docs(perception): record Worker observability repair and remaining stream gates

deploy/telemetry-plane/README.md

@@ -20,10 +20,23 @@ The normalizer exposes a read-only normalized telemetry adapter on
 Timescale credentials, and Timescale is not published on a host port.
 The normalizer uses a separate `missioncore_normalizer` database role with only
 `SELECT`, `INSERT`, `UPDATE`, and bounded retention `DELETE` on the telemetry
-hypertable. Raw telemetry older than 30 days is removed at most once per day by the
-normalizer. This stays compatible with the Apache-licensed Timescale image without
+hypertable. Raw telemetry older than 30 days is removed in batches of at most
+1000 rows per minute, on a separate connection/thread (2s statement / 250ms lock
+deadline). Retention never runs inside the MQTT callback. This stays compatible
+with the Apache-licensed Timescale image without
 depending on the Timescale License retention scheduler.
 
+The 1 GiB database container explicitly sets 128 MiB shared buffers and 64 MiB
+maintenance memory. The HA image's automatic tuning sees the Docker VM instead
+of this container limit; do not inherit its multi-GiB defaults.
+
+For a memory-constrained local repair, `compose.source.yaml` mounts the reviewed
+normalizer source read-only into the **existing** image. Set
+`MISSIONCORE_NORMALIZER_SOURCE` to the absolute `normalizer.py` path, pass both
+Compose files and the existing private `--env-file` / `--project-directory`, and
+use `up -d --no-deps --no-build normalizer`. This is an explicit local source
+override, not a rebuilt portable image. Normal restart/reboot retains the mount.
+
 The stack is one deployment contour, not one multi-process container. Keeping broker,
 normalizer and database in separate containers preserves independent health checks,
 least-privilege boundaries and rollback while Compose provides one operator lifecycle:
@@ -136,6 +149,24 @@ globally unique because Mosquitto ACL ownership is username-based.
 
 ## Worker agent
 
+MQTT outputs use `startup_error_behavior="retry"`, with a 2000-metric buffer and
+the configured flush interval. A missing broker at agent startup must not end
+the service. See [Telegraf's startup policy](https://docs.influxdata.com/telegraf/v1/configuration/plugin-options/).
+If Docker lost a published listener while the saved LAN address is unchanged,
+the explicit broker Apply action reconciles that listener; a telemetry GET never
+restarts infrastructure. Node connectivity does not prove a profile is ready.
+
+The streaming profile can export one bounded (8 KiB) current observation using
+`--telemetry-snapshot /telemetry/current.json`, with `/telemetry` mounted to
+`C:\ProgramData\NDC\MissionCore\telemetry-agent\perception` on Worker. The existing
+collector reads it with a 5s freshness limit and forwards it over the same MQTT
+pipeline topic. It overrides the legacy service only when explicitly present;
+an expired/broken file reports unavailable rather than relabeling a legacy model.
+The publisher runs independently from heartbeat/inference and never renews a
+lease, grants GPU ownership, or qualifies real-time. Queue memory includes active
+input and decoder scratch. Stage timings are unavailable until actually measured.
+No camera, point cloud, model result, MQTT secret, or motor command goes here.
+
 Worker 006 uses the official Windows Telegraf distribution as the host service
 `NDC Mission Core Telemetry Agent`. Install or update it with: