docs(adr): clarify MAT privacy and companion state lifetimes

docs/adr/ADR-001-wifi-mat-disaster-detection.md

@@ -165,6 +165,29 @@ The module integrates with existing crates through adapters:
 | False positives from animals | Size/pattern classification |
 | Power constraints in field | Low-power modes, solar charging |
 
+## Hosted API and privacy boundary amendment (2026-10-22)
+
+PR #2249 composes the MAT API into the sensing-server host with one in-memory
+MAT `AppState`. It remains inside host validation and authentication; optional
+ML unavailability and empty incident state must be reported explicitly. This
+composition does not implement a durable incident database or establish the
+physical performance targets above.
+
+The host's `--privacy-mode` applies to MAT REST output and WebSocket broadcasts.
+HTTP response middleware cannot inspect messages after an upgrade, so the host
+installs the same recursive serialized-output filter in the MAT stream path.
+Besides structured vital signs, this removes generated alert prose and domain
+event Debug details that can contain literal heart/breathing rates. Permitted
+status, identity and coarse metadata remain; ordinary error messages and
+privacy-off serialization retain their existing behavior. Standalone MAT hosts
+must install their own output policy; the extension hook alone is not a privacy
+guarantee.
+
+Authenticated nonempty REST and real-socket stream regressions cover the output
+boundary in both privacy modes. They use synthetic incidents and do not qualify
+survivor detection, clinical accuracy, phone transport, or restart persistence.
+Native companion stream support remains governed by ADR-419's allowlist.
+
 ## References
 
 - [WiFi-based Vital Signs Monitoring](https://dl.acm.org/doi/10.1145/3130944)

docs/adr/ADR-355-local-empty-room-bootstrap-prior.md

@@ -140,6 +140,19 @@ This is measured negative evidence for one installation. No occupied positive
 holdout was recorded, so it does not prove person recall, person counting, or
 cross home accuracy improvement.
 
+## Full room receipt versus restart prior (2026-10-22)
+
+An explicit room calibration can name multiple contributing radios, but this
+persisted field model remains bound to exactly one model-writing radio and its
+CSI grid. On helper restart, the full explicit session, room binding and receipt
+are not restored. Client history cannot recreate that live server authority.
+
+Verify all three radios' fresh reception independently of the restored prior's
+single source. A one-radio `bootstrap_only` source set is neither proof that
+other radios stopped receiving nor proof of a restored three-radio calibration.
+Original expiry and negative-only authority remain unchanged. Retaining a room
+or scan on an app is a separate lifecycle from restarting its paired helper.
+
 ## Acceptance test
 
 With a physically empty room, complete calibration on stable nodes, promote

docs/adr/ADR-419-secure-local-companion-pairing.md

@@ -116,3 +116,24 @@ The consumer independently opts in to foreground sharing and renders remote
 geometry separately from local sensing/calibration authority. Software protocol,
 real socket and owner/companion middleware checks do not establish physical
 phone-to-Mac capture accuracy or calibration acceptance.
+
+## Retained replica boundaries (2026-10-22)
+
+The helper's durable `companion-room.json` is one canonical geometry envelope,
+not a replica of either app's scan, models or local evidence history. The app
+containers own those records separately; Cognitum sign-in and local pairing do
+not synchronize them. Expiry or revocation withdraws transport access and does
+not establish deletion of already retained client data.
+
+Every accepted room PUT increments the server revision. A client may avoid an
+unnecessary new binding by validating and reusing the exact unchanged published
+configuration instead of issuing another PUT. Importing that identical envelope
+must preserve legitimate local evidence; a deliberate changed binding withdraws
+current authority while local records remain historical. The client retention
+repair is proposed in ruview-mobile ADR-047; it is not present in TestFlight
+build 2026102213 and requires a subsequent delivered-build restart check.
+
+The sensor preview remains transient and currently carries no room-binding
+digest. A displayed phone mesh is not a saved canonical room, durable draft,
+live AR alignment or RF calibration receipt. MAT HTTP composition likewise does
+not expand native companion WebSocket paths; see ADR-001's privacy amendment.

docs/adr/README.md

@@ -135,6 +135,7 @@ Statuses: **Proposed** (under discussion), **Accepted** (approved and/or impleme
 | [ADR-346](ADR-346-fail-closed-edge-occupancy-evidence.md) | Fail closed ESP32 occupancy evidence | Accepted (C6 occupancy integrity qualified) |
 | [ADR-347](ADR-347-rate-aware-esp32-temporal-sensing.md) | Rate aware ESP32 temporal sensing | Accepted (C6 timing and transport qualified) |
 | [ADR-363](ADR-363-native-macos-usb-node-onboarding.md) | Native macOS USB node onboarding with nonce bound discovery and fresh server verification | Accepted and physically qualified on one ESP32 S3; C6 and signed distribution pending |
+| [ADR-419](ADR-419-secure-local-companion-pairing.md) | Secure local Mac–iPhone pairing, canonical room publication and transient sensor preview | Accepted decision; software verified, physical qualification pending |
 | [ADR-115](ADR-115-home-assistant-integration.md) | Home Assistant integration via MQTT auto-discovery + Matter bridge (HA-DISCO + HA-FABRIC + HA-MIND) | Accepted (MQTT track) / Proposed (Matter SDK P8b) |
 | [ADR-169](ADR-169-adam-mode-light-theme.md) | adam-mode — light theme toggle for the three.js realtime demo | Proposed |
 | [ADR-170](ADR-170-yoga-mode-pose-system.md) | yoga-mode — yoga pose detection, classification, and scoring for the three.js realtime demo | Proposed |