docs(perception): record controller readiness boundary and fault evidence

docs/adr/0049-stream-first-perception-profiles.md

@@ -1,7 +1,8 @@
 # ADR 0049 — Stream-first full perception profiles
 
-Date: 2026-09-01; updated 2026-09-02 14:22 MSK. Status: stage-1 engineering
-baseline complete; stage-2 binary full-graph prototype, not a product runtime cutover.
+Date: 2026-09-01; updated 2026-09-02 14:52 MSK. Status: stage-1 engineering
+baseline complete; stage-2 binary graph and controller-readiness primitives,
+not a product runtime cutover or a connected production inventory collector.
 Execution order remains the four stages in
 [the ExecPlan](../OBSERVATORY_REALTIME_PROFILES_EXECPLAN.md).
 
@@ -100,6 +101,42 @@ explicit byte bound is required. No duplicate new scanner feed is introduced.
 
 ## Time and lifecycle
 
+Stage-2 controller-readiness increment, 2026-09-02 14:52 (`92625bf`):
+`WorkerReadinessMonitor` consumes existing `WorkerOperatingEnvelope` and
+`WorkerSnapshot` under the same lifecycle lock as admission. No host I/O occurs
+under this lock. The trusted controller, not a sensor payload, provides the
+snapshot in a locally comparable Worker monotonic clock domain and seals the
+mode/envelope into its effective configuration. Snapshot arrival is not a lease
+renewal, and renewing a lease does not refresh inventory. Identity, exclusive
+ownership, known inventory and freshness are mandatory in both modes.
+
+`strict-envelope` rejects post-warmup performance conditions outside the
+preregistered envelope. `labelled-experiment` permits these conditions, including
+unknown performance facts, but records violations and never grants real-time
+qualification. It cannot waive unknown/competing GPU clients, stale inventory,
+changed worker/image/config/owner or missing warmup. Low clocks during STARTING
+do not prohibit model warmup; transition to RUNNING checks warmup explicitly.
+Freshness is checked before spawn/admission/compute/result/heartbeat and in the
+50-ms watchdog. A late telemetry refresh cannot resurrect expired authority;
+old StreamStart updates are rejected without stopping the current owner.
+
+Readiness loss enters STOPPING and stops only owned child groups. A new owner
+still requires verified child/thread/callback/input release and a new generation
+and epoch. The monitor cannot clear an active durable lease, force recovery,
+start a replacement model, change host clocks/quotas or stop other services.
+It retains one snapshot and bounded reason sets, not unlimited telemetry history.
+
+The existing diagnostic PilotController has no continuous real collector yet;
+unconfigured runtimes expose `worker_readiness.enabled=false` and cannot claim
+monitored readiness. No authentication or host-clock translation is implemented
+by this in-process method. External inventory collection, control-channel
+delivery, production admission/recovery and standalone packaging remain stage 2.
+349 focused tests and four sequential Worker Linux CPU-only scenarios pass.
+The latter use synthetic GPU facts, zero GPU devices/models and real child
+processes: stop 10.676–63.994 ms, zero residual input, released fixture generation
+4. These are not new GPU graph timings. Evidence manifest SHA-256:
+`4588995d763fe82d896b42689e981f1d00feedaf9d6aab29f4579f771d03da3a`.
+
 Stage-2 raw IPC increment, 2026-09-02 (`da60fef`, `a937400`, `79ce55d`):
 `streaming_wire.py` maps existing `LiveIngressEvent` fields into
 `missioncore.live-perception-wire/v2`. The v1 producer hooks, class and legacy