docs(telemetry): record managed contour operations

deploy/telemetry-plane/README.md

@@ -65,6 +65,24 @@ in process arguments or committed files. `--initialize` generates `.env` with mo
 `0600` and refuses to replace existing credentials. The generated `.env` and `runtime/`
 directory are ignored by Git.
 
+After initial provisioning, the selected compute contour owns the operational network
+profile in `Система → Вычислительные модули → Настройки контура`. The profile keeps
+these concerns separate:
+
+- the stable broker hostname resolved by the worker, preferably the operator Mac's
+  `.local` name;
+- the exact private LAN address on which Docker publishes the authenticated listener;
+- the stable worker hostname used by the trusted SSH bootstrap profile.
+
+Mesh access points inside one LAN are not registered as separate broker endpoints.
+Roaming between them preserves the same hostname-based profile. Moving the kit to a
+different LAN requires selecting the Mac's new private bind address, applying it to the
+broker, and then applying the saved endpoint to the worker. Both actions are explicit.
+The broker update changes only `MISSIONCORE_MQTT_BIND_ADDRESS` in the private `.env`;
+the worker update changes only the Telegraf service endpoint and interval, preserves its
+scoped credential, verifies DNS plus TCP, and rolls back on failure. Wildcard
+`0.0.0.0` and public MQTT endpoints are rejected.
+
 The product architecture and topic contract are defined in
 `docs/adr/0031-local-compute-contour-telemetry-plane.md`.
 
@@ -101,13 +119,30 @@ The same host service reads the existing perception worker's loopback `/health`
 contract with `Get-NdcMissionCorePipelineTelemetry.ps1` and publishes nine
 stage-keyed snapshots to the contour's `pipeline` topic. The perception container
 does not receive broker credentials and no second agent container is introduced.
-These snapshots expose current durable-worker state and cumulative stage timing;
-native per-run lifecycle events remain a separate compute contract.
+These snapshots expose current durable-worker state and cumulative stage timing.
+
+The runner also appends canonical run lifecycle documents plus one bounded
+start/aggregate-terminal pair per stage to `pipeline-telemetry.jsonl` in the
+already-mounted persistent publish directory. Stage records retain the first/last
+frame boundary and aggregate activation count without producing one MQTT row per
+frame activation.
+Telegraf's `inputs.tail` owns the saved file offset, keeps at most 1000 undelivered
+lines in flight and publishes the records through the same QoS 1 pipeline output.
+The normalizer verifies the topic-bound record and restores the original native
+document before storage. A broker outage therefore stays inside the existing
+Telegraf buffer; the perception container receives neither MQTT credentials nor a
+second network client. Telemetry write failure is reported in `/health` but does not
+change inference control flow.
 
 When the mounted perception runner itself changes, use
 `Update-NdcMissionCorePerceptionRunner.ps1` with exact predecessor and candidate
-digests. It backs up the mounted runner, restarts the same container, accepts only a
-ready health document with stage metrics, and restores the predecessor on failure.
+digests for both the runner and its standalone telemetry module. It backs up the
+mounted files, restarts the same container, accepts only a ready health document with
+stage metrics and a ready native journal transport, and restores the predecessor on
+failure. Update the token-stdin launcher separately with
+`Update-NdcMissionCorePersistentLauncher.ps1`; this keeps the operational
+contour/agent/node identity explicit and reviewable without changing the K1 command
+sequence.
 
 The stack and agent are intentionally not started by repository tests. Provisioning a
 machine is a separate, explicit operation.