fix(observatory): fence portable catalog refresh

apps/control-station/test/observatoryLaboratorySetups.test.mjs

@@ -117,11 +117,6 @@ function portableSetup() {
       outcome: "pass",
       compatible: true,
       reason: "Запись соответствует требованиям EoMT + DDRNet.",
-      evidence: {
-        frame_count: 6830,
-        timeline_start_seconds: 0,
-        timeline_end_seconds: 819,
-      },
     },
     executor: {
       contour_id: "worker-006",
@@ -281,6 +276,27 @@ test("portable LAB V1 rejects an unbound existing result projection", async () =
   );
 });
 
+test("portable LAB V1 rejects heavyweight compatibility evidence", async () => {
+  const heavyweight = portableSetup();
+  heavyweight.source_compatibility.evidence = {
+    frame_count: 6830,
+    timeline_start_seconds: 0,
+    timeline_end_seconds: 819,
+  };
+
+  await assert.rejects(
+    fetchObservatoryPortableLaboratorySetups("source-a", {
+      fetcher: async () => new Response(JSON.stringify({
+        schema_version: "missioncore.observatory-portable-setup-catalog/v2",
+        source_session_id: "source-a",
+        setups: [heavyweight],
+        authority,
+      }), { status: 200 }),
+    }),
+    /неизвестные поля/,
+  );
+});
+
 test("Observatory preflight sends the exact selected definition and never submits a run", async () => {
   const selected = (await fetchObservatoryLaboratorySetups("source-a", {
     fetcher: async () => new Response(JSON.stringify({

apps/control-station/test/observatoryWorkspace.test.mjs

@@ -240,8 +240,14 @@ test("Observatory keeps one compact selector axis without the obsolete setup det
     /"preemption-pending": \{[\s\S]*label: "Ждём подтверждения остановки"/,
   );
   assert.doesNotMatch(setupHook, /Promise\.allSettled/);
-  assert.match(setupHook, /publishSetupCatalog\(legacyCatalog/);
+  assert.match(setupHook, /publishSetupCatalog\(\s*legacyCatalog/);
+  assert.match(setupHook, /preserveUnknownSelection: true/);
+  assert.match(setupHook, /selectedSetupId, sourceSessionId/);
   assert.match(workspace, /Worker установлен, запуск закрыт/);
+  assert.match(
+    workspace,
+    /preflightCandidate\.definitionSha256[\s\S]*selectedSetup\?\.runDefinition\?\.definitionSha256/,
+  );
   assert.match(workspace, /succeeded: \{ label: "Вычислено · ждёт публикации"/);
   assert.match(workspace, /failed: \{ label: "Ошибка расчёта"/);
   assert.match(workspace, /"reconciliation-required": \{ label: "Нужна сверка"/);