fix(archive): preserve prepared sessions across restarts

docs/adr/0008-durable-observation-sessions-and-workspace-layout.md

@@ -73,11 +73,15 @@ committed metadata; replay stops at the last validated aligned boundary.
 
 ### Recorded spatial playback
 
-When a native capture is normally sealed or recovery-sealed, a bounded
-single-worker reconciler automatically prepares its private derived `.rrd`.
-Preparation is a backend lifecycle and is never executed by an HTTP replay
-request. Reopening, seeking, switching tabs or changing display settings reads
-the already prepared artifact and does not rerun conversion. Export is lossless
+When a native capture is normally sealed or recovery-sealed during the current
+process lifetime, a bounded single-worker reconciler automatically prepares its
+private derived `.rrd`. The reconciler's first scan establishes a historical
+baseline and does not enqueue old sessions. Preparation is a backend lifecycle
+and is never executed inside an HTTP replay request: an explicit request may
+enqueue one cold historical package and returns `202` while the worker owns the
+conversion. Reopening, seeking, switching tabs, listing the catalog or changing
+display settings reads the already published artifact and does not rerun
+conversion. Export is lossless
 with respect to every decodable point and pose message in the native capture;
 it does not pass through the bounded live-preview queue. The RRD uses the
 recording-local `session_time` duration timeline, while the receive wall clock
@@ -123,21 +127,23 @@ future replay v3 will need distinct spatial and session-union ranges.
 The path-free descriptor is atomically persisted in the private derived cache
 with its checksum and a stat identity covering the native timing origin and
 every camera summary, index, init and segment file. Restart performs confined
-stat validation and reuses an unchanged descriptor without reading/hashing media;
-a missing, corrupt or stale sidecar is rebuilt in the background. An unparseable
-or ambiguous fragment fails readiness rather than exposing a fake seekable
-camera. Replay requests consume the prepared descriptor and never repeat media
-conversion or timing analysis. Launch and manifest aggregate byte counts must
-agree before the browser admits camera payload downloads.
+stat validation and reuses an unchanged descriptor without reading/hashing media.
+A missing, corrupt or stale historical sidecar stays cold until that session is
+explicitly opened; startup, catalog reads and completion of another session do
+not rebuild it. An unparseable or ambiguous fragment fails readiness rather than
+exposing a fake seekable camera. Replay requests consume the prepared descriptor
+and never repeat media conversion or timing analysis. Launch and manifest
+aggregate byte counts must agree before the browser admits camera payload
+downloads.
 
 The derived RRD writes an actual zero-time anchor at the internal
 `/__mission_core/session_origin` entity. Keeping it outside `/world` prevents a
 synthetic visualization layer while ensuring that the decoded RRD timeline,
 not merely its summary document, begins at session time zero. This changes the
-derived payload contract. Cache v7 keeps that anchor and additionally binds the
-derived recording to the owning plugin ID, primary artifact and ordered source
-artifact set; it rejects v6 and older sidecars and performs one background
-rebuild.
+derived payload contract. Cache v9 keeps that anchor, binds the owning plugin,
+ordered source artifacts and capture-envelope endpoints, and materializes the
+sealed completion rows. Older sidecars are incompatible and remain cold until
+that session is explicitly opened.
 
 Replay v2 exposes two paths to the same pinned generation. `source_url` retains
 the strict `If-Match: "sha256:…"` contract for Mission Core clients;