feat(perception): audit E36 second-source eligibility

docs/13_LIDAR_WORKER_PRODUCT_AND_ROADMAP.md

@@ -643,6 +643,14 @@ with a complete `missioncore.laboratory-method/v1` manifest.
 | **E35 — deterministic degradation and recovery** | Does the accepted pipeline fail safely when one source degrades? | Derive immutable replay variants for camera loss, LiDAR loss, pose staleness, delayed frames, bounded drops and timing offset. Preserve the original source and record every injected transformation. Measure status transitions, recovery time, queue accounting and false confidence. | Pass only if missing evidence becomes camera-only, geometry-only, stale or unknown; never guessed class, false free space or hidden success. |
 | **E36 — second-source transfer gate** | Does the result survive another real capture rather than only RAVNOVES00? | First audit the source catalog for a second recording with the required camera, LiDAR, pose, time and calibration identities. Run the accepted E32–E35 profile unchanged when such evidence exists. Public GOOSE/RELLIS data may qualify an algorithm but cannot substitute for this K1 transfer gate. | Compare the frozen profile without retuning. If no eligible source exists, keep the gate blocked only in the roadmap/Ops plan: do not publish an empty LAB page, fabricate a result or collect new data by default. |
 
+The E36 catalog-admission audit is complete in immutable result
+`e36-source-catalog-audit-c5a7b259f043c0a4f3be38f869af1e675dfaa43743e45fd4f43fac166d07f849`.
+TEST007 passes the camera, LiDAR, pose, host-time, device-identity and minimum
+camera-window checks, but lacks calibration and physical-mount identities bound
+to its source session. The transfer replay remains blocked; no LAB E36 page,
+retuning or automatic collection was created. ADR 0029 records the admission
+contract and exact unblocking evidence.
+
 The current E30 AI-assisted engineering generation is
 `e30-engineering-generation-62a4fea10dea9b77f69ceac1af5bf0e4928d9c7716083c22258a03670fe5bd4f`.
 It covers all `486` selected items: `403` confirmed, `81` corrected and `2`

docs/16_ARCHITECTURE_AUDIT_EXECUTION_ROADMAP.md

@@ -209,7 +209,13 @@ Six deterministic variants each replay all 4,489 frames; the result records
 against the `0.25 s` gate. Hidden success, false free-space, unsupported
 semantic/metric claims, timing-mismatch `agree`, late-result return and
 upstream changes are all zero. A0–A8 are closed. A9/E36 is now the critical
-path and requires an eligible second mounted real source.
+path. Its immutable catalog-admission audit
+`e36-source-catalog-audit-c5a7b259f043c0a4f3be38f869af1e675dfaa43743e45fd4f43fac166d07f849`
+checked all 11 physical source rows. TEST007 is a real 206.073-second candidate
+with camera, LiDAR, pose, host time and device identity, but no calibration or
+mount identity is bound to that source session. A9 transfer therefore remains
+blocked without publishing an empty LAB. ADR 0029 defines the exact unblocking
+contract.
 
 - [x] Reproduce all 4,489 immutable E29 frames with the exact frozen profile
   before applying E31/E30 changes.
@@ -223,6 +229,12 @@ path and requires an eligible second mounted real source.
   TrackGeometryFrame reconstruction/validation.
 - [x] Package the exact E32 result, frozen runtime and profile as immutable
   E33 worker input with complete artifact digests.
+- [x] Audit all 11 physical source rows through the frozen E36 eligibility
+  contract without creating an empty LAB.
+- [ ] Bind TEST007 calibration and physical mount identities to its exact
+  source session using primary evidence.
+- [ ] Run and compare the frozen E32–E35 profile on an eligible second source
+  without retuning.
 - [x] Replay all 4,489 frames at recorded `1.0×` pace through independent
   bounded latest-wins work/result queues.
 - [x] Close every frame as delivered, input-superseded or result-superseded

docs/adr/0029-e36-second-source-catalog-admission.md

@@ -0,0 +1,67 @@
+# ADR 0029 — E36 second-source catalog admission
+
+Date: 2026-07-27
+
+Status: accepted; transfer replay blocked by missing source provenance
+
+## Context
+
+E31–E35 are accepted only for the immutable RAVNOVES00 source session. E36 is
+the first transfer gate: the exact accepted profile must run without retuning
+on another real K1 capture. A second recording is not eligible merely because
+it contains a point cloud or can be opened in the viewer. Camera, LiDAR, pose,
+host time, device, calibration and physical mount identities must all be
+bindable to that source.
+
+The local source catalog contains historical recordings, including TEST007.
+Publishing an empty LAB while no source is eligible would confuse a planning
+blocker with an experimental result.
+
+## Decision
+
+1. Source admission is a separate content-addressed audit before any E36 replay.
+2. The admission profile freezes the exact E31–E35 result identities and
+   forbids retuning.
+3. A candidate must be a ready physical K1 source with point cloud, trajectory,
+   video, exact host-time identity and at least 60 seconds of contiguous camera
+   evidence.
+4. Device identity is retained only as irreversible hashes in the redacted
+   inventory.
+5. Calibration and mount evidence must each bind explicitly to the candidate
+   `source_session_id`. A later snapshot from the same scanner and an assumed
+   handheld setup are not substitutes.
+6. Public datasets cannot satisfy this mounted K1 transfer gate.
+7. A blocked audit authorizes neither a new capture nor an E36 LAB
+   publication. Collection remains a separate operator decision.
+8. The audit result has no command, navigation or safety authority.
+
+## Catalog outcome
+
+Immutable audit:
+`e36-source-catalog-audit-c5a7b259f043c0a4f3be38f869af1e675dfaa43743e45fd4f43fac166d07f849`.
+
+Eleven physical source records were audited. TEST007 is the closest candidate:
+it is a ready distinct capture from the same accepted K1, has camera, LiDAR,
+pose and exact host-time evidence, and contains a sealed 2,061-frame camera
+window of approximately 206.073 seconds.
+
+TEST007 is not yet eligible because:
+
+- no calibration identity is bound to the TEST007 source session;
+- no physical mount profile or mount identity is bound to that session.
+
+CAM_REC_TEST also lacks those bindings and its longest contiguous camera window
+is only 22.884 seconds, below the frozen minimum. The remaining sources do not
+contain the required camera modality or accepted physical-source provenance.
+
+## Consequences
+
+- A9 has completed its catalog-admission sub-gate, but E36 transfer remains
+  blocked.
+- The next admissible action is provenance recovery or a new explicit binding
+  artifact for TEST007, based only on primary evidence. It is not threshold
+  tuning and does not rerun E32–E35.
+- If both bindings become available, the same audit can be rerun. Only an
+  eligible result authorizes packaging the frozen E32–E35 transfer replay.
+- Until then, Mission Core publishes no LAB E36 page and claims no
+  generalization beyond RAVNOVES00.