fix(replay): stream sealed perception overlays

docs/01_IMPLEMENTATION_PLAN.md

@@ -17,7 +17,8 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | E31 binding sensitivity | MEASURED — E45 closes accounting for 87/87 accepted correspondences and finds no material monotonic residual association with represented image radius, rig speed or pose age. It does not supply calibration-target truth or outer-fisheye coverage. |
 | Detector Truth Island | PREPARED FOR HUMAN REVIEW — E46 freezes 32 references with no prelabels, predictions, scores or candidate identity. Immutable handoff `e46-review-handoff-652f7409c8a529946a26264cea006f3afdd714e19529c731e0f66d0f03fd5668` provides two separately assigned, hash-verified CVAT/COCO reviewer packages and a fail-closed E48 converter. Two real independent reviews and adjudication are still required; the handoff is not ground truth. |
 | Detector candidate comparison | FROZEN BEFORE TRUTH — E47 freezes raw-KB4 and fixed-valid-FOV-fill predictions from the same exact Mask R-CNN checkpoint. No accuracy result or winner exists before the E46 truth seal. |
-| Detector truth/evaluation executors | READY, NOT RUN — E48 fail-closed review/adjudication sealing and separate post-seal E49 scoring are implemented. Neither result exists because real independent reviews are absent. |
+| Detector truth/evaluation executors | DEFERRED BY OWNER, READY, NOT RUN — E48 fail-closed review/adjudication sealing and separate post-seal E49 scoring are implemented. Neither result exists because real independent reviews are absent. The deferral does not convert E37–E40 into blind truth and does not block R2/R4 operational work. |
+| RAVNOVES00 recorded AI publication | GO — after a real backend restart, the admitted E10 overlay `e10-integrated-perception-36964643f1c0727a434671e3cddc2e76c536b9c28b8c56845f18941ae791c39a` recovered from its sealed cache without model execution or source revalidation. Recording `f83e29dc-5d25-42a5-824e-228cdbb83d21` streamed `69,227,327` bytes with verified SHA-256 `c2bb73fca8bb616a3929df236c6dc63d071b6466a6ca57d06487ef18ed985b57`; a warm localhost request completed in `0.391 s`, and its steady-state server RSS delta was `48 KiB`. |
 | Product interface | DEFERRED — no new windows, page anatomy or design changes are part of this stabilization increment. |
 
 The governing decision is

docs/20_RAVNOVES00_REFERENCE_SOURCE_PRODUCT_PLAN.md

@@ -68,7 +68,9 @@ failures remain blocking even when an aggregate percentage passes.
 | R4 — reference release candidate | Replay the complete RAVNOVES00 source through the accepted pipeline at recorded pace with regression, resource and recovery evidence | Source-scoped release decision for the known-location product envelope |
 | R5 — later transfer | Under the preregistered E43 protocol, record the same K1 and mount over a new route after explicit operator authorization; freeze predictions before independent labels are revealed | Generalization decision; no retuning before comparison |
 
-R0–R2 and non-UI R4 preparation are the active stabilization path. R3 is
+R2 and non-UI R4 preparation are the active stabilization path. The owner has
+deferred the two-reviewer E46–E49 blind-acceptance branch without cancelling or
+weakening it; no independent accuracy claim exists while it is deferred. R3 is
 explicitly deferred for separate discussion. R5 has a frozen protocol but no
 capture or labels yet.
 
@@ -195,6 +197,42 @@ seal and computes the frozen AP/AR, miss, large-box, valid-FOV-centre leakage
 and temporal class-count metrics. It cannot select a candidate automatically.
 No E48/E49 result exists until two real reviews and adjudication are supplied.
 
+### Recorded AI publication checkpoint · 2026-07-30
+
+The existing accepted E10 generation is now usable as a stable recorded product
+layer rather than a replay-time compute job:
+
+- source session: `20260720T065719Z_viewer_live` (`RAVNOVES00`);
+- admitted result:
+  `e10-integrated-perception-36964643f1c0727a434671e3cddc2e76c536b9c28b8c56845f18941ae791c39a`;
+- Rerun recording identity:
+  `f83e29dc-5d25-42a5-824e-228cdbb83d21`;
+- sealed overlay length: `69,227,327` bytes;
+- sealed overlay SHA-256:
+  `c2bb73fca8bb616a3929df236c6dc63d071b6466a6ca57d06487ef18ed985b57`.
+
+After a real restart of the canonical `127.0.0.1:8000` backend, the server
+recovered the cache admission without running the detector, segmentation or
+fusion pipeline and without revalidating the heavy source artifacts. The
+publication path verifies the bounded sidecar, RRD magic, byte length and
+streamed file SHA-256, then returns a file-backed HTTP response. It no longer
+copies the complete 69 MB overlay into the Python heap before sending it.
+
+Acceptance evidence:
+
+- focused overlay, mux and session-API tests pass;
+- the restarted product endpoint returned HTTP `200` with the exact length,
+  media type and SHA-bound ETag;
+- a throttled `8.241 s` transfer remained bounded, and a subsequent warm
+  `69,227,327`-byte transfer completed in `0.391 s`;
+- steady-state backend RSS changed by only `48 KiB` across that warm transfer;
+- the canonical service remained on port `8000`; no service listened on
+  `8765`.
+
+This closes the availability and recovery part of R4 for the existing admitted
+AI overlay. It does not close detector accuracy, blind review, navigation or
+safety acceptance.
+
 E43 immutable protocol
 `e43-future-capture-protocol-28f091b9648daffce988d44c183e21f56d77988061630de934f8003fb13701d8`
 preregisters the later same-K1/new-route transfer. It requires the same mount,
@@ -231,11 +269,10 @@ The current non-UI priority order is:
    producers to adopt verified resolution before any separately authorized
    physical reclamation;
 5. preserve E43 unchanged until the owner supplies the new capture.
-6. complete two independent E46 reviews and adjudication without exposing
-   model prelabels or E47 predictions;
-7. reveal the sealed truth only after the E47 prediction freeze, then calculate
-   the preregistered detector metrics and select or reject a preprocessing
-   candidate.
+6. keep the E46 handoff, E47 prediction freeze and E48/E49 executors immutable
+   while the owner-requested review deferral is active;
+7. continue R2/R4 deterministic replay, recovery and resource acceptance
+   without treating operational readiness as independent detector accuracy.
 
 The following remain outside the present stabilization increment:
 
@@ -244,6 +281,8 @@ The following remain outside the present stabilization increment:
 - initiation of a new physical route/camera capture by an agent;
 - second K1 or changed mount generalization;
 - open-world and adversarial evaluation.
+- two independent E46 reviews, adjudication and E49 candidate scoring until the
+  owner resumes that branch.
 
 The owner may provide a future recording under E43. Until it exists, current
 work neither depends on it nor simulates its result. The existing E36 audit and