docs(simulation): accept S1C live worker

docs/01_IMPLEMENTATION_PLAN.md

@@ -24,7 +24,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
 | K1 application control | GO (physical staged cycle) — after fixing the PCAP-proven `sint64` time field, one explicit UI launch completed all 14 canonical operations on one control session, reached live `SCANNING + project + init_ready`, displayed real points, then one explicit STOP returned K1 to unbound `READY`. No retry or fallback command was sent. Native-project reuse through LixelGO/USB remains an independent verification |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
-| Simulation Polygon | SIM S0 GO; S1A complete; S1B real-provider lifecycle PASS; UI-0 internal read-only run view PASS — exact commit `6cb1495` passed 25 target tests and one D-only loopback stock-Ackermann run. Mission Core admitted world/startup/DDS health, persisted eight events, sent zero commands and stopped both PGIDs with zero residue. The Control Station now reads that canonical journal through GET-only Polygon API routes and a direct hidden workspace; visual QA opened the real accepted run. Pause/resume/step/reset, PX4 command delivery, canonical telemetry/frames, watchdog/failsafe, navigation/safety acceptance and real actuator authority remain absent; top-level Polygon remains gated |
+| Simulation Polygon | SIM S0 GO; S1A complete; S1B lifecycle PASS; S1C registered live worker/UI PASS — exact commit `b7ccca3` passed 21 focused target tests and a UI-driven D-only PX4/Gazebo run. Mission Core registered the loopback-only unprivileged worker through a private Unix socket, rendered diagnostic ENU `VehicleState`, persisted eight events and stopped both provider groups with zero residue. The run sent zero commands; PX4 command delivery/motion, canonical PX4/ROS 2 telemetry, pause/step/reset, watchdog/failsafe, navigation/safety acceptance, auth/RBAC and real actuator authority remain absent; top-level Polygon remains gated |
 
 USB project copying remains optional ground truth rather than a blocker for the
 now-verified network path. Owner-operated LixelGO traffic verifies the MQTT
@@ -160,9 +160,15 @@ exact-profile/D-only worker guard, health-gated real provider specs and
 deterministic POSIX PGID supervision. Exact generation `6cb1495` passed on
 `MissionCore-Sim`: Micro XRCE-DDS Agent and PX4/Gazebo stock rover ran inside a
 fresh loopback-only namespace, the run reached `completed`, and both provider
-groups stopped without residue. Live world control, PX4 command delivery,
-heartbeat/watchdog execution and captured failsafe outcomes remain the next S1
-increments.
+groups stopped without residue. S1C commit `b7ccca3` adds a persistent
+unprivileged worker agent in the same isolation boundary, a bounded Unix-socket
+gateway, an explicit `internal-virtual-only` backend gate and a browser-native
+live panel. The exact D-only generation passed 21 target tests and one
+UI-driven provider run with diagnostic Gazebo `VehicleState`, eight persisted
+lifecycle events, terminal `completed` and zero process residue. Its
+zero-command stationary rover does not close PX4 command delivery, canonical
+PX4/ROS 2 telemetry, pause/step/reset, heartbeat/watchdog or failsafe checkers;
+these remain the next S1 increments.
 
 UI-0 now consumes the same append-only run repository through
 `GET /api/v1/polygon/runs` and
@@ -172,10 +178,12 @@ write transition. The Control Station opens the internal
 `polygon-run-internal` workspace only for the direct
 `?workspace=polygon-run[&run=<id>]` route; it is filtered out of System
 navigation and adds no seventh top-level section. Browser QA loaded the accepted
-real run with eight events, four provider pins, zero commands and the unchanged
-virtual-only authority boundary. A shared operator-facing deployment still
-requires a reviewed read-only D mount/source configuration; UI-0 does not use
-SSH as a product data plane.
+archive and the S1C live worker. The hidden UI-1 panel shows
+worker/run/provider status, sim time, ENU/FLU pose and a bounded 2D trajectory.
+Start/stop stays behind the backend gate and reaches the worker through a local
+Unix socket; SSH remains qualification bootstrap, never the product data plane.
+A shared operator-facing deployment still requires authentication/RBAC,
+service supervision and an accepted routed worker transport.
 
 Mission Core remains a distributed web product. React is served by a long-lived
 Gateway/API and renders canonical state through browser-native components.