refactor(platform): harden LAB evidence and telemetry

docs/adr/0031-local-compute-contour-telemetry-plane.md

@@ -16,10 +16,9 @@ The first local contour is active:
 - Mission Core on canonical port `8000` uses this adapter for live System
   telemetry and reports the source as `agent-mqtt`;
 - SSH is retained only for explicit profile diagnostics and bootstrap checks.
-- the selected contour owns a managed network profile: Worker 006 uses
-  `desktop-opj8j04.local`, resolves the broker through the operator Mac's stable
-  `.local` name, and keeps the current private Docker bind address as a separate
-  reviewed value;
+- the selected contour owns a managed network profile: Worker 006 keeps its node
+  identity separate from its SSH address and from the broker endpoint; every saved
+  endpoint and private Docker bind address is probed before an explicit transition;
 - the existing contour settings can probe DNS/TCP from both Mac and Worker, apply the
   listener address to the local broker, and apply the endpoint to the Telegraf Windows
   service without exposing or replacing its scoped credential.
@@ -81,11 +80,27 @@ The direct SSH/PowerShell probe remains a bounded bootstrap and diagnostic fallb
 the existing Worker 006 profile. It is not the target live telemetry transport.
 
 Mesh access points belonging to one LAN are not modeled as separate broker addresses.
-Roaming keeps the stable hostname contract. A move to another LAN changes the reviewed
-private bind address, not the agent identity or MQTT topic identity. Applying a saved
-profile is explicit, verifies DNS and TCP reachability, and rolls back the affected
-configuration when verification fails. MQTT without TLS cannot be configured for a
-public endpoint or wildcard listener.
+The broker endpoint may be a hostname only when the Worker can resolve it; Mission Core
+does not assume that macOS `.local` discovery is portable to Windows. A move to another
+LAN changes the reviewed endpoint and private bind address, not the agent identity or
+MQTT topic identity. Applying a saved profile is explicit, verifies DNS and TCP
+reachability, and rolls back the affected configuration when verification fails. MQTT
+without TLS cannot be configured for a public endpoint or wildcard listener.
+
+## 2026-08-05 recovery correction
+
+Worker 006 stopped publishing because its Telegraf MQTT output still referenced the
+operator Mac through a `.local` name that Windows no longer resolved. Telegraf exited
+on the output connection error, and the Windows service had no configured recovery
+actions. The reviewed compute-contour transition rebound the broker and worker profile
+to the currently verified private LAN endpoint without replacing the scoped MQTT
+credential; fresh agent, hardware and pipeline telemetry then returned.
+
+Install, update and existing-agent network transitions now configure the same bounded
+Windows recovery policy: restart after 5 seconds, 30 seconds and 60 seconds, resetting
+the failure counter after one day and applying recovery to non-crash failures. This
+does not make an invalid endpoint valid; it keeps transient broker or network loss from
+silently leaving the telemetry agent stopped after connectivity returns.
 
 ## Why these components
 

docs/adr/0036-configurative-laboratory-evidence-registry.md

@@ -0,0 +1,67 @@
+# ADR 0036: Configurative laboratory evidence registry
+
+Date: 2026-08-05
+Status: accepted and implemented as the first migration slice
+
+## Context
+
+The advanced LAB index grew by adding one result-id regular expression, one root
+provider argument, one application wiring block and one tuple for every experiment.
+That made the Mission Core control plane structurally dependent on an expanding list
+of experiment names. It also made a new frozen evidence source look like a new product
+runtime pipeline even when the UI only needed read-only result discovery.
+
+The target product architecture has a stricter dependency direction:
+
+```text
+contracts -> providers -> graphs -> experiments
+```
+
+Mission Core owns configurations, runs, evidence, health, telemetry and operator
+control. Experiment code may invoke production graphs and freeze evidence, but the
+core must not import an experiment to discover that evidence.
+
+## Decision
+
+Advanced LAB evidence sources are declared as one versioned JSON definition per
+`work_id` under `config/laboratories/`. Each definition contains only:
+
+- a repository-runtime-relative evidence root;
+- a digest-bound result-id prefix;
+- the bounded identity document name;
+- the exact identity-document schema version.
+
+`LaboratoryEvidenceRegistry` discovers these files without importing experiment code.
+It rejects unknown keys, unsafe or non-normalized paths, symlinked definitions,
+oversized files, invalid identifiers and duplicate work IDs, roots or result prefixes.
+The existing advanced index keeps its previous fail-closed evidence validation:
+identity digest, schema, creation time and read-only/no-command authority must still
+match before a result is published.
+
+The production advanced index now obtains all 27 standard evidence sources through
+this registry. Adding another standard source therefore adds data, not another router
+parameter or application wiring branch.
+
+## Explicit non-goals
+
+This first slice configures evidence discovery; it does not claim that the historical
+experiment implementations are already reusable production graphs. E31-E40 retain
+specialized read-model projectors behind their current adapters while those payloads
+are converted to canonical contracts. L3/L31/L32/L33 retain bounded legacy identity
+adapters because their stored evidence does not yet use the common identity document.
+
+The registry does not select detectors, trackers, planners or command paths and cannot
+grant navigation or safety authority. Future executable LAB definitions must reference
+versioned provider/graph contracts; they must not contain arbitrary Python imports or
+shell commands.
+
+## Consequences
+
+- LAB growth no longer expands the product composition root for standard evidence.
+- Evidence location and identity contracts are reviewable, diffable configuration.
+- A malformed or ambiguous definition prevents startup instead of silently exposing
+  the wrong evidence.
+- The remaining manual frontend fetch/render map and specialized backend projectors
+  are visible migration debt, not the intended extension mechanism.
+- The next architecture slice can add provider and graph registries against the
+  canonical perception contracts without making experiments dependencies of core.