Clarify published animation evidence boundary

ROADMAP.md

@@ -7,7 +7,7 @@ ImageCraft is an actively developed pre-1.0 package. The repository contains onl
 - Independent SwiftPM products: `ImageCraftCore` and `ImageCraftImageIO`.
 - iOS 15+ and macOS 12+.
 - Bounded PNG/JPEG/GIF probing and static primary-frame decoding.
-- Exact-timeline GIF/APNG and pre-split JPEG-sequence preparation with on-demand frames, bounded decode windows, source reuse, cancellation, strict Codable invariants, format allowlists, APNG CRC/type/order validation, GIF interactive/text-rendering rejection, early frame admission, cumulative sequence metadata budgets, actual decoded-row-stride publication checks, and owned-APNG persistent semantic replay anchors that eliminate unnecessary checkpoints only when full-canvas source/background semantics prove a safe later replay start. Full-source + previous and subrect-background remain conservative controls. This remains an unpublished release candidate until a fixed revision is created and consumed by Fovea.
+- Exact-timeline GIF/APNG and pre-split JPEG-sequence preparation with on-demand frames, bounded decode windows, source reuse, cancellation, strict Codable invariants, format allowlists, APNG CRC/type/order validation, GIF interactive/text-rendering rejection, early frame admission, cumulative sequence metadata budgets, actual decoded-row-stride publication checks, and owned-APNG persistent semantic replay anchors that eliminate unnecessary checkpoints only when full-canvas source/background semantics prove a safe later replay start. Full-source + previous and subrect-background remain conservative controls. These animation bytes are published in `0.1.0-alpha.7` (`3b7f7ef212acfa42a022d7cd0bfad73c0cd2d252`), which is also Fovea's exact package pin. That closes component publication, not host animation adoption: Fovea still has no production `EncodedAnimationPlaybackPreparing` implementation backed by ImageCraft, so the animation path remains integration- and device-qualification pending.
 - Bounded progressive-JPEG sessions with monotone non-final generations, cancellation fencing, terminal reclaim after accepted-input failures, and a package-internal 500-SOS CPU-amplification ceiling shared by full-container security inspection and the incremental parser. A separate source-bound libjpeg-turbo 3.2.0 classic-API probe now proves that persistent buffered-image coefficient state can consume arbitrary 1-byte through full-file chunk schedules without replaying prior entropy: 5 cases / 21 schedules retain identical scan-completion state and final RGB, while private jmemmgr 3.2.0 checkpoints expose the dominant retained/final-render allocator live bytes without promoting that private ABI to a public contract. The same probe now observes virtual-barray controls before realization: four 1920-wide cases have an exact multi-minheight no-backing-store hinge (`threshold-1` fails before coefficient allocation; threshold succeeds byte-exact), while the 23×13 case intentionally falsifies a universal 1-byte rule because libjpeg's mandatory one-minheight fallback succeeds even with `max_memory_to_use=1`.
 - Static PNG and JPEG encoding with explicit color, orientation, alpha, metadata, and output-byte policies.
 - Versioned capability, resource, lifecycle, and failure contracts.

docs/EVIDENCE.md

@@ -82,7 +82,7 @@ scripts/verify-imageio-evidence.sh Evidence/Baselines/macos-27.0-26A5388g-arm64.
 
 动画合同目前以 `IMG_ANIM_PT_001`–`IMG_ANIM_PT_056` 连续且唯一编号；`scripts/check-animation-test-ids.py` 在 `scripts/verify.sh` 中同时检查重复和缺号。19 项 ImageIO 测试使用确定性 GIF、手工构造且 CRC 正确的 APNG，以及完整 JPEG 帧序列，验证精确有理数 timing、有限/无限 loop、frame rect、disposal、blend、ImageIO 最终 canvas 像素、按需帧、有界 decode window、颜色/尺寸一致性和取消；另固定三类 source 的格式 allowlist、JPEG sequence 累计 metadata 预算、APNG 默认图像不属于动画、chunk CRC、critical/reserved type、sequence gap、非连续 `IDAT`、首帧非法 `fdAT`、声明帧数早期 admission、越界 rect，以及 GIF disposal/GCE 保留位、user-input flag、Plain Text graphic block、尾随未消费 GCE 和 LZW 最小码宽。7 项 Core 测试固定 duration/loop/rect/descriptor 的严格 Codable、规范化和 metadata 连续性。实际 timeline publication 还以 `DecodedImage.estimatedByteCost × frameCount` 复核行跨度与 overflow。静态容器误入动画入口、总时间轴字节上限和越界帧索引继续失败关闭。
 
-`IMG_ANIM_PT_027`–`IMG_ANIM_PT_056` 进一步覆盖压缩 checkpoint、RFC1950 互操作、owned raw-subrect APNG、separate-default、随机访问、批量共享 canvas、公开 decoder backing/资源诊断以及 semantic replay。semantic replay 只接受能够持续重建后续 pre-frame canvas 的锚点：full-canvas `source` 且 disposal 不是 `previous` 可从当前帧开始；full-canvas `background` disposal 后下一帧可从透明 canvas 开始。`IMG_ANIM_PT_054` 验证 10 帧 full-background 控制在最大 replay=2 时不再保留 checkpoint，随机与批量像素仍一致；`IMG_ANIM_PT_055` 保留 full-source + previous 反例，证明该语义不会被错误提升为持续锚点；`IMG_ANIM_PT_056` 从公开 instrumented decoder 看到 semantic reset、checkpoint 数和实际最大 replay。该机制是本地未发布候选，不代表物理内存、能耗或跨库优势。
+`IMG_ANIM_PT_027`–`IMG_ANIM_PT_056` 进一步覆盖压缩 checkpoint、RFC1950 互操作、owned raw-subrect APNG、separate-default、随机访问、批量共享 canvas、公开 decoder backing/资源诊断以及 semantic replay。semantic replay 只接受能够持续重建后续 pre-frame canvas 的锚点：full-canvas `source` 且 disposal 不是 `previous` 可从当前帧开始；full-canvas `background` disposal 后下一帧可从透明 canvas 开始。`IMG_ANIM_PT_054` 验证 10 帧 full-background 控制在最大 replay=2 时不再保留 checkpoint，随机与批量像素仍一致；`IMG_ANIM_PT_055` 保留 full-source + previous 反例，证明该语义不会被错误提升为持续锚点；`IMG_ANIM_PT_056` 从公开 instrumented decoder 看到 semantic reset、checkpoint 数和实际最大 replay。该机制已包含在不可变开发标签 `0.1.0-alpha.7`（`3b7f7ef212acfa42a022d7cd0bfad73c0cd2d252`）中；发布身份不等于宿主动画接入或物理设备资格，仍不代表物理内存、能耗或跨库优势。
 
 `ImageCraftEvidence --animation-performance` 对同一输入分别记录 ImageCraft 精确准备、直接 ImageIO 准备下界、冷单帧、保留 source 单帧、8 帧窗口顺序解码和完整直接顺序下界，并保存全部样本与像素 SHA-256。动画 hostile-path 测试另行固定格式 allowlist、APNG CRC/顺序、早期帧 admission、GIF 保留位和 JPEG sequence 累计元数据边界。当前 `.artifacts/performance/animation-initial` 仅是脏工作树、本机、256×256 单 fixture 方向性证据；它不进入稳定 baseline，也不支持竞品或跨设备优越性声明。
 

docs/INTEGRATION_CONTRACT.md

@@ -57,4 +57,4 @@ scripts/verify-consumer-package.sh
 
 ## 尚未配置的分发设施
 
-公开 Git remote 与 GitHub Hosted `xcode-27` preview 核心 CI workflow 已配置，并由仓库内工具链门验证 Xcode 27 / Swift 6.4 身份。项目仍未发布稳定版本 tag；preview runner 容量、真机、能耗和正式 required-check 治理必须与普通构建通过分开报告。
+公开 Git remote 与 GitHub Hosted `xcode-27` 核心 CI workflow 已配置，并由仓库内工具链门验证 Xcode 27 / Swift 6.4 身份；`main` 当前启用严格 required `core` check。项目仍未发布稳定版本 tag；管理员强制约束、runner 容量、真机和能耗资格必须与普通构建通过分开报告。

docs/PERFORMANCE.md

@@ -540,4 +540,4 @@ scripts/capture-animation-performance.sh \
 
 在预注册的 `FULL-BACKGROUND-1024-60` 分析场景、64 MiB retained budget 下，旧 checkpoint-only 模型约为 64 MiB retained / 76 MiB modeled peak / worst replay 4；semantic reset 模型为 8 MiB retained / 20 MiB modeled peak / worst replay 1。这个数字是分析模型，不是 RSS 或设备峰值。当前 owned APNG runtime 已实现持续 semantic anchor，并以 `semanticReplayResetCount` 和 `maximumResolvedReplayFrames` 暴露 package-only 诊断。10 帧 full-background 控制在最大 replay=2 时产生 9 个 semantic reset、0 个 retained checkpoint、maximum resolved replay=1；full-source + previous 控制仍需要 checkpoint。
 
-该结果只支持“在已绑定场景/当前未发布 runtime 上减少 replay/checkpoint”的局部结论。它不支持 universal APNG Pareto dominance、物理设备内存/能耗优势，也不改变 <=1024 RGBA8 non-interlaced admission、32 MiB retained 上限、8 帧最大 replay 或 Fovea 的生产 dependency pin。发布前仍需 exact revision、Fovea production-pin 集成和稳定 iPhone 证据。
+该结果只支持“在已绑定场景/已发布 `0.1.0-alpha.7` runtime 上减少 replay/checkpoint”的局部结论。它不支持 universal APNG Pareto dominance、物理设备内存/能耗优势，也不改变 <=1024 RGBA8 non-interlaced admission、32 MiB retained 上限或 8 帧最大 replay。Fovea 已精确 pin 到同一 ImageCraft revision，但当前源码仍没有由 ImageCraft 实现的生产 `EncodedAnimationPlaybackPreparing`；动画宿主接入、稳定 iPhone 证据和端到端资源/播放资格仍未闭合。