docs(perception): record full-graph network and recovery evidence

docs/adr/0049-stream-first-perception-profiles.md

@@ -1,9 +1,9 @@
 # ADR 0049 — Stream-first full perception profiles
 
-Date: 2026-09-01; updated 2026-09-02 18:11 MSK. Status: stage-1 engineering
-baseline complete; stage-2 authenticated gRPC candidate has cross-host CPU proof.
-Full-graph network integration, native-host GPU inventory, standalone image and
-product cutover remain open; transport proof is not physical-live acceptance.
+Date: 2026-09-01; updated 2026-09-02 19:00 MSK. Status: stage-1 engineering
+baseline complete; stage-2 full graph has authenticated container-network proof.
+Cross-host full-graph clock/grant integration, native-host GPU inventory,
+standalone image and product cutover remain open. This is not physical-live acceptance.
 Execution order remains the four stages in
 [the ExecPlan](../OBSERVATORY_REALTIME_PROFILES_EXECPLAN.md).
 
@@ -777,3 +777,55 @@ warns that a completed write need not mean network delivery;
 [channel options](https://github.com/grpc/grpc/blob/master/include/grpc/impl/channel_arg_names.h)
 documents the fixed lookahead window. Source and actual behavior were checked;
 these references alone are not a performance qualification.
+
+## Stage 2 increment 13: full graph over container networking (2026-09-02)
+
+The same `BinaryGraphInput` decoder and causal sensor cut now feed the full
+graph from `NetworkGraphBridge`. Source and receiver execute in a separate
+CPU-only container. No camera/index/sensor recording mount exists in the GPU
+container. Resident DDRNet/RF-DETR/decoder/TGS children and the local Worker
+lease remain owned by the existing controller; remote ingress cannot restart
+models or renew the lease.
+
+The return payload carries the existing scene plus the actual uint8 segmentation
+plane. Grid coordinates join the costmap digest. Result1MiB, JSON512KiB and plane
+512KiB caps are checked before parsing/retention; total framing also fits1MiB.
+The receiver verifies raw mask and all layer hashes and independently derives
+freshness/policy. Network arrival, integrity-validation completion and complete
+consumer-view readiness are recorded separately.
+
+The pilot verifies a common Linux boot and zero monotonic namespace offsets.
+Its grant file is trusted local control, read-only to the source; source status
+uses a separate mount. It is **not** the production grant delivery or cross-host
+clock mapping implementation. A foreign clock cannot be silently subtracted.
+
+Final normal128b:128/128 byte-exact received scenes, raw model/geometry/motion/
+costmap parity to the prior reference, no queue drops, one input epoch, no resets.
+Consumer-ready p95/p99/max106.150/115.349/126.910ms. One frame exceeds125ms;76/128
+scenes have complete six-layer freshness, with52 original missing sensor pairs.
+Gap128b:2.2s disconnect,102 completed +26 omissions24–49, fresh keyframe/pair
+resume50, exactly one temporal reset, same four PIDs and lease generation1.
+Consumer-ready p95/p99/max107.098/110.817/117.317ms; availability gap2.725s.
+Post-gap history-dependent outputs are not asserted equal to uninterrupted
+history. All230 mask/scene receipts and their derived views were rechecked.
+
+These runs use temporary stock2610/10251MHz clocks,450W,8CPU/8GiB model and
+2CPU/1GiB source envelopes. They prove container-network behavior on one
+Worker, **not** Mac↔Worker/radio/live latency. Observed result maximum460248B,
+tracked peak13,217,791B, residual0. Full-model slow consumer and cross-host
+clock/grant integration precede standalone packaging; product cutover remains
+closed. Diagnostic startup retry is not a production recovery service.
+
+Source init originally preceded the delayed start by2s and triggered a spurious
+idle timeout. The source now connects100ms before release, without relaxing
+the timeout. Final normal/gap have zero/one intended recovery. Missing runner,
+read-only mountpoint and launcher ExitCode failures are retained as rejected
+attempts.146 focused tests pass;2 larger Worker-only tests skipped on Mac.
+
+Evidence236 artifacts at
+`.runtime/perception-stage2-network-graph-20260902T1541Z/manifest.json`, SHA256
+`d1bc7e26850a2d9050ee1d8f8a5ece2e6b8c53e2e7dba381cbd4445d68a5ec17`.
+See [the detailed report](../../experiments/perception/PERCEPTION_STREAM_STAGE2_NETWORK_2026-09-02.md).
+Four prior services and automatic clocks restored; transient containers,
+networks, lease volumes, keys and grants removed. Ollama/Frigate stay disabled.
+Mac8000 and Worker telemetry remain available; no8765 or external deployment.