docs(node): reconcile release status and build provenance for 0.6.11

apps/node-agent/README.md

@@ -1,4 +1,36 @@
-# Mission Core Node — system configuration candidate
+# Mission Core Node — onboard configuration and sensors
+
+## Current candidate: 0.6.11
+
+The installed candidate on the qualification Mini is 0.6.11. It contains the
+native GTK/WebKit application, seven-step environment configuration, host and
+USB/network inventory, trusted SSH key management, Tailscale access, explicit
+Node/Core pairing, and the first RealSense D455 sensor workflow. Supported host:
+Ubuntu 24.04 LTS Desktop amd64. This is an early candidate, not a completed or
+fully hardware-qualified Node v1.
+
+The shared Node/Core sensor UI supports preparation, naming, profiles/options,
+live RGB/depth/IR/points/motion, and capture/recording commands owned by the
+board. After initial preparation, the device row keeps one connectivity lamp,
+settings and viewer actions; driver redeployment moves into device settings.
+USB events update inventory while persistent identity/name/configuration remain
+available across sessions. A green connection lamp does not assert that frames
+are currently being acquired or that every sensor option has been qualified.
+
+Actual GUI acceptance and its limits are recorded in
+[the sensor architecture report](../../docs/node/05_SENSOR_HOST_AND_SHARED_CONTROL.md).
+Node GUI raw playback has passed. Core replay/API event acceptance still needs
+the separately approved canonical server restart. Resumable raw transfer/import,
+continuous unplug/replug without service restart, different USB ports, native
+WebKit media, recovery/soak and clean-OS qualification remain open. The owner
+powered the Mini off after the session; no later hardware checks are implied.
+
+Installed package: `mission-core-node_0.6.11_amd64.deb`, 94,021,846 bytes;
+SHA-256 `2d593616d64ed9fecb99e5758763ae52610731aaf1467fb23c7d75b19ffef0fa`.
+Its source/provenance base is `404285419f864da7306eef6ee07a2077ad30e674`.
+Subsequent documentation commits do not imply another package installation.
+
+## Bootstrap history: 0.2–0.4
 
 0.4.0 makes «Настройка окружения» the first system view. A fixed privileged
 helper starts a durable, versioned systemd workflow for packages, the board
@@ -52,9 +84,9 @@ keys for local Ubuntu administrators. The agent and desktop window run
 unprivileged; fixed polkit helpers admit only local login and the shipped system/network actions. SSH configuration is
 owned by the versioned environment workflow, with conflict detection and cleanup on removal.
 
-Core pairing/mTLS, sensor plugins, capture, media and
+In 0.2.0, Core pairing/mTLS, sensor plugins, capture, media and recovery were
-recovery are subsequent vertical increments, not implemented capabilities of
+subsequent vertical increments. See the current candidate section above for
-this package. This is not a completed Node v1 or a hardware-qualified release.
+their present implementation and acceptance boundaries.
 
 ## Operator workflow
 
@@ -94,7 +126,8 @@ stopped, starting, unavailable and connected states. Installation and connection
 use two fixed root-owned polkit helpers from the desktop window. The web API
 can only read a reduced local status; it cannot run commands or change network
 settings. The generic Node identity and capture lifecycle do not depend on
-Tailscale. Pairing to Mission Core is still a separate, unimplemented operation.
+Tailscale. Pairing to Mission Core is a separate explicit UI operation; see
+[the pairing protocol](../../docs/node/04_NODE_CORE_PAIRING_PROTOCOL.md).
 
 On a new machine, the helper downloads the official amd64 `.deb` pinned in
 `packaging/tailscale-release.json`, verifies SHA-256 before invoking APT, installs
@@ -138,7 +171,8 @@ but leaves the SSH server and persistent Node state available for reinstall.
 
 Install UI dependencies with `npm ci --ignore-scripts` in `ui/`. The build
 requires the sibling Design Guideline repository used by the monorepo, at
-`8a79dfe84d895c9f1d42b8d285bc6670114f939f`. In that checkout, run
+`999864e5b0a81555823cfa1ea6e8cf8a417c37f1` (the exact `DG_COMMIT` in
+`packaging/build.py`, not necessarily the latest documentation commit). In that checkout, run
 `npm ci --ignore-scripts` and `npm run build:packages` before building Node.
 Its dependencies are bundled into the binary; the board never references that
 sibling path. The pinned commit includes ResourceRow and the shared shell fixes;
@@ -180,6 +214,9 @@ path, URL or environment is executed with elevated privileges. One-use login
 tokens expire after one minute, authenticated cookies after eight hours, and
 all sessions expire on service restart. Identity corruption fails closed.
 
-Raw device serials and MAC addresses are not collected. The report omits node
+The D455 worker reads USB/SDK serials internally to match one physical device;
-ID, hostname and network addresses; credentials and private keys never enter
+the shared sensor API uses a derived stable device ID. Treat identifiers, host
-the public status or report. Real evidence and credentials stay outside Git.
+inventory and captured data as private operational evidence. Credentials,
+private keys, real recordings, exported host reports and runtime state stay
+outside normal Git. See the architecture reports for the exact API/report
+boundaries rather than treating source-test fixtures as live evidence.