fix(runtime): fail closed on offline artifact misses

docs/09_OBSERVATION_SESSIONS.md

@@ -224,7 +224,7 @@ a separately attested storage root:
 export MISSIONCORE_DATA_DIR=/absolute/private/path/mission-core
 # Full K1 point-plus-camera evidence must currently remain below the checkout.
 export MISSIONCORE_EVIDENCE_DIR=/absolute/path/to/NODEDC_MISSION_CORE/.runtime/mission-core/evidence/sessions
-# Optional operator retention quota; unset means no application byte quota.
+# Optional operator override; the application default is 8 GiB.
 # export MISSIONCORE_RRD_CACHE_MAX_BYTES=8589934592
 export MISSIONCORE_RRD_FREE_SPACE_RESERVE_BYTES=2147483648
 uv run k1link serve
@@ -298,10 +298,11 @@ global cross-process export gate to cap concurrent RAM, CPU and temporary-disk
 use. Crash leftovers from candidates, exporter temporary files and staged replay
 prefixes are scavenged under that lock before capacity accounting. Ready cache
 hits and active response leases do not wait behind that gate. The derived cache
-has no application byte quota by default, so a single multi-hour RRD is not
-rejected at 8 GiB. It still preserves a 2 GiB default filesystem reserve. An
-operator may set `MISSIONCORE_RRD_CACHE_MAX_BYTES` to enable LRU eviction of
-derived RRDs only; native evidence is never deleted.
+has an 8 GiB application byte quota and a 2 GiB filesystem reserve by default.
+`MISSIONCORE_RRD_CACHE_MAX_BYTES` can override the quota; LRU eviction still
+affects derived RRDs only, and native evidence is never deleted. A single
+derived RRD larger than the configured quota fails explicitly instead of
+consuming the operator host without a bound.
 
 ## Capture-clock envelope
 

docs/adr/0011-laboratory-plugin-runtime-handshake-and-transport-seam.md

@@ -63,9 +63,10 @@ gateway remains a same-process data-plane route; portable stream/media IPC is a
 separate future gate.
 
 `GET /api/v1/device-plugin-runtimes` exposes the small lifecycle snapshots. The
-main health response reports ready/total runtime counts. These values do not
-claim device connectivity, sensor health, process containment or durable
-supervision.
+main health response includes ready/total runtime counts as one component beside
+recording-cache, shared-artifact, media-tool and catalog-reconciler readiness.
+The plugin values still do not claim device connectivity, sensor health,
+process containment or durable supervision.
 
 ## Acceptance
 

docs/adr/0022-operator-surface-ownership.md

@@ -77,6 +77,11 @@ Contour health reads only live contracts:
 - `GET /api/v1/polygon/worker`;
 - current Mission Runtime state for active device and perception metrics.
 
+The base health contract now separates local operational readiness from
+production shared-artifact readiness and reports bounded cache, catalog
+reconciler, media-tool and Map Gateway configuration states. It performs no
+remote fan-out and never invents Worker 006 or device health.
+
 Unknown or unavailable values remain empty/offline. The UI does not invent
 load, latency, activity or connected devices.
 

docs/adr/0033-central-session-artifacts-and-bounded-host-cache.md

@@ -84,6 +84,10 @@ The integrated-perception endpoint resolves
 results. A sealed central/local CAS hit therefore needs neither Worker 006 nor
 the original E10 result tree. Invalid central metadata fails closed; a genuinely
 absent central role can still use the existing local materialization path.
+When the central store is unavailable, however, a missing local CAS role is not
+treated as an absent role: base RRD export and overlay rendering both fail with
+an explicit offline-cache error. This prevents one disconnected operator host
+from silently producing a second derived truth.
 
 ## Persistent pins and offline use
 
@@ -105,7 +109,15 @@ When the central root is unavailable:
 
 - a sealed local reference, manifest, and object resolve normally;
 - an absent local object returns an explicit offline-cache error;
-- Mission Core does not silently fetch from Worker 006 or start a heavy AI run.
+- Mission Core does not invoke the local RRD exporter, scan stale worker
+  results, render an overlay, fetch from Worker 006 or start a heavy AI run.
+
+`GET /api/health` exposes the effective shared/standalone mode, central-store
+availability, bounded CAS and RRD-cache occupancy, media-tool availability and
+the background catalog reconciler state without disclosing filesystem paths.
+Operational readiness remains distinct from production shared-artifact
+readiness so an offline, already pinned field host stays observable rather than
+being mistaken for a fully connected host.
 
 ## RAVNOVES00 migration acceptance