docs(observatory): record real M49 publication and restart acceptance

docs/adr/0050-recorded-observatory-first.md

@@ -52,8 +52,11 @@ is recoverable. Changed profile versions become new calculations.
 
 The checkpoints below are chronological evidence, not a current TODO list.
 As of 2026-09-03, the queue/claim/cache/selector foundation is implemented and
-locally checked. Full recorded-analysis, measured progress and end-to-end
-published review on real recordings remain unaccepted; the current four-stage
+locally checked. Attempt-bound progress is implemented and active (`bee8552`,
+control-agent installation `54c8d82`). One real M49 run succeeded and published;
+exact cached document reopening survives restart after the no-op reindex fix
+`bd947b4`. Full recorded-analysis and synchronized saved visual replay remain
+unaccepted; the current four-stage
 route and next increment are maintained only in the linked ExecPlan.
 
 ## First implementation increment
@@ -151,6 +154,32 @@ Historical terminal logs do not become a new selection's error. The existing
 responsive selector layout follows workspace width, including restored narrow
 windows, rather than only the browser viewport.
 
+## Real progress, publication and restart proof — 2026-09-03
+
+Worker-to-backend-to-UI progress is claim/generation/sequence-bound and stored as
+one bounded current row per job. It does not renew ownership or change live
+semantics. One UI-submitted M49 × RAVNOVES004TREE run published on its first
+attempt after 1416.763 s. All 6830 fragment-schedule rows and result artifacts
+were verified; 19 missing-LiDAR positions remain UNOBSERVED, point accounting
+has zero unaccounted contributions. The schedule spans 39.215–757.160 s, not
+the whole 808.779 s source session. This CPU-only result is not a full AI profile.
+
+An actual canonical restart exposed a missed case: unchanged archive discovery
+advanced the source row's update clock, changing its admitted catalog hash and
+hiding the exact cache hit. Reconciliation now preserves the **entire existing
+snapshot** when only that incidental clock differs. Real changes still alter
+identity; the fingerprint, package and computation schemas are not weakened.
+The affected source's one clock field was restored only after reconstructing
+its exact admitted hash, with backup and transactional before/after fences.
+No source bytes, result provenance or job identity were rewritten.
+
+Following activation/restart, the same catalog, job and cached result document
+reopened; all previous jobs and claim history remain. However, the portable
+review currently renders a checked JSON document/artifact inventory, not video
+and TGS. Therefore stage 2B stays open for a common schema-bound saved visual
+adapter, using this sealed result without recomputation or legacy overlays.
+See [real-run and restart evidence](../../experiments/perception/OBSERVATORY_RECORDED_PROGRESS_2026-09-03.md).
+
 ## Boundaries
 
 No Synology deployment, hardware actuation, motor integration, new capture,