docs(perception): record stage-two scheduler and cell freshness proof

docs/adr/0049-stream-first-perception-profiles.md

@@ -147,12 +147,39 @@ must reassess at later use. Missing/stale output remains inspectable but cannot
 retain permissive advisory policy. This envelope is NOT a replacement for
 StreamStart identities, complete input lineage or controller lease fencing.
 
-The current pilot propagates the oldest last-seen permissive TGS cell into the
-costmap/policy age. Expiry currently suppresses the entire scene's permissions;
-stage 2 must implement explicit per-cell expiration without granting authority
-from retained occupied/unknown history. Existing model/geometry/motion/TGS/material
-outputs remain identical to the pinned reference on the measured 128-frame window.
-Freshness/completeness is not semantic correctness or physical safety.
+The stage-1 pilot propagated the oldest last-seen permissive TGS cell into the
+costmap/policy age and suppressed the entire scene on expiry. Stage-2 increment
+`1f8101e` adds `missioncore.costmap-cell-freshness/v1`: bounded (8192 cells),
+index-aligned original support timestamps, decimal int64 strings/null, included
+in the costmap payload digest together with the guard mode. Unobserved support
+is never assigned a timestamp. The pilot now defaults to `per-cell`; the old
+`whole-scene` mode remains an explicit comparison control, not a product cutover.
+
+Both publication and receipt remove permission from expired ground cells and
+mark them rejected/NO_GO. Occupied cells retain prohibition. The remaining
+permissions propagate their original support age AND the mandatory segmentation,
+geometry and motion dependencies. A missing/stale mandatory layer still blocks
+the whole policy. A derived consumer view has new costmap/policy hashes while
+preserving source identity/timestamps; the original published bytes stay immutable.
+Reassessment cannot restore a suppressed action or move the observer clock back.
+The enclosing StreamStart must bind the grid/profile/epoch/clock; this descriptor
+alone does not establish those identities or authenticate a remote producer.
+
+In the measured 128-frame window, raw model/geometry/motion/TGS/material outputs
+remain identical to pinned PyTorch. Effective costmap states and permissions
+change deliberately on expiry. A fresh six-layer envelope can still contain
+rejected/unknown cells; it is not a claim of full free-space coverage, semantic
+correctness, vehicle clearance or physical safety. Recheck again at actual use.
+
+`bcacb02` promotes the proven mailbox and serial GPU stage to common perception
+modules, with the pilot importing compatibility aliases rather than owning
+another scheduler. Pending ingress + completed GPU outputs share two slots;
+active inputs share 16 MiB and are released by their owning stage. Cancellation
+discards pending work, a timed-out callback retains ownership, and CPU-owned
+input is not freed by GPU shutdown. Diagnostic drop history is capped at 256
+entries with exact per-reason totals; it is not the durable terminal ledger.
+These primitives are NOT the controller supervisor, a cross-process GPU lease,
+StreamStart fencing or the binary data plane. Those stage-2 boundaries remain open.
 
 `worker_operating_envelope.py` checks a trusted post-warmup snapshot against
 preregistered hardware/driver/resource/clock conditions and StreamStart identities,