refactor(platform): freeze laboratory and telemetry boundaries

deploy/telemetry-plane/README.md

@@ -43,9 +43,43 @@ unique passwords and build the ACL/password files before starting the stack.
 
 ```bash
 uv run python prepare.py --initialize --mqtt-bind-address <MISSION_CORE_HOST_LAN_IP>
+uv run python prepare.py --enroll-agent worker-006 --contour-id worker-006
+uv run python prepare.py
 docker compose up -d --build
 ```
 
+`--enroll-agent` is generic: repeat it with a new globally unique `agent-id` and
+the contour it owns. Agent credentials live only in the private
+`runtime/agents.json` registry with mode `0600`. A normal `prepare.py` run rebuilds
+the Mosquitto password file from that exact registry and generates one non-wildcard
+writer ACL per agent, so removed or renamed identities cannot survive in the broker
+password file by accident. Existing installations can use `--migrate` to import the
+old Worker 006 variables once without replacing their credential.
+
+Build the reviewed Windows installer bundle and export the selected agent's private
+stdin payload as separate files:
+
+```bash
+uv run python prepare.py --build-agent-bundle windows \
+  --output runtime/missioncore-telemetry-agent-windows.zip
+uv run python prepare.py --export-agent-payload worker-006 \
+  --node-id DESKTOP-OPJ8J04 \
+  --output runtime/worker-006.private.json
+```
+
+The ZIP is deterministic, content-addressed and contains only the pinned installer,
+updater, collector and configuration template. It contains no credential. Transfer
+the ZIP and private payload separately; on the Worker, unpack the ZIP and pass the
+payload through stdin:
+
+```powershell
+Get-Content .\worker-006.private.json -Raw |
+  .\Install-NdcMissionCoreTelegraf.ps1
+```
+
+Delete the transferred payload after the service has been accepted. The installer
+persists the scoped credential only in the ACL-restricted Windows service environment.
+
 Expected Docker object names:
 
 ```text
@@ -97,8 +131,8 @@ replacement for MQTT TLS.
 
 Each agent credential is bound to one exact
 `contours/<contour-id>/agents/<agent-id>/+` prefix. Adding another contour requires
-issuing another password entry and explicit ACL row; the wildcard contour writer is
-not permitted.
+`--enroll-agent`; the wildcard contour writer is not permitted. An `agent-id` is
+globally unique because Mosquitto ACL ownership is username-based.
 
 ## Worker agent
 
@@ -134,6 +168,12 @@ frame boundary and aggregate activation count without producing one MQTT row per
 frame activation.
 Telegraf's `inputs.tail` owns the saved file offset, keeps at most 1000 undelivered
 lines in flight and publishes the records through the same QoS 1 pipeline output.
+The source outbox rotates at 64 MiB into content-addressed
+`pipeline-telemetry.<sha256>.jsonl` segments. Telegraf tails both the active file and
+segments. At eight retained segments the writer fails telemetry publication
+observably instead of deleting evidence which may not yet have been acknowledged.
+Segment reclamation therefore remains an explicit operator action after normalized
+storage is verified; inference control flow remains fail-open.
 The normalizer verifies the topic-bound record and restores the original native
 document before storage. A broker outage therefore stays inside the existing
 Telegraf buffer; the perception container receives neither MQTT credentials nor a