docs(observatory): record saved replay evidence and open visual gates

docs/OBSERVATORY_REALTIME_PROFILES_EXECPLAN.md

@@ -221,17 +221,24 @@ watchdog, stop/slow при пропаже данных, моторы и авто
 - [ ] Этап 2A, остаток — versioned recorded-analysis и устранение полного input barrier.
 - [x] Этап 2B, compute/publish/cache — M4.9 ×004TREE завершён; документ повторно открыт после рестарта.
 - [x] Найденный reindex-дефект exact cache исправлен; исходная связь восстановлена по точному SHA proof.
-- [ ] Этап 2B, visual — синхронное воспроизведение сохранённых camera/TGS, coverage и viewer acceptance.
+- [x] Этап 2B, saved replay — camera/source cloud/TGS в одном native Rerun, выдача с Core после рестарта без compute.
+- [ ] Этап 2B, visual acceptance — сохранение ручного ракурса и подробная визуальная оценка; не подменять работающим проигрывателем.
 - [ ] Этап 2C–2D — LAB V1/вторая запись, cache/recovery/каталог.
 - [ ] Этап 3 — самостоятельный полный профиль и сравнение конфигураций.
 - [ ] Этап 4 — кандидат, затем фактическая бортовая квалификация.
 - [x] 2026-09-03 — план и Desktop-сводка синхронизируются с фактическим исполнением.
 
-**Следующий крупный инкремент — остаток2B:** общий сохранённый camera/TGS-viewer
+**Сделано 2026-09-03:** общий сохранённый camera/TGS-viewer для уже опубликованного
-для уже опубликованного результата job
+job `observatory-run-b230216709dc4c59bc56c98c7e329bf1`, без нового compute.
-`observatory-run-b230216709dc4c59bc56c98c7e329bf1`, без нового compute.
+Evidence: [saved replay](../experiments/perception/OBSERVATORY_SAVED_TGS_REPLAY_2026-09-03.md).
-Result ID и пакет — в связанном progress evidence. Проверять реальную визуальную
+Core хранит/выдаёт 193,622,178-byte replay; Worker не нужен для просмотра.
-синхронизацию/coverage, не только JSON/наличие файлов.
+**Остаток2B:** ручной ракурс сбрасывается при смене portable-слоя из-за upstream
+blueprint clone activation. Не объявлять stable source ID сохранением eye;
+выбирать только поддержанный native-механизм либо отдельно согласованный upgrade,
+не патчить WASM и не создавать второй renderer. Подробная визуальная приёмка открыта.
+Первым действием после нормализации памяти Mac повторить browser first-open для
+последней правки initial cursor +1мкс; до этого не писать PASS начальной сцены.
+Автотесты/build проходят; последняя визуальная проверка остановлена resource gate.
 Отдельно закрыть остаток2A версионированным incremental input;
 не объявлять прежний whole-recording materializer потоковым.
 Не начинать снова с claim/v3, memory repair, селектора или сетевого canary.

experiments/perception/OBSERVATORY_SAVED_TGS_REPLAY_2026-09-03.md

@@ -0,0 +1,138 @@
+# Observatory — saved camera/TGS replay on Core
+
+Date: 2026-09-03. Core packaging: `2797985`; shared viewer: `9db29bc`.
+Stage 2B, saved-data projection increment; full visual
+acceptance remains open. No new Worker computation, model change, acquisition,
+Synology release or onboard/actuation work.
+
+## Source and result
+
+- Session: `20260828T130511Z_viewer_live`, RAVNOVES004TREE.
+- Existing job: `observatory-run-b230216709dc4c59bc56c98c7e329bf1`, generation 1.
+- Result: `m49-tgs-portable-review-a09d2b4a07d103e4f3693ba746a51be2197214768774eabfded4f109ae80dce4`.
+- Package: `52e8afd6aaa38b615008463b873b94feae160946a69ce67aba12efc5f12b1589`.
+- Base RRD: `a65196a55fc1a59d391329777608f512a3930b1287f38971da91b9bf379e1468`.
+- New merged replay: `012e9c2bdc20a06c5e2c748b8e3d149230fd1a3cf13ac15570c39a3555573a87`,
+  **193,622,178 bytes**. Original recording and sealed result are unchanged.
+
+The current profile is CPU TRAVEL TGS, not the planned full
+DDRNet/RF-DETR/distance/motion/policy graph. No historical E47 or LAB overlay is
+substituted for an absent layer.
+
+## Implementation
+
+`portable_tgs_replay.py` verifies artifact digests, source-stage identity,
+frame/source clock equality, shapes, dtypes, state codes and measured z bounds.
+Each map-gravity-local costmap is translated by its exact selected source pose;
+no rotation or estimated pose is introduced. The base RRD remains sole owner
+of points, pose and trajectory. Native Boxes3D carry TGS; missing/unobserved
+cells have no invented physical volume. Per-state clears and an epoch-end clear
+prevent stale obstacles surviving missing evidence or a seek.
+
+`portable_replay.py` packages native AssetVideo/VideoFrameReference and TGS into
+one source-clock RRD through the existing canonical merger. Video uses source
+PTS, H.264, two encoder threads and a separately sealed proxy. Packaging is
+serialized on Core; it has no Worker/model calls. Bounds include 768 MiB camera
+input, 192 MiB video proxy, 1 GiB served RRD and a 3 GiB free-space start gate.
+These are current admission bounds, not support for arbitrary recording sizes.
+
+The same-origin API binds result ID, base generation and replay generation.
+HEAD prepares a missing derivative; GET never prepares or computes. GET requires
+the exact generation and supports Range; stale generations return 412.
+Warm cache admission verifies publication, metadata, size and SHA, memoizing
+the file identity at nanosecond precision in a bounded 32-entry map.
+
+The common `CanonicalResultRerunReplay` is extracted from the existing LAB V1
+viewer. Both thin profile adapters use one unmodified Rerun 0.36.3 viewer,
+one native clock and existing Design Guideline controls. Source points use
+zero accumulation; Local SLAM uses five seconds. No second media/Three.js player
+or profile-specific page pattern is introduced. Existing selector semantics
+remain: calculated current M49 below; uncalculated current LAB V1 in the selector.
+
+## Video timing evidence
+
+The first proxy exposed an encoder time-base defect: passthrough alone rounded
+timestamps to 100 ms and produced **526 duplicate PTS**. It was rejected, not
+admitted by weakening the check. The corrected proxy explicitly uses the demuxer
+time base (`-enc_time_base -1`) together with `-fps_mode passthrough`.
+
+Real source: 6,830 video packets; proxy: **6,748 decoded frames**, zero duplicate
+or backwards PTS, maximum distance to the corresponding source packet PTS
+**222 ns**. The last relative PTS is 717.945 s. This is not a claim that every
+fragment produced a decodable frame. No synthetic fixed-rate renumbering occurs.
+
+TGS has 6,830 anchors × 2,244 cells: 6,811 available LiDAR associations and
+19 missing associations represented as UNOBSERVED. Anchors span
+39.215263458–757.160263458 s; the camera epoch ends at 757.260263458 s.
+The base recording spans 0–808.779495667 s. Outside the epoch the derived camera
+and TGS are cleared; missing evidence does not imply free space.
+
+## Validation and measurements
+
+- **114 backend tests**: portable arrays/integrity/cache/API/video-timebase,
+  shared legacy merger, session API, publication and RRD blueprint tests.
+- **728 frontend tests**, architecture checks, typecheck and production build.
+  Existing Vite chunk-size and TestClient deprecation warnings remain.
+- Ruff on changed replay modules/tests and focused mypy on the three new
+  backend modules pass. `git diff --check` passes.
+- Successful cold packaging HEAD: **116.950 s**; warm first SHA check:
+  **0.292 s**; warm HEAD after canonical restart/reopen: **0.046 s**.
+  Header time is not browser-ready time or inference latency. The browser
+  still loads/decodes a 194 MB RRD; opening is not instantaneous.
+- Exact-generation Range request returns 206 and `RRF2`. Wrong generation,
+  missing preparation and same-size cache corruption have regression tests.
+- Browser: saved M49 opened after canonical restarts, play/pause, forward and
+  backward seek (39 s, 77 s, 406.630 s, end and before coverage), normal/expanded
+  composition, Escape, Source/Local SLAM/TGS, camera modes and 3D/PLAN checked.
+  Unavailable semantic controls stay disabled. Coverage-end camera/TGS clearing
+  is visually confirmed. No Calculate action was used during this increment.
+- Queue readback retains the same current M49 job, created 08:08:03.013Z;
+  no new M49 run was created by opening the viewer.
+- Heavy local operations ran sequentially. Transient memory pressure 2 after
+  full frontend work recovered to 1 before the next heavy stage; no host load
+  test or Docker capacity increase was performed. Only three durable telemetry
+  containers remain; no model container was started by this work.
+
+Private command evidence is in `.runtime/observatory-replay-Vt0m2o/`; raw
+recordings, images, caches and logs stay out of Git.
+
+Ops report **MISSIONCOR-72**, “Observatory — сохранённый M49 replay с Core”,
+issue `4d8079b2-6a3e-4822-9e12-dcd4a4f20017`, was created through direct MCP.
+An earlier transport-failed attempt was followed by a successful empty search
+before creation was retried; no duplicate was found.
+
+## Open visual boundary — do not mark full 2B complete
+
+Rerun 0.36.3 activates a **clone** of the SDK blueprint. Appending to the SDK
+source without activation does not update the visible layer. Reactivation
+updates layers but discards the active clone's manually edited eye. A stable
+source-store ID does **not** prove operator-camera preservation.
+This is confirmed by browser orbit/toggle QA and
+[upstream activation implementation](https://github.com/rerun-io/rerun/blob/0.36.3/crates/viewer/re_viewer_context/src/store_hub.rs#L910).
+
+Portable replay explicitly opts into reactivation. Legacy/Data/live behavior
+is not changed by this opt-in. Distinct native 3D and plan presets fix the
+plan-to-3D return. Initial following-eye activation waits until source-clock
+admission; initial/reset framing remains native, not a fixed world-origin eye.
+QA also isolated initial latest-at boundary admission: at the exact first
+timestamp derived layers were absent, while a small forward seek revealed them.
+The portable initial cursor is placed 1 microsecond inside the first sample;
+logged camera/TGS/source timestamps remain unchanged. This is not a per-frame
+offset or evidence interpolation.
+The final browser recheck of this one-microsecond initial-cursor change is
+pending: after the final successful build macOS memory pressure stayed at 2
+with all temporary test/build/viewer processes already stopped. The local
+resource gate prevents another heavy replay until pressure returns to normal.
+**Changing a portable layer still resets a manually changed
+viewpoint to the preset.** Preserving that eye needs a supported native mechanism
+or an explicitly reviewed dependency decision. No WASM patch/private API/fork,
+DOM emulation of viewer controls or second camera engine is added.
+
+Other remaining gates: detailed visual quality/coverage acceptance, versioned
+incremental recorded-analysis input (2A), LAB V1 and second source (2C), bounded
+disk eviction/recovery/catalog at scale (2D). The new derivative cache currently
+has per-artifact bounds/free-space admission but no total LRU quota or health
+aggregation. Packaging is still lazy on first open, not publication-time.
+The old LAB V1 camera-proxy timing path is not repaired by this new adapter.
+Replay success is neither realtime full-graph qualification nor traversability,
+navigation, motor or safety authority.