docs(perception): close stage-one baseline and record freshness proof

docs/adr/0049-stream-first-perception-profiles.md

@@ -137,6 +137,31 @@ remain the domain vocabulary. `LayerEvidence` adds freshness/completeness checks
 not a second semantic ontology. In stage 2, layer manifests also carry their full
 input reference sets; a single anchor does not replace camera/cloud/pose lineage.
 
+Stage-1 implementation update, 2026-09-02 (`097e450`):
+`missioncore.perception-scene-freshness/v1` in `realtime_scene.py` extends
+`LayerEvidence` with oldest-required-input time and checks the six-layer dependency
+graph. A derived result cannot refresh its input age. Decimal int64 JSON strings
+preserve timestamps/sequence exactly; transport-neutral Python objects use integers.
+The pilot validates payload hashes and assesses freshness again at receipt, and
+must reassess at later use. Missing/stale output remains inspectable but cannot
+retain permissive advisory policy. This envelope is NOT a replacement for
+StreamStart identities, complete input lineage or controller lease fencing.
+
+The current pilot propagates the oldest last-seen permissive TGS cell into the
+costmap/policy age. Expiry currently suppresses the entire scene's permissions;
+stage 2 must implement explicit per-cell expiration without granting authority
+from retained occupied/unknown history. Existing model/geometry/motion/TGS/material
+outputs remain identical to the pinned reference on the measured 128-frame window.
+Freshness/completeness is not semantic correctness or physical safety.
+
+`worker_operating_envelope.py` checks a trusted post-warmup snapshot against
+preregistered hardware/driver/resource/clock conditions and StreamStart identities,
+ownership and client inventory. Unknown or expired facts fail readiness. The
+candidate records the previously measured 4090 fixed-clock envelope; a compatible
+auto-clock experiment cannot inherit its latency result. The evaluator performs
+no I/O, host clock changes, lease acquisition or qualification; collection and
+continuous enforcement belong to the common controller/runtime in stage 2.
+
 DDRNet currently crops the center 600×600 to 512×512; outside that ROI is undefined,
 not hard_surface/free. RF-DETR accepts the full 800×600 native raster with its
 pinned valid-FOV handling. Their coordinates must be related explicitly.