docs(telemetry): record managed contour operations

docs/adr/0031-local-compute-contour-telemetry-plane.md

@@ -16,6 +16,13 @@ The first local contour is active:
 - Mission Core on canonical port `8000` uses this adapter for live System
   telemetry and reports the source as `agent-mqtt`;
 - SSH is retained only for explicit profile diagnostics and bootstrap checks.
+- the selected contour owns a managed network profile: Worker 006 uses
+  `desktop-opj8j04.local`, resolves the broker through the operator Mac's stable
+  `.local` name, and keeps the current private Docker bind address as a separate
+  reviewed value;
+- the existing contour settings can probe DNS/TCP from both Mac and Worker, apply the
+  listener address to the local broker, and apply the endpoint to the Telegraf Windows
+  service without exposing or replacing its scoped credential.
 
 The existing Worker 006 containers were renamed in place to
 `ndc-mission-core-triton` and `ndc-mission-core-perception-worker`. Their
@@ -60,6 +67,13 @@ would hide part of the host it is meant to observe.
 The direct SSH/PowerShell probe remains a bounded bootstrap and diagnostic fallback for
 the existing Worker 006 profile. It is not the target live telemetry transport.
 
+Mesh access points belonging to one LAN are not modeled as separate broker addresses.
+Roaming keeps the stable hostname contract. A move to another LAN changes the reviewed
+private bind address, not the agent identity or MQTT topic identity. Applying a saved
+profile is explicit, verifies DNS and TCP reachability, and rolls back the affected
+configuration when verification fails. MQTT without TLS cannot be configured for a
+public endpoint or wildcard listener.
+
 ## Why these components
 
 - **Telegraf** is the universal host agent. It already supports Windows and Linux host
@@ -196,7 +210,12 @@ subscribe to `mission-core/v1/contours/+/agents/+/+`.
 - Mission Core code stays responsible for product semantics and stable API contracts,
   not OS-specific metric collection.
 - Host, container, network and inference telemetry is stored in the normalized path.
-- Per-stage LAB processing telemetry has a native producer contract and an admitted
-  already-connected MQTT sink. It remains unavailable for a durable worker run until
-  that worker actually injects the sink and publishes the `pipeline` topic; consumers
-  must not infer stages from aggregate hardware load.
+- Per-stage processing telemetry derives from the actual durable-worker spans. It
+  emits explicit run start/terminal outcomes and one bounded start/aggregate-terminal
+  pair per stage and run, with exact run, source, package, method, activation count and
+  first/last frame identity. The inference container appends canonical documents to
+  its existing D:-backed publish mount. The host Telegraf service tails that journal
+  with a saved offset and publishes it through its existing authenticated QoS 1 output.
+- Broker credentials remain outside the perception container. Journal write failures
+  are observable but fail open for inference; consumers must not infer stages from
+  aggregate hardware load or from the periodic snapshot alone.