wip(k1): checkpoint connection recovery rewrite

Capture the current unreleased K1 connection, recovery, lifecycle, viewer, and test work as a single known-bad baseline for subsequent fixes.

apps/control-station/test/rerunViewportAtomicAdmission.test.mjs

@@ -5,7 +5,9 @@ import { after, before, test } from "node:test";
 import { createServer } from "vite";
 
 let server;
+let claimExclusiveLiveViewer;
 let createRecordedOpenWatchdog;
+let createReentrantViewerDisposer;
 let recordedOpenWatchdogTimeoutMs;
 let rerunViewerInitialSource;
 let resolveRecordedViewerSourceUrl;
@@ -17,7 +19,9 @@ before(async () => {
     server: { middlewareMode: true },
   });
   ({
+    claimExclusiveLiveViewer,
     createRecordedOpenWatchdog,
+    createReentrantViewerDisposer,
     recordedOpenWatchdogTimeoutMs,
     rerunViewerInitialSource,
     resolveRecordedViewerSourceUrl,
@@ -118,6 +122,45 @@ test("complete recorded admission clears its watchdog", () => {
   assert.deepEqual(cancelled, [23]);
 });
 
+test("deferred viewer start cannot reopen after stale unmount", async () => {
+  let resolveStart;
+  const start = new Promise((resolve) => {
+    resolveStart = resolve;
+  });
+  let disposed = false;
+  let cleanupCount = 0;
+  let closeCount = 0;
+  let stopCount = 0;
+  const diagnostics = [];
+  const disposeViewer = createReentrantViewerDisposer(
+    () => {
+      cleanupCount += 1;
+    },
+    () => {
+      closeCount += 1;
+      stopCount += 1;
+    },
+  );
+  const pendingMount = (async () => {
+    await start;
+    if (disposed) {
+      disposeViewer();
+      return;
+    }
+    diagnostics.push("admitted");
+  })();
+
+  disposed = true;
+  disposeViewer();
+  resolveStart();
+  await pendingMount;
+
+  assert.equal(cleanupCount, 1);
+  assert.equal(closeCount, 2);
+  assert.equal(stopCount, 2);
+  assert.deepEqual(diagnostics, []);
+});
+
 test("recorded RRD bytes are never split across LogChannel.send_rrd calls", async () => {
   const source = await readFile(
     new URL("../src/components/RerunViewport.tsx", import.meta.url),
@@ -129,7 +172,7 @@ test("recorded RRD bytes are never split across LogChannel.send_rrd calls", asyn
   assert.match(source, /viewer\.start\(\s*rerunViewerInitialSource\(resolvedSource\)/s);
   assert.match(
     source,
-    /recordingOpened = true;[\s\S]*clearLiveRecordingOpenTimer\(\);[\s\S]*clearLiveRecordingDiscoveryTimer\(\);/,
+    /recordingOpened = true;[\s\S]*diagnosticLifecycle\.markAdmitted\(\);/,
   );
   assert.match(
     source,
@@ -145,12 +188,31 @@ test("recorded RRD bytes are never split across LogChannel.send_rrd calls", asyn
   );
 });
 
+test("one live document owns one native Rerun receiver", async () => {
+  const releases = [];
+  const releaseFirstClaim = claimExclusiveLiveViewer(() => releases.push("first"));
+  const releaseSecondClaim = claimExclusiveLiveViewer(() => releases.push("second"));
+
+  assert.deepEqual(releases, ["first"]);
+  releaseFirstClaim();
+  assert.deepEqual(releases, ["first"]);
+  releaseSecondClaim();
+
+  const releaseThirdClaim = claimExclusiveLiveViewer(() => releases.push("third"));
+  assert.deepEqual(releases, ["first"]);
+  releaseThirdClaim();
+});
+
 test("raw replay exercises the same streaming receiver lifecycle as a live scan", async () => {
   const source = await readFile(
     new URL("../src/workspaces/Workspaces.tsx", import.meta.url),
     "utf8",
   );
   assert.match(source, /followLive=\{!recordedReplay && streamActive\}/);
+  assert.match(
+    source,
+    /sourceUrl\.trim\(\) && pointCloudVisible && !intentionalSourceEnd/,
+  );
 });
 
 test("the complete vendor canvas host is hidden during partial and failed admission", async () => {