feat(observatory): admit canonical recorded replay

docs/24_M5_1_OBSERVATORY_SURFACE_BRIEF.md

@@ -51,9 +51,48 @@ The existing source-specific viewer contracts remain separate and unchanged:
 
 Canonical LAB compositions may configure the recorded Rerun engine inside the bounded LAB slice,
 but that does not make Observatory a LAB or live consumer. The first Observatory slice mounts no
-viewer at all. A later viewer slice may activate only the historical `recorded-session` profile
-after an explicit Session selection and a separate acceptance proof. It must not add a fourth
-profile or silently collapse the three existing lifecycles.
+viewer while its catalog is opened, refreshed or navigated. Its bounded canary may activate only
+the historical `recorded-session` profile after a separate explicit action and acceptance proof.
+It does not add a fourth profile or silently collapse the three existing lifecycles.
+
+## M5.1 canary: canonical recorded replay
+
+The accepted viewer canary reuses the stabilized full-route RAV004 composition; it does not create
+a second viewer or a second recorded-data pipeline. The sealed vegetation result is first projected
+into the generic Session/LAB catalog through `SessionStore.publish_lab_instance`. Its exact
+`route_full_review.session_id` is the only source relationship. Labels, `latest`, result prefixes and
+the advanced LAB index are not valid joins.
+
+The immutable LAB projection carries a versioned replay capability:
+
+```json
+{
+  "schema_version": "missioncore.observation-lab-replay-capability/v1",
+  "kind": "canonical-recorded-rerun",
+  "viewer_profile": "recorded-session",
+  "timeline": "session_time",
+  "activation": "explicit",
+  "commands_enabled": false
+}
+```
+
+Catalog entry, Session selection and result selection remain lightweight. Only the explicit
+`Открыть визуальный разбор` action reads and revalidates the sealed result metadata. Only after that
+admission does the application mount the shared canonical replay component, which follows the
+existing `resolveObservationSessionReplay → resolveCanonicalLabReplay → recordedSessionRerunProfile
+→ RerunViewport` path. Closing the review or changing Session unmounts that component and aborts
+pending admission. At most one viewer and one `session_time` clock exist.
+
+The publication command verifies the registered result root, schema, content-addressed identity,
+artifact hashes, exact RAV004 source Session and all false authority flags before adding an
+idempotent SQLite projection. The validated source snapshot is compared again inside the same
+SQLite write transaction, so reconciliation cannot swap the Session between admission and copy.
+The default v1 catalog continues to hide capability-owned projections from legacy consumers; the
+explicit v2 LAB catalog returns the typed capability. A narrowly matched rolling migration types
+the already-published canonical projection and leaves ordinary legacy LAB rows untouched. The
+command does not run inference, ffmpeg, RRD merge or replay
+materialization; source/result evidence is not copied or rewritten. Legacy LAB continues to import
+the same shared replay through a compatibility wrapper.
 
 ## Information hierarchy and states
 
@@ -89,5 +128,19 @@ workspace.
   the historical tail remains in legacy LAB and is never mounted into a long Observatory DOM.
 - Loading, empty, refreshing, error/retry and ready states contain no synthetic data.
 - Linked evidence is never presented as a CV or safety pass.
-- Existing LAB, Simulation, K1 and Data/Sessions code paths remain unchanged.
+- Existing LAB, Simulation, K1 and Data/Sessions operator behavior remains unchanged.
 - Live, historical Session and legacy LAB viewer-profile contracts remain distinct.
+
+## Canary acceptance
+
+- RAV004 appears as one exact LAB result linked to `20260828T130511Z_viewer_live` in the Session
+  catalog; Observatory never reads `/api/v1/laboratory/advanced-index`.
+- Entering Observatory and changing Session perform no replay POST, RRD HEAD/GET, viewer mount or
+  canvas creation.
+- Explicit open validates the result/source binding, then uses the existing canonical RRD,
+  blueprint, cache, `recorded-session` profile and `session_time` clock.
+- One `RerunViewport` is mounted; legacy clip/Three renderers, a second clock and a second RRD
+  builder are absent.
+- Close, Session change and run replacement abort pending work and fully unmount the viewer.
+- K1, Worker 006/add-worker, Simulation/Gaussian, raw Sessions and legacy LAB behavior remain
+  unchanged.