[raylei50653]

Summary

WorkbenchPool 清掉滿 queue 的 4 幀時，原本只記 drops=1。本 PR 保留 latest-wins／drain-all，將 drops／telemetry 改為實際丟棄幀數，另計 overflow_events、stop discard，以及各 stream 的連續 frame identity／可觀察 gap。並行 producer 的 drain-and-enqueue 以 per-stream lock 保護。

新的 admission lock 也納入 stop deadline；取得鎖逾時會保留資源、維持 STOPPING 並允許重試，已完成的部分清理不遺失也不重複計數。鎖可能改變競爭時實際交付的幀集合；沒有輸出／吞吐等價宣稱。

需求與選擇：owner F02 裁決、方案與交付紀錄。契約、首次失敗分類、真實 GPU 證據與 SHA-256 在 async_ownership_538.md §10。Refs #538、#550；本 PR 不關閉 parent issue。

Decision-layer change?

不修改 headline preset、eval schema／defaults、pipeline inject、tracker 決策 kernel 或 decision docs。dispatcher.py 屬 decision_relevant，風險為高：runtime identity 已經獨立兩檔 publication PR #636 審查並合入本 branch。本 PR 將實作與 coordinate 一次原子合入 main。

Behavior change?

• Yes — WorkbenchPool host admission／accounting／bounded stop。對應 30 CPU＋13 真實 CUDA 契約、fault injection 與 fresh identity probe。
• No — docs/tools/help only。

既有 offline eval／tracker 行為沒有修改；MOT17-09 identity probe 不被當成 7-seq performance／online qualification。

Adding, tightening, or retiring a check?

新增 regression tests，沒有修改 CI／hook／qualification 標準。

• Drift prevented：批次少計幀、並行 admission 未入帳、停止逾時或重試漏算／重算。
• Entry points：既有 pytest／pre_push／CI collection。
• Disposition：行為斷言失敗即拒絕；修正實作後重新驗證，不放寬 accepted contract。

Test plan

• 43 focused CPU／GPU contracts passed，0 skipped；包含真實 CUDA preprocess／batcher、TRT inference 替身。
• 6 個隔離 mutation 均由行為斷言攔住。
• Fresh native build、MOT17-09 probe、完整 runtime-input manifest、strict attested exit 0。
• 最終完整 pre_push：6242 passed／195 skipped／105 deselected／5 xfailed／0 failed，496.85 s；首輪失敗定位為 repo 外 .venv symlink，改用同 head 的實體目錄後通過，未修改或跳過測試。
• 固定 implementation／publication head 獨立審查均 APPROVE，無 findings；combined head 39ddb39b3ad5592ba6713cc9e0c84961caaa6afa 的獨立 delta review 也 APPROVE。
• 最終 head 39ddb39b3ad5592ba6713cc9e0c84961caaa6afa 的 required／適用 CI 8/8 通過；[Hub] SACCADE 工作總入口：進度、優先序、依賴與 checkpoint #550 §0A self-check 已貼於本 PR。

Remaining OPEN：online qualification、F04 watchdog、F05 ingest drops、多 worker NMS capture 等既有殘留；未清除 #340 trace。distribution local-only、equivalence unproven。回退須同時回退實作並依 runbook 重發 coordinate。

Combined head: 39ddb39b3ad5592ba6713cc9e0c84961caaa6afa；tree 9ac7f0620974fc7680f6ce825b88aef63dae176a 與已審查、完整測試的 1ef62df872c0bad2798b6a39a274de2b6081a781 完全相同。main base aa69c3c1caf502ecc5aeeda92f90d8db6871a6c3。

遠端 CI／C++ 全綠；pytest 6083 passed／294 skipped／105 deselected／4 xfailed／0 failed。

[raylei50653]

Independent review — APPROVE

Reviewer: separately authorized read-only Codex review agent /root/f02_independent_review; this is an independent session review, not a GitHub account approval.

• Implementation base: aa69c3c
• Implementation reviewed head: 83252ce
• Publication reviewed head: 1ef62df
• Verdict: APPROVE for both heads.
• Findings: no actionable or blocking findings; no unresolved dispositions.

The reviewer checked per-stream serialized admission/drain/enqueue, actual frame accounting versus overflow events/stop discards, frame identity/gaps/reset/restart, bounded stop lock acquisition and partial-drain retry. Publication changes exactly canonical + archive. Archive equals base bytes (SHA-256 d740889a2fe15e58bd868a9af5b8e9ae23b033c76cca1caa068562e65407d85b); canonical equals scratch candidate (f36316235124b7edde843e262b46248299b99077f25aa47c50e1784d51bdb5b2). Implementation members 319 -> 319; only dispatcher.py changed; four other axes unchanged; complete=true, equivalence=unproven. Both native artifact bytes match build witnesses.

Independent checks: 8 new CPU contracts passed (1 GPU deselected); strict attested validation with retained fresh verification probe and complete runtime-input manifest exited 0 on the GPU host. All evidence hashes, 43-test JUnit (13 CUDA cases, zero skips/failures), and the six intended mutant assertion failures were verified. Earlier full pre_push logs and the resolved .venv path failure classification were verified.

Limits: reviewer did not rerun the full GPU suite or recapture MOT17-09; those retained artifacts were audited and strict attestation revalidated. CUDA contract tests use real Workbench/batcher with substituted TRT inference. No online qualification, performance or semantic-equivalence claim. Required final-head checks, PR CI, §0A self-check and atomic landing remain separate gates; changed heads require delta review.

Publication review is also recorded on #636, now merged into this implementation branch. The combined merge commit is 39ddb39; its content-identical delta is undergoing independent review.

[raylei50653]

Final-head local validation

Head: 1ef62df872c0bad2798b6a39a274de2b6081a781
Tree: 9ac7f0620974fc7680f6ce825b88aef63dae176a
Clean checkout: /home/ray/developer/ai/saccade/.worktrees/550-f02-validation

scripts/pre_push.sh exited 0: 6242 passed, 195 skipped, 105 deselected, 5 xfailed, 0 failed (496.85 s). Ruff/format, mypy, document and all applicable gates passed. No C++ sources changed; native build for identity and focused GPU contracts was performed separately and is documented in §10.

Command:

UV_NO_SYNC=1 UV_CACHE_DIR=/tmp/saccade-550-uv-cache \
PYTHONDONTWRITEBYTECODE=1 \
PYTHONPATH=/tmp/saccade-550-f02/build/runtime_identity:/home/ray/developer/ai/saccade/build/runtime_identity:/home/ray/developer/ai/saccade/.worktrees/550-f02-validation/src \
bash scripts/pre_push.sh

Log pre-push-final-head.log SHA-256: 493c62bc63a561114d560526246e1e64b1becc6b470501590d1fdcc496a68bd0.

The earlier failure was the existing import-witness test resolving a symlinked .venv outside the checkout; using a real in-checkout dependency directory at the same head resolved it without changing or skipping a test. Both first-failure and successful rerun logs/hashes remain recorded in §10. This final run directly tests the reviewed publication head and supersedes the earlier documentation-only delta qualification.

After #636 merged, combined head is 39ddb39b3ad5592ba6713cc9e0c84961caaa6afa, parents 83252cee… + 1ef62df8…. Its tree is the same 9ac7f0620974fc7680f6ce825b88aef63dae176a; git diff 1ef62df8 39ddb39b is empty. Main remains aa69c3c1…. No code/test/publication bytes changed after this validation.

[raylei50653]

Independent delta review — APPROVE

Exact reviewed combined head: 39ddb39b3ad5592ba6713cc9e0c84961caaa6afa.
Reviewer: the same independent read-only Codex review session; findings: none; disposition: no correction required.

Verified parents are 83252ceea451a6b223d8d0eb4bfc1a8e6d1077d3 and 1ef62df872c0bad2798b6a39a274de2b6081a781; both and base aa69c3c1caf502ecc5aeeda92f90d8db6871a6c3 are ancestors. Tree 9ac7f0620974fc7680f6ce825b88aef63dae176a is byte-identical to the reviewed publication head; full diff is empty. Relative to implementation head, only canonical + archive are added. All previously verified source/test/candidate/archive hashes remain unchanged.

The reviewer independently checked the final pre_push log and its SHA-256 493c62bc63a561114d560526246e1e64b1becc6b470501590d1fdcc496a68bd0: 6242 passed, 195 skipped, 105 deselected, 5 xfailed, 0 failed, 496.85 seconds, all checks passed. Validation checkout remains clean at 1ef62df; identical tree binds that result to this merge head.

This is a content-empty delta review; no full test rerun was performed by the reviewer. Original GPU/qualification limits remain. Required CI on this exact landing head, §0A self-check and atomic main merge are the remaining delivery gates.

[raylei50653]

#550 §0A merge self-check — READY

Reviewed landing head: 39ddb39b3ad5592ba6713cc9e0c84961caaa6afa
Base: aa69c3c1caf502ecc5aeeda92f90d8db6871a6c3
Tree: 9ac7f0620974fc7680f6ce825b88aef63dae176a

1. Scope / review. Matches the owner’s D1-F02 contract: latest-wins/drain-all retained; actual frame drops, distinct overflow events/stop discards, per-stream identities/gaps, accounted concurrent producers, bounded stop/retry. Independent implementation/publication review and exact combined-head delta review: APPROVE, no actionable/blocking findings. Fresh PR readback has no unresolved review threads; head/base unchanged, ready and mergeable.
2. Required CI / regressions / negative controls. CI and C++ for this head: 8/8 success, including required pytest. Remote pytest: 6083 passed, 294 skipped, 105 deselected, 4 xfailed, zero failures. Local identical-tree pre_push: 6242 passed, 195 skipped, 105 deselected, 5 xfailed, zero failures. Focused 43 CPU/CUDA contracts: zero skips; six intended mutations rejected. First local failure was a .venv symlink resolving outside the validation checkout; same-head real directory fixed the environment without changing/skipping tests. Both first-failure and successful logs are preserved. This PR’s remote CI passed on its first run.
3. Runtime identity / atomic landing. chore(runtime): publish #538 F02 coordinate with exact outgoing archive #636 independently reviewed only canonical + exact outgoing archive, then merged into this implementation branch. Fresh native build, fresh MOT17-09 capture, all 12 runtime inputs, complete candidate and strict attested verification pass. Only the implementation axis changes (dispatcher.py); four axes and equivalence=unproven remain unchanged. This main merge brings implementation + coordinate together; no stale intermediate main state.
4. Real-environment evidence. §10 and final-head receipt contain commands, source/log hashes, tested head and hardware scope. The 13 CUDA contracts use actual Workbench/batcher/preprocess with substituted TRT inference on RTX 5070 Ti Laptop. Independent review verified retained evidence and separately reran strict attestation. No performance, complete TRT/online qualification, semantic equivalence or package claim is added.
5. Closeout / OPEN / rollback. The contract/evidence documentation is in this PR; live delivery state is this PR and Hub [Hub] SACCADE 工作總入口：進度、優先序、依賴與 checkpoint #550. Remaining OPEN: watchdog F04, ingest drops F05, online qualification, multi-worker NMS capture, GE-07/update_into/NV12 and other existing D1/D2 obligations; CUDA graph capture races the frame decode thread and kills runs #340 trace remains untouched. distribution stays local-only. On main CI failure, stale identity or overturned evidence, suspend this line and repair/revert under §0A. Rollback must pair the implementation with a fresh coordinate publication per runbook, not only replace canonical JSON. After merge, verify main ancestry/tree/attestation and update Hub checkpoint.

Merge authorization is #550 §0A standing authorization. Merge is constrained to the exact reviewed head above.

[raylei50653]

Post-merge verification — main 6ca331d60e8fbb002fdfbd72487c60de6aee161b

GitHub confirms #637 merged. Parents are aa69c3c1caf502ecc5aeeda92f90d8db6871a6c3 + reviewed head 39ddb39b3ad5592ba6713cc9e0c84961caaa6afa. Main tree is 9ac7f0620974fc7680f6ce825b88aef63dae176a, exactly the tested/reviewed tree; full diff is empty. #636 was merged into the implementation branch; both task PRs are MERGED.

Additional strict check on merged main:

PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src \
SACCADE_BUILD_PATH=/tmp/saccade-550-f02/build/runtime_identity \
.venv/bin/python scripts/tools/check_runtime_identity_staleness.py \
  --mode attested --strict \
  --probe-from /tmp/saccade-550-f02-evidence/verification-probe.json \
  --runtime-inputs-from /tmp/saccade-550-f02-evidence/runtime-inputs.json

Run from clean /tmp/saccade-550-f02 at the merged main commit: exit 0. Log main-attested-strict-capture-root.log SHA-256: 6f66d4d2da35c315d08ac546f9d406dc828bf9378a7619db41ebb586d58e750d.

First attempt is retained and classified: running the same supplied full manifest from the other checkout .worktrees/550-f02-validation failed with 50 added/50 removed runtime-input paths. All differences are exactly the checkout-root prefix; relative memberships are identical. h2_runtime_inputs.py:670–699 reconciles build-bound absolute paths from discover_bound_paths with the recorded manifest, so this correctly rejects reuse in a different checkout namespace. Running at the original capture root with the same merged commit, unchanged manifest/probe and unchanged source tree passes. Failed log main-attested-strict.log SHA-256: 7f2a8c4e3247483524b3b51c6057ff309bf97c8ed4ee8734d567f9a60eae9cbf. No checker, evidence, source, or qualification standard was relaxed. Independent read-only closeout review: APPROVE for exact main 6ca331d, no code/identity correction needed. The reviewer verified all 50 path pairs have identical bytes, both log hashes, unchanged checker code, correct parents/tree and clean checkouts, and independently reran the same attested+strict command at the capture root with exit 0. No recapture or canonical republication is required.

Main CI and C++ are SUCCESS, 8/8 checks, bound to exact merge 6ca331d. Main pytest: 6083 passed, 294 skipped, 105 deselected, 4 xfailed, 0 failed (886.88 seconds). Both main workflows passed on the first run. Existing OPEN items and qualification limits remain as in the pre-merge self-check.