docs(observatory): record real M49 publication and restart acceptance

experiments/perception/OBSERVATORY_RECORDED_PROGRESS_2026-09-03.md

@@ -1,6 +1,7 @@
 # Recorded Observatory — attempt-bound progress and first real run
 
-Date: 2026-09-03. Current implementation: `bee8552`.
+Date: 2026-09-03. Progress: `bee8552`; control layers: `54c8d82`;
+unchanged-source reindex fix: `bd947b4`.
 This is an observation/control-plane increment of stage 2, not onboard or
 full recorded-analysis acceptance. No Synology release, physical acquisition,
 actuation, model replacement or GPU benchmark is involved.
@@ -37,6 +38,8 @@ actuation, model replacement or GPU benchmark is involved.
   actual subprocess invocation and timeout child cleanup. A separate **40 tests**
   cover portable runtime, M49 entrypoint/queue/LAB V1 wiring and minimal imports.
   Ruff and focused mypy pass. The existing TestClient deprecation warning remains.
+- Exact offline installer: **3 tests** covering file/hash inventory and declaration
+  fences. These are separate from the 128 + 40 backend checks above.
 - Canonical8000 was replaced only while the queue was idle. Previous UI output
   and a SQLite backup were retained. All rows in the six pre-existing tables
   matched their pre-update hashes; the new progress table was empty.
@@ -74,7 +77,7 @@ predecessors alongside replacements, use the old package launcher to overwrite
 the control layer, or restore an old SQLite backup over newer work. No reboot
 was performed; installed restart declarations, not reboot recovery, were checked.
 
-## Real run — status at 08:20 UTC
+## Real run — succeeded and published
 
 One ordinary UI Calculate action submitted:
 
@@ -82,16 +85,81 @@ One ordinary UI Calculate action submitted:
 - Setup: `m49-tgs-portable-v2`, definition
   `f56d6321bd794ccdfb7d2e3b05d044b11f616ffb81ee29517386cc253046d4eb`.
 - Job: `observatory-run-b230216709dc4c59bc56c98c7e329bf1`, generation 1.
-- Input inventory: 6837 members. Delivery completed after approximately 298 s;
-  input preparation is still running. There is no result/cache/view acceptance yet.
-- Queue: 10 retained failures, one retained historical success/not-required,
-  one running job, one current progress row. No second model/profile was started.
+- Input inventory: 6837 members. Delivery completed after approximately 298 s.
+  Initial LiDAR decode and source-stage construction completed before TGS; this
+  remains a whole-input executor, not the target incremental runtime.
+- Submitted `2026-09-03T08:08:03.013Z`; published on the first attempt at
+  `2026-09-03T08:31:39.776Z`: **1416.763 s / 23 min 36.763 s** end to end.
+- Result: `m49-tgs-portable-review-a09d2b4a07d103e4f3693ba746a51be2197214768774eabfded4f109ae80dce4`.
+  Package SHA-256: `52e8afd6aaa38b615008463b873b94feae160946a69ce67aba12efc5f12b1589`.
+  Central manifest: `0297a3502e7510e3d126ddf33e1afc2ef495638255351cd37a6dbed5b42ab832`.
+- All **10 central artifacts**, including the package manifest, independently
+  passed byte-length and streaming SHA-256 verification on the Mac. The package
+  contains 9 result members plus that manifest; sampled transfer progress ending
+  at 8/9 is not the publication/completeness authority.
+- **6830 ordered schedule rows**, **2244 costmap cells** per row. There are
+  6811 available LiDAR associations and 19 missing ones; the corresponding
+  costmap states are all UNOBSERVED and their height bounds remain NaN.
+- Point accounting: 149733073 eligible = 36777326 ground + 112748049 nonground +
+  207698 rejected; **0 unaccounted**. Counts cover rolling-window contributions,
+  not unique physical points across the entire route. Rejected is not free space.
+- Source-session duration is 808.779495667 s. This profile schedules one anchor
+  per admitted camera fragment: first 39.215263458 s, last 757.160263458 s;
+  the camera epoch ends at 757.260263458 s. Its 717.945 s anchor span is not
+  proof of coverage of every second of the 13:29 source or every decoded image.
+- Exact runner trace: TGS-only p50/p95 **1.204 / 2.6075 ms**, stage-wall p50/p95
+  **17.676102 / 29.991720 ms**. Sums are 9.122023 s TGS and 131.038739079 s
+  stage wall. These exclude source preparation, result assembly and transfer.
+  JSON `effective_fps=9.51187` is schedule cadence, not processing/onboard FPS.
+- Final queue: 10 retained failures, one retained historical success/not-required,
+  one new success/published, one v3 claim grant and one progress row. All 11 old
+  jobs, the 50000 legacy claim receipts and previous reconciliation remain intact.
+  No second profile, LAB V1, ML/GPU model or onboard execution was started.
 
 An early diagnosis based on a stationary 556912640-byte temporary camera archive
 did **not** prove a network stall. That equals the sealed archive's complete
 length; the job subsequently advanced normally. Do not report it as a proven
 transport outage or benchmark.
 
+## Restart found and fixed a real cache defect
+
+The first idle-only canonical restart recovered health in 20.985 s and preserved
+all 12 job rows, but **failed cache acceptance**. The result document still opened;
+the profile reappeared in the calculation selector. Archive reconciliation
+unconditionally replaced `observation_sessions.updated_at_utc`; that field is
+part of the exact source catalog hash, so unchanged data looked like a new source.
+
+`bd947b4` keeps the existing fingerprint algorithm and all source/artifact fields.
+Inside the candidate transaction it compares the complete before/after snapshot
+with the previous update clock. If everything else is identical, it rolls back
+the no-op reindex. Real session/source/artifact differences still commit with
+the new timestamp. This does not introduce matching by LAB name or weaken source
+or result integrity.
+
+The already-published job needed one bounded metadata repair: changing only its
+source row's clock from `2026-09-03T08:36:25.809Z` back to
+`2026-09-03T08:06:12.724Z` reconstructs **exactly** the admitted full-catalog hash
+`2db6b8f109f5cc31bb32733ca633e03becca83d1f140a68ecc9ec9522010c24e`.
+The old clock was recovered by a bounded, read-only millisecond candidate check
+in this turn's known startup/admission interval; no other field was varied.
+A SQLite backup was retained. The transaction rechecked the current hash, then
+the reconstructed admitted hash, and changed only that one field in one row.
+Raw evidence, package/provenance and job receipts were not rewritten or recomputed.
+Do not generalize this repair to another source without the same exact hash proof.
+
+Validation: **89 session-store/publication tests** (including 7 new regressions),
+**72 admission/LAB-cache/queue/API tests**, Ruff and focused mypy pass. A new store,
+reconciliation with a later clock and cold result cache preserve reuse; actual
+session/source/artifact changes still invalidate it. No frontend rebuild was
+needed for this backend-only repair; the previously verified progress UI remains.
+
+After activation/restart, canonical8000 recovered in 20.650 s with PID77997.
+Catalog, complete job projection and result view equal their pre-restart values.
+Browser Refresh/reopen keeps M49 below, only LAB V1 remains in the selector,
+and the exact result document opens with no new job. The 12 job rows remain
+unchanged. This proves saved **document/cache** persistence, not visual replay.
+The first failed acceptance is retained in the evidence, not overwritten as PASS.
+
 ## Remaining boundaries — not hidden by the progress feature
 
 1. This does not introduce `recorded-analysis` into the retained live runtime.
@@ -106,10 +174,21 @@ transport outage or benchmark.
 4. Phase snapshots are not a complete performance trace. Warmup/stage timings,
    throughput, all required-frame accounting and onboard estimates need separate
    evidence. These UI counts are not FPS or real-time qualification.
-5. Stage 2B remains open until this run publishes an exact, reviewable result and
-   cached reopening is verified. LAB V1 and the other recording follow sequentially.
+5. **Stage 2B is not closed.** Publication and cached document reopening after
+   restart are proved, but `portable-result-review` currently renders JSON and
+   the artifact inventory, not synchronized camera/TGS playback. The existing
+   title “полный маршрут и воспроизведение” is not an accepted capability proof.
+   Add a schema-bound, bounded saved-data adapter to the common replay pattern;
+   admit only this result's arrays and the exact source camera timeline. Do not
+   reuse the legacy 4489-frame M49/E47 overlays or invent semantic/detector layers.
+   Reuse this sealed result to validate the viewer without another inference run.
+6. LAB V1 and the other recording follow sequentially after the first visual
+   cycle. Full time coverage/source synchronization must be qualified separately
+   from counts on the current fragment schedule.
 
 Private evidence, not Git: `.runtime/observatory-progress-DbxaPA/` contains the
 SQLite backup and row hashes, payload/plan/receipt/declarations, build/test logs,
-submitted job and bounded read-only progress observations. Model assets and
+submitted/completed jobs, result/artifact checks, restart failure, exact clock
+repair proof/backup and cache/history acceptance, plus bounded read-only progress
+observations. Model assets and
 recorded camera/LiDAR payloads are not copied into this report.