docs: close out #127 provenance; broaden the annotations read-gate note (cf. #450)

[JArmandoAnaya]

Two ratified corrections to text that no longer describes the repository. Nothing here
changes behaviour: one published wire string is broadened to match the rule the service
already enforces, and four passages of prose stop deferring a question that has since been
settled. No issue is ended by this pull request.

The branch-and-merge affordances are settled, not deferred

DESIGN.md's Provenance section recorded the version-control affordances the reference
design draws — the main version dropdown and Merge — as post-beta and pending a
decision, and said their top-bar slots render disabled. Both halves stopped being true. The
slots were removed on 2026-08-05 by the change that took them off the annotator's top bar
(#354), and the annotation-versioning question itself was settled on 2026-08-10 as
superseded by the batch, review and release model the product already has (cf. #127) — the
working line is the batch and job, the merge-after-review is the review flow's accept pass,
and the immutable line a consumer takes is the release.

Three further passages promised the controls "return with the model", which is a promise the
decision withdrew. All four now read true at HEAD, in each file's own voice, keeping the
principle-9 rationale that a disabled control whose only honest explanation is "this feature
does not exist" says nothing about what would enable it:

• DESIGN.md — the Provenance paragraph, and the top-bar bullet in the annotation-page
  section that described the three unrendered controls.
• docs/ui.md — the top-bar section that told a reader the dropdown and Merge return with
  the model behind them.
• frontend/ui-core/src/annotator/AnnotationPage.tsx — the module docstring's "What the top
  bar has and what it does not" section, which carried the same deferral and the same
  promise. It cites no issue number, and does not start to.

The audit behind that list was the bounded one the task named — git grep -n "127" over
docs and DESIGN.md, plus a word grep for Merge in the workspace docs, widened to
return with the model and post-beta once those turned out to be the load-bearing
phrases. Every surviving post-beta hit is about something else: dark mode, and a
provenance field in an SDK example.

The annotations read is not gated on job or batch state

The route description on GET /jobs/{job_id}/assets/{asset_id}/annotations said reading is
not gated on the batch being open. That is true but narrower than the rule: neither job state
nor batch state gates a read, and a description that names only the batch invites a client to
believe job state might. This was flagged as "found, not fixed" while shipping the
batch-lifecycle write-gate documentation (cf. #450) and ratified on 2026-08-08. The sentence
now reads "Reading is not gated on job or batch state", keeping the reason it was written
for — a label outlives the work that produced it.

The description is a published wire string, so openapi.json and
frontend/ui-core/src/generated/api.ts were regenerated through the repository's own
generation path (uv run python scripts/export_openapi.py, then pnpm generate:client) and
committed alongside it. The regeneration produced exactly one changed line in each file,
and both are the description text. checks.ts is byte-identical, and the generated group
of the gate — openapi drift, generated client drift, MCP tool reference drift, version sync —
passes on the committed artifacts.

Found, not fixed

The Provenance sentence also claimed that the removal record "re-milestoned #127 out of
0.1.0". #127 carried the 0.1.0 milestone when it was closed on 2026-08-10, so the claim did
not describe the tracker. Rather than assert a milestone fact in a document that cannot be
kept in sync with one, the rewritten sentence drops the clause; the milestone on a closed
issue is a tracker question, not a DESIGN.md question.

Test plan

bash scripts/check.sh was run in its four groups rather than as a single invocation,
because the full run exceeds this environment's command ceiling. Every group ran, on Node
24.19.0, from the worktree at 572281b. Exit codes, verbatim:

GENERATED_EXIT=0    check.sh: PASSED  ran=generated  skipped=python,frontend,browser
FRONTEND_EXIT=0     check.sh: PASSED  ran=frontend   skipped=python,generated,browser
PYTHON_EXIT=0       check.sh: PASSED  ran=python     skipped=frontend,generated,browser
BROWSER_EXIT=0      check.sh: PASSED  ran=browser    skipped=python,frontend,generated

Per-step timings, as each group reported them:

generated   1s openapi drift · 1s generated client drift · 1s mcp tool reference drift · 0s version sync · 3s total
frontend    5s build · 27s tests · 11s lint · 43s total
python      208s tests · 0s ruff (lint) · 0s ruff (format) · 6s mypy · 0s import contracts · 214s total
            Contracts: 4 kept, 0 broken.  mypy: no issues found in 153 source files
browser     96s annotator + app e2e (chromium) · 19s browser cycle, real server (chromium) · 115s total

Nothing was skipped and no exception was invoked: both browser suites ran, and the whole
gate is green on unmodified test code. check.sh runs pytest under -q, which suppresses
the count line; the progress output carries no failure or error marker and the step exits 0.