree rather than restated in the test — e.g. deriving each enumerator's product call sites (
src/,include/,examples/, excludingtests/) and requiring the derived set to be non-empty for exactly the enumerators whose message omits the marker.test_ltx2_video's "the recorded reader anchors are the ones in the source" case (added by #661) is a working precedent for deriving a claim from a source file inside a doctest suite.Done when
DECLARED, NOT REQUESTABLE, and when a reachable enumerator loses its last call site while its message does not..agents/verification.md.Related: #644, #611, #604.