[raylei50653]

This is a docs-only writeback of the #549 S2-1 contract status. The owner authorized it for documentation and review only; it does not authorize a merge. The authorization is recorded verbatim in #550 comment 6106062419.

Baseline: main@c5ddf51c62c382b8f6851c57bb07b2b72d18d083, the #576 merge commit. Its parents are f06c9062 and the reviewed head f294459e. The evidence sources are the S2-1 checkpoints already published:

• #549 checkpoint
• #536 status
• [Hub] SACCADE 工作總入口：進度、優先序、依賴與 checkpoint #550 row 3A

Status vocabulary used

Term	Meaning in this PR
accepted target	Design accepted (ADR 028 D1–D7); not implemented
source-level implemented	Merged in #576 and covered by CI ctest and/or local tests. Not runtime, GPU, installed-package or production qualification
verified	Only where a named CI run or local check is cited, and only for the scope that run covers
UNRESOLVED / UNVERIFIED / unproven	V5 qualification / installed package / runtime equivalence

Changes and their evidence

1. docs/architecture/ship_export_contracts_536.md (CC-536-01-02, the single status writer)

• Terminology line, §1 legend, §4 intro. These now say manifest-mode N-T3 is source-level implemented. That covers the TR-1b expected source, the expected_source_verified decision, --require-identity and Gate B load_verification.
  • Still accepted target: the formal shipping policy (the installed launcher default, S2-3) and loaded_buffer (S2-2).
  • The card is still not complete.
  • Evidence: feat(shipping): #549 S2-1 model-bundle manifest mode, TR-1b allowlist and load verification #576 and c5ddf51c.
• expected_source_verified and "分階段強制" items. Each gets an appended "後續狀態" note: S1 picked TR-1b, and the level is reachable only in manifest mode with an approved entry. The production allowlist is empty.
  • The acceptance criteria themselves are unchanged.
  • Evidence: shipping/trusted_model_bundles.json has entries: [].
• Status headline. It now lists three implemented parts and the parts that are not implemented.
• New #cc-536-01-02-status-s2-1 block. It keeps separate:
  • merge SHA and parents;
  • design, implementation and merge authorizations;
  • PR CI 38114298315 + C++ 38114298365;
  • main CI 38115253152 + C++ 38115253145, 8/8 with headSha = the merge SHA and pytest 5393 passed;
  • review rounds (Codex 3 findings, owner 1, final re-review with no findings; none is a GitHub APPROVED review);
  • coordinate chore(provenance): #549 S2-1 runtime coordinate republication r3 (stacked review) #578 r3 (implementation 1f50133b…, equivalence=unproven);
  • the unverified items (V5 UNRESOLVED, manifest MOT equality diagnostic only, installed package UNVERIFIED with the pin still on e0eab2f7, equivalence unproven, local-only);
  • known limits (TOCTOU, no version/SM/dtype gate, hardlink, runtime prefix).
• Smaller fixes.
  • The feat(shipping): observe legacy Gate A checksum identity (S2-1a) #572 legacy block gets a parenthetical: from S2-1 on, legacy mode writes v3/v5 plus load_verification.
  • The §5 N-T3 index row is updated.
  • §6 item 4 is now "partly done".

2. docs/decisions/028-model-bundle-runtime-separation.md

• Removed: "沒有任何部分已實作或驗證".
• Added: an #implementation-status paragraph that only references the CC-536-01-02 block. Per decision item:
  • source-level: D2 mechanism (empty allowlist), D3, the S2-1 part of D4, D6, D7, and the Gate A/B writer boundary;
  • accepted target: D1 package split and the D4 launcher default (S2-3); D5 loaded_buffer and the version/SM/dtype gates (S2-2); TR-2;
  • unverified: V5, package, equivalence, local-only.
• Scoping:
  • The baseline sentence is now limited to §1–§2 at 46ab79c1.
  • A note after the §3 diagram maps the target nodes to their S2-1 status: GA2 and T3 implemented; GB2 partial; N-M1..M5 not built.
• Unchanged: the decision text D1–D7 and the Status line ("Accepted — S1 design targets only").

3. docs/architecture/model_bundle_contract_549.md (S1 contract)

• Status paragraph. "沒有任何介面已實作或驗證" is replaced by an #implementation-status paragraph with the same split.
• "S2-1 狀態" notes, by section:

Section	Note	Evidence
§1	the pytest still checks design only; a C++ reader ctest now replays the matrix rows; the matrix current column stays the S1 baseline	coverage JSON
§2 resolved bindings	implemented	detector_plan.hpp, detector_host.cpp
§3.1	schema checks all fields; compatibility.targets and io get schema/R-08 checks only, with no version/SM/dtype gate (S2-2)	model_bundle.cpp validates target() with schema only
§3.2	R-01..R-08 in the manifest reader, R-09 in the allowlist reader, both in model_bundle.cpp
§3.4	step 1 implemented (default none, legacy capped at checksum_matched, both modes v3/v5); step 2 is S2-3
§4.1	load_verification is source-level implemented; loaded_buffer is unreachable and stays S2-2	RunCompletion::record_load_verification
§4.3	per-VL status; VL4 has no qualified parity, V5 UNRESOLVED
§5	rows implemented vs S2-2/S2-3	coverage JSON
§6	new per-gap S2-1 table; the baseline columns are not rewritten
§7	S2-1 marked merged, with two recorded departures from the original suggestion: no entrypoint re-pin (package UNVERIFIED), and the GPU smoke is diagnostic only
§8	scoped to the S1 design PR #571

4. docs/reference/model_bundle_s2_1_549.md (evidence page)

• Status paragraph: "候選分支（Draft PR，未 merge）" becomes merged, source-level.
  • The CC-536-01-02 S2-1 block is the status writer.
  • The per-layer results were taken on the final head; local/GPU evidence was not re-run on the merge commit, whose tree is identical.
• Rows that said "pending" / "待審" / "再審待做":
  • PR CI and main CI now have their run links.
  • The stacked coordinate review is done.
  • The final re-review found no findings.
• Unchanged: the evidence rows themselves (V5 UNRESOLVED, package UNVERIFIED, SHA256SUMS).

5. docs/reference/README.md: the S2-1 and S2-1a index rows say "source-level 實作（#576／#572 merged）" instead of "候選實作".

Verification

• scripts/tools/check_doc_links.py: all 3123 relative links resolve. The new anchors #cc-536-01-02-status-s2-1 and #implementation-status were checked by hand.
• scripts/tools/check_doc_structure.py --strict: no state-projection violations. The 2 S2 warnings were already on main and are unrelated.
• git diff --check: clean.
• tests/contract/test_model_bundle_contract_549.py: 30 passed.
• Local scripts/pre_push.sh on the clean committed tree passed (exit 0) at both heads, and HEAD did not change during either run:
  • 120b83c9: 5650 passed, 52 skipped, 105 deselected, 5 xfailed;
  • e1e6a691: same counts. No C++ or determinism-sensitive changes were detected.
• Independent Codex read-only review (codex exec --sandbox read-only). This is not a GitHub APPROVED review.
  • Round 1 (120b83c9): 2 findings, both fixed in e1e6a691.
    • P2: the evidence page said "CI 不 build binary", but cpp_build.yml does compile saccade_track. The wording now separates compilation from the pytest job, which has no binary, so the CLI suites skip there.
    • P3, already on main: the C++ reader replays 23 schema/semantic negative rows (MB-01/MB-02 are positive controls), not 25.
  • Round 2 (e1e6a691): No findings.
  • Raw outputs are local only (gitignored results/549_s2_1_docs/).
• PR CI 7/7 SUCCESS at head e1e6a691: CI 38117718109.
  • Jobs: lockfile, shipping-config-loader, contracts, pytest (5393 passed, 249 skipped, 105 deselected, 4 xfailed), ruff, mypy, lint-typecheck.
  • The C++ build was not triggered, because this PR is docs-only. This result is not reported as 8/8.

Not changed / not claimed

• No changes to: runtime, C++, Python, tests, CI, configuration, allowlist, artifacts, package, runtime coordinate, or verification_matrix.json (its current column stays the S1 baseline).
• No change to any contract's acceptance criteria.
• Residual: the reading string in model_bundle_s2_1_coverage_549.json still says CI "builds none". That is accurate only for the pytest job, since C++ CI compiles saccade_track but never runs it. The file is contract-test data, so this PR does not edit it.
• Not started: S2-2, S2-3, package re-pin, approval of a real allowlist entry, public distribution.
• Not claimed: runtime, GPU, installed-package or production qualification. V5 UNRESOLVED, installed package UNVERIFIED, equivalence unproven, distribution.status=local-only.
• Merge: not authorized. Merging needs a separate owner authorization pinned to the final head.

🤖 Generated with Claude Code

[raylei50653]

Owner merge authorization (recorded verbatim)

The owner gave this authorization in the working session, not on GitHub. It is copied here verbatim before merging, so it can be traced. Pre-merge check: head e1e6a691f607ecb63ebaecfe66ddad51a08f552d unchanged, base c5ddf51c = origin/main, MERGEABLE/CLEAN, PR CI 38117718109 SUCCESS (7/7), diff limited to the 5 agreed files.

---

Owner Merge Authorization — PR #579

批准將 PR #579 從 Draft 轉為 Ready，並使用 merge commit 合併至 main。

鎖定座標

• Repository: raylei50653/saccade
• PR: #579
• Head: e1e6a691f607ecb63ebaecfe66ddad51a08f552d
• Base: c5ddf51c62c382b8f6851c57bb07b2b72d18d083
• PR CI: 38117718109 — SUCCESS

執行授權

1. 合併前再次確認 head 未變、mergeable/CLEAN、CI 成功且變更仍僅限原定五份文件。
2. 將 Draft 轉為 Ready，使用 merge commit 合併。不得 squash、rebase 或加入額外修改。
3. 合併後核對 merge SHA、雙 parents，以及合併後 tree。
4. 確認 main CI 與 C++ Core Build 全部成功，並核對兩者的 headSha 均等於實際 merge SHA。
5. 在 [Architecture umbrella] Separate model artifacts from Saccade runtime and release lifecycle #549、architecture(B): design a supported architecture with traceable diagrams and behavior contracts #536、[Hub] SACCADE 工作總入口：進度、優先序、依賴與 checkpoint #550 記錄實際合併結果與證據邊界；不得提前宣稱 main CI 已通過。

驗證與範圍限制

• 此次僅批准文件狀態回寫，不代表新的 runtime、GPU 或 installed-package 驗證。
• Production allowlist 仍為空；expected_source_verified 不可達。
• load_verification 最多為 hashed_before_load。
• MOT text equality 僅為 diagnostic，不構成 parity。
• V5 維持 UNRESOLVED；installed package 維持 UNVERIFIED；equivalence 未證明。
• Distribution 維持 local-only。
• model_bundle_s2_1_coverage_549.json 的既有措辭問題另外追蹤，不得藉本次合併擴大修改範圍。

若合併前 head、變更範圍或必要檢查狀態改變，停止合併並重新審查。

本授權不包含 S2-2、S2-3、package re-pin、allowlist entry approval、V5 recheck 或 public distribution。上述工作均需獨立授權。