eric8810 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026
diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
@@ -6,15 +6,15 @@ on:
       version:
         description: Core and stable Small facade version
         required: true
-        default: 0.5.7
+        default: 0.5.9
         type: string
       publish_to_registry:
         description: Publish the tested candidate to npm under next
         required: true
         default: false
         type: boolean
       npu_sdk_run_id:
-        description: Optional run containing npu-release-sdks (AMD requires explicit provider configuration)
+        description: Optional override containing both locked Intel and AMD deployment SDKs
         required: false
         default: ""
         type: string
@@ -47,6 +47,10 @@ jobs:
           python tools/npm_release.py ensure-unpublished --version "$RELEASE_VERSION"
 
   build-native:
+    # The locked AMD asset is attached to a draft until release publication.
+    permissions:
+      contents: write
+      actions: read
     needs: validate
     name: build ${{ matrix.id }}
     strategy:
@@ -97,9 +101,22 @@ jobs:
           path: dist/npu-sdk
           run-id: ${{ inputs.npu_sdk_run_id }}
           github-token: ${{ github.token }}
-      - name: Verify NPU SDK inventory and runtime identities
-        if: matrix.id == 'linux-x64' && inputs.npu_sdk_run_id != ''
-        run: python tools/npu/prepare_release.py --sdk-root dist/npu-sdk --github-env "$GITHUB_ENV"
+      - name: Prepare packaged Intel and opt-in AMD NPU payloads
+        if: matrix.id == 'linux-x64'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [[ ! -d dist/npu-sdk/openvino ]]; then
+            python tools/npu/build_openvino.py \
+              --package-cache .cache/npu-packages --output-dir dist/npu-sdk/openvino
+          fi
+          if [[ ! -d dist/npu-sdk/amdnpu ]]; then
+            python tools/npu/fetch_amdnpu.py \
+              --package-cache .cache/npu-packages --output-dir dist/npu-sdk/amdnpu
+          fi
+          python tools/npu/prepare_release.py --sdk-root dist/npu-sdk --github-env "$GITHUB_ENV" \
+            --require-provider openvino --require-provider amdnpu
       - name: Fetch the pinned PDF renderer for npm bundling (Unix)
         if: runner.os != 'Windows'
         shell: bash
@@ -343,7 +360,7 @@ jobs:
           npm install --offline --ignore-scripts --no-audit --no-fund --package-lock=false \
             ../dist/release/arcships-light-ocr-model-ppocrv6-small-0.3.4.tgz \
             ../dist/release/arcships-light-ocr-${{ matrix.native }}-${RELEASE_VERSION}.tgz \
-            ../dist/release/arcships-light-ocr-runtime-0.1.8.tgz \
+            ../dist/release/arcships-light-ocr-runtime-0.1.9.tgz \
             ../dist/release/arcships-light-ocr-${RELEASE_VERSION}.tgz
           cp ../tools/npm/smoke.cjs .
       - name: Run stable Small OCR
@@ -377,8 +394,8 @@ jobs:
           npm install --offline --ignore-scripts --no-audit --no-fund --package-lock=false \
             ../dist/release/arcships-light-ocr-model-ppocrv6-tiny-0.1.0.tgz \
             ../dist/release/arcships-light-ocr-model-ppocrv6-medium-0.1.0.tgz \
-            ../dist/release/arcships-light-ocr-tiny-0.1.7.tgz \
-            ../dist/release/arcships-light-ocr-medium-0.1.7.tgz
+            ../dist/release/arcships-light-ocr-tiny-0.1.8.tgz \
+            ../dist/release/arcships-light-ocr-medium-0.1.8.tgz
           node ../tools/npm/smoke-tier.cjs @arcships/light-ocr-tiny light-ocr-tiny \
             ppocrv6-tiny-onnx-20260722.1
           node ../tools/npm/smoke-tier.cjs @arcships/light-ocr-medium light-ocr-medium \
@@ -412,7 +429,7 @@ jobs:
           docker run --rm -v "$PWD:/work" -w /work
           -e LIGHT_OCR_SMOKE_FIXTURE=/work/corpus/fixtures/generated-hello-123
           alpine:3.22 sh .github/scripts/smoke-musl.sh
-          "${{ matrix.id }}" "${{ inputs.version }}" "0.1.8"
+          "${{ matrix.id }}" "${{ inputs.version }}" "0.1.9"
 
   publish:
     needs: [test-packages, smoke-musl]
@@ -463,7 +480,7 @@ jobs:
           cd registry-document
           npm init --yes
           npm install --ignore-scripts --no-audit --no-fund --package-lock=false \
-            "@arcships/light-ocr-document@0.1.4"
+            "@arcships/light-ocr-document@0.1.5"
           node ../tools/npm/document-smoke.cjs
       - name: Verify the published stable package offline
         shell: bash

diff --git a/.github/workflows/npu-native.yml b/.github/workflows/npu-native.yml
@@ -20,6 +20,10 @@ permissions:
 
 jobs:
   build:
+    # Draft release assets are visible only to tokens with push access.
+    permissions:
+      contents: write
+      actions: read
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
@@ -39,6 +43,11 @@ jobs:
           path: dist/npu-sdk/amdnpu
           run-id: ${{ inputs.amd_sdk_run_id }}
           github-token: ${{ github.token }}
+      - name: Fetch locked AMD deployment runtime and compiled recognition models
+        if: inputs.amd_sdk_run_id == ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: python tools/npu/fetch_amdnpu.py --package-cache .cache/npu --output-dir dist/npu-sdk/amdnpu
       - name: Build the native addon with packaged NPU SDKs
         shell: bash
         run: |

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,27 +4,32 @@ This file records user-visible changes to `light-ocr`. Published artifact detail
 
 ## [Unreleased]
 
+## [0.5.9] - Unreleased
+
+Release preparation; npm publication and GitHub Release are pending.
+
 ### Added
 
-- Added a source-level Intel NPU backend (`provider: "openvino"`) for Linux x64.
+- Added a bundled Intel NPU backend (`provider: "openvino"`) for Linux x64.
   Builds configured with `LIGHT_OCR_OPENVINO_SDK_DIR` load the OpenVINO C
   runtime at run time, run detection and 20-bucket recognition on the NPU, and
   place `openvino` first in the package Auto policy
   (`openvino → webgpu → cpu`); hosts without an NPU skip it with
   `adapter_unavailable`. Added a pinned native SDK extractor, package-local
   runtime descriptor 2.1, numeric driver/compiler checks, and reviewed-evidence
-  release staging with optional device reports. Published npm packages do not include OpenVINO yet, so
-  `provider: "openvino"` returns `unsupported_capability` there. See
+  release staging with optional device reports. The 0.5.9 Linux x64 build includes
+  pinned OpenVINO 2026.4.0 libraries. See
   [Intel NPU 加速技术方案](docs/intel-npu-acceleration.md).
-- Added a source-level AMD NPU backend (`provider: "amdnpu"`) for Linux x64
+- Added a bundled AMD NPU backend (`provider: "amdnpu"`) for Linux x64
   glibc and Ryzen AI STX/KRK devices. It isolates the vendor ORT runtime,
   loads 20 immutable BF16 recognition contexts, and runs detection on CPU.
   Added model compilation and SDK import tools, descriptor validation,
   license/SBOM staging, and candidate/release workflows. AMD is excluded
   from Auto and enabled only through `execution.provider: "amdnpu"` (or
   `--provider amdnpu`). NPU device reports are optional for release;
-  `deviceValidated` remains false. Current published packages
-  return `unsupported_capability`. See [AMD NPU 加速技术方案](docs/amd-npu-acceleration.md)
+  `deviceValidated` remains false. The 0.5.9 Linux x64 build includes Ryzen AI 1.8
+  deployment libraries and real compiled contexts bound to Small 0.3.4.
+  Other platforms retain their existing providers. See [AMD NPU 加速技术方案](docs/amd-npu-acceleration.md)
   and [NPU SDK 构建与发布](docs/npu-runtime-release.md).
 
 ## [0.5.8] - 2026-09-24

diff --git a/README.md b/README.md
@@ -235,6 +235,8 @@ selection guidance, and exit code reference:
 - [Build and release](docs/build-and-release.md)
 - [Roadmap](docs/roadmap.md)
 - [Changelog](CHANGELOG.md)
+- [npm 0.5.9 release preparation — English](docs/releases/npm-0.5.9.en.md)
+- [npm 0.5.9 发布准备 — 中文](docs/releases/npm-0.5.9.md)
 - [npm 0.5.8 release record — English](docs/releases/npm-0.5.8.en.md)
 - [npm 0.5.8 发布记录 — 中文](docs/releases/npm-0.5.8.md)
 - [npm 0.5.7 release record — English](docs/releases/npm-0.5.7.en.md)

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -226,6 +226,8 @@ AI Agent 使用。它提供场景驱动的工作流、命令选择建议和退
 - [构建与发布](docs/build-and-release.md)
 - [路线图](docs/roadmap.md)
 - [更新日志](CHANGELOG.md)
+- [npm 0.5.9 release preparation — English](docs/releases/npm-0.5.9.en.md)
+- [npm 0.5.9 发布准备 — 中文](docs/releases/npm-0.5.9.md)
 - [npm 0.5.8 release record — English](docs/releases/npm-0.5.8.en.md)
 - [npm 0.5.8 发布记录 — 中文](docs/releases/npm-0.5.8.md)
 - [npm 0.5.7 release record — English](docs/releases/npm-0.5.7.en.md)

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-0.5.8
+0.5.9
diff --git a/bindings/node/test/cli.test.cjs b/bindings/node/test/cli.test.cjs
@@ -108,7 +108,7 @@ test('info: --version is metadata-only and reports the Small tier', async () =>
   assert.equal(code, EXIT.success);
   assert.equal(stderr, '');
   const info = JSON.parse(stdout);
-  assert.equal(info.core, '0.5.8');
+  assert.equal(info.core, '0.5.9');
   assert.equal(info.tier, 'small');
   assert.equal(info.maturity, 'stable');
   assert.equal(info.model, 'ppocrv6-small-native-20260719.1');

diff --git a/docs/amd-npu-acceleration.md b/docs/amd-npu-acceleration.md
@@ -1,6 +1,6 @@
 # AMD NPU 加速技术方案
 
-更新时间：2026-10-06。状态：Linux x64 glibc 后端与打包改造已实现，默认关闭、配置显式开启；Ryzen AI SDK 与编译产物尚缺，真机验收不再作为发布前置。当前已发布 npm 包不含 AMD NPU 运行时。
+更新时间：2026-10-06。状态：Linux x64 glibc 后端与打包改造已实现，默认关闭、配置显式开启；0.5.9 发布输入已包含 Ryzen AI 1.8 的原生部署库与 Small 0.3.4 的 20 个真实 BF16 context。无需真机即可完成编译，尚未执行 AMD 设备推理。正式 npm 发布仍待完成。
 
 ## 范围与模型路线
 
@@ -16,22 +16,21 @@ BF16 路线由 VAIML 编译 FP32 ONNX，生成可嵌入权重与微码的 EPCont
 - 校验源识别模型哈希、VAIML 配置和 20 个静态宽度桶；识别形状为 `[1,3,48,width]`，批次为 1。编译结果的字典类别数必须与 bundle 一致。
 - 设备检查要求可读写的 AMD STX/KRK `/dev/accel` 节点；无设备返回 `adapter_unavailable`。库或模型哈希不符属于不可恢复错误，不能静默跳到 CPU。
 - detector 使用 CPU，recognition 使用 `VitisAIExecutionProvider` 和其允许的 CPU 分区。只有首次会话及对应桶实际创建成功后才选中该候选；后续推理失败直接报告错误。
-- `tools/npu/compile_amdnpu.py`：在 vendor SDK Python 环境编译所有桶，要求存在嵌入式 VitisAI EPContext，并重新打开部署产物。
+- `tools/npu/compile_amdnpu.py`：在 vendor SDK Python 环境编译所有桶，要求存在嵌入式 VitisAI EPContext，并检查输入输出类型与形状；编译过程不执行模型推理，不要求真机验收。
 - `tools/npu/import_amdnpu.py`：从已取得的 SDK 部署目录导入原生库，设置包内 RPATH、检查 ELF 依赖闭包、记录变更前后哈希，并锁定模型、配置及许可证。
 - CMake、Node descriptor 2.1、JS loader、npm staging、SBOM 和候选/正式发布流程均已接入。构建入口与报告格式见 [NPU SDK 构建与发布](npu-runtime-release.md)。
 
 ## 默认关闭与发布策略
 
-AMD 始终排除在 Auto 候选列表之外；用户通过 `execution.provider: "amdnpu"`、CLI `--provider amdnpu` 或 C++ 的 `ExecutionProvider::amdnpu` 显式开启。构建必须含 vendor SDK 与匹配的识别模型；运行时未配置 AMD 时不装载 vendor ORT。
+AMD 始终排除在 Auto 候选列表之外；用户通过 `execution.provider: "amdnpu"`、CLI `--provider amdnpu` 或 C++ 的 `ExecutionProvider::amdnpu` 显式开启。0.5.9 Linux x64 发布构建默认附带 vendor SDK 与匹配的 Small 识别模型；运行时未配置 AMD 时不装载 vendor ORT。
 
 按维护者决定，NPU 真机验收不再阻塞发布。SDK 导入的 `qualificationOnly: true` 仅记录尚无设备证据，平台包可随其他已满足条件的运行时一起发布；`deviceValidated` 保持 `false`。库存、模型哈希、依赖闭包和许可证校验继续执行，设备报告可选。
 
 ## 尚未验证的设备行为（可选后续工作）
 
-1. 取得 Ryzen AI 1.8 Linux SDK 和 STX/KRK 主机；确认独立 namespace 装载、XRT/amdxdna 驱动及 VitisAI C API 20 能协同工作。
-2. 编译真实 PP-OCRv6 模型，核对 20 桶的 NPU 分区与 FP32 CPU goldens；当前没有生成或伪造这些产物。
-3. 对完整 locked corpus 记录逐行文本、框与置信度差异，审阅 BF16 误差；测量冷/热延迟、CPU 时间和 RSS。
-4. 覆盖 20 次关闭/重建、驱动兼容、权限不足、无设备、损坏产物，以及与 WebGPU 共存和回退。
-5. 核实 SDK/模型再分发条款和完整第三方 notices，再创建 accepted SDK。
+1. 在 STX/KRK 主机确认独立 namespace 装载、XRT/amdxdna 驱动及 VitisAI C API 20 协同工作。
+2. 比较已编译 20 桶模型与 FP32 CPU goldens，记录文本、框、置信度及 BF16 误差。
+3. 测量冷/热延迟、CPU 时间和 RSS，覆盖关闭/重建、权限不足、驱动兼容及 WebGPU 共存。
 
+SDK 的原始与打包后哈希、依赖闭包、许可证/第三方 notices 和源模型绑定已随部署包记录；这不等同于真机验收或独立法律审阅。
 这些设备行为尚无实测结论，不再作为源码合入或 AMD 显式开启支持发布的前置条件。
diff --git a/docs/implementation-status.md b/docs/implementation-status.md
@@ -1,8 +1,10 @@
 # C++ Core 与 Node-API 实施状态
 
-更新时间：2026-09-24<br>
+更新时间：2026-10-06<br>
 结论：npm `0.5.8` 已发布并晋升 `latest`。本版新增 musl（Alpine）Linux 的 CPU-only 预编译平台包（`@arcships/light-ocr-linux-x64-musl`/`-arm64-musl`，平台包总数八），其 onnxruntime 1.22.0 musl 产物从源码构建、由 `models/deps.lock.json` 以 SHA-256 锁定于 [`musl-runtime-1.22.0`](https://github.com/arcships/light-ocr/releases/tag/musl-runtime-1.22.0)；同时所有包的 `engines.node` 放宽为下限式 `>=22.0.0`（Node-API 稳定 ABI，Tier 1 仍为 22/24 LTS）。实现经 [PR #63](https://github.com/arcships/light-ocr/pull/63) 两轮独立 review；[发布 run 36013862673](https://github.com/arcships/light-ocr/actions/runs/36013862673) 完成八平台构建、离线 smoke、registry 发布与回装，[晋升 run 36018294655](https://github.com/arcships/light-ocr/actions/runs/36018294655) 只提升稳定闭包。完整证据见 [npm 0.5.8 发布记录](releases/npm-0.5.8.md)（[English](releases/npm-0.5.8.en.md)）与 [`v0.5.8` GitHub Release](https://github.com/arcships/light-ocr/releases/tag/v0.5.8)。上一版 `0.5.7`（macOS 下游重签名兼容）的证据链见 [npm 0.5.7 发布记录](releases/npm-0.5.7.md)（[English](releases/npm-0.5.7.en.md)）与 [`v0.5.7` GitHub Release](https://github.com/arcships/light-ocr/releases/tag/v0.5.7)。
 
+发布准备：`0.5.9` 已同步 Core/native、runtime `0.1.9`、Document `0.1.5`、Tiny/Medium `0.1.8`。Linux x64 默认带 Intel NPU SDK；AMD 默认关闭且需要真实 SDK/模型输入。NPU 真机报告不作为发布前置；npm 和公开 GitHub Release 尚未发布。见 [0.5.9 发布准备](releases/npm-0.5.9.md)（[English](releases/npm-0.5.9.en.md)）。
+
 状态含义：
 
 - **Done**：代码存在，并有本地实际运行证据。
@@ -88,6 +90,10 @@
 | 高分辨率峰值内存 | Done | Release 原生独立进程本机参考：2048² 空白 `318.8 MiB ≤ 384 MiB`；xfund 密集表单 116 框 `400.5 MiB ≤ 640 MiB`。四平台 release jobs 的真实模型与 RSS gates 均通过。 |
 | Tiled 高分辨率准确模式 | Done / `0.2.0` published | 1280 tile、2048→4-pass row-major、全局 candidate ceiling、IoU/IOS greedy merge、原图 recognition、C++/Node contract、8-fixture/196-line corpus、独立 oracle、四平台 36-entry accepted baseline 与 package smoke 均已完成。 |
 
+## 0.5.9 NPU 发布准备（2026-10-06）
+
+Linux x64 glibc 双 NPU Core/Node 构建与 npm native staging 已完成。默认发布输入包含 OpenVINO 2026.4.0，以及 Ryzen AI 1.8 的 20 个原生部署库和绑定 Small 0.3.4 的 20 个真实 BF16 context。Intel 进入 Auto；AMD 始终默认关闭，由配置显式开启。未执行 AMD 设备推理，`deviceValidated` 保持 false；真机验收不作为发布前置。版本、归档哈希与后续发布步骤见 [0.5.9 发布记录](releases/npm-0.5.9.md)。
+
 ## 本机最终验证快照
 
 环境：macOS arm64 Apple M4 Max，macOS 26.5.1，Apple Clang 21.0.0，CMake 4.2.1，macOS deployment target 13.3；CPU 使用 ONNX Runtime，Apple 候选使用系统 Core ML。