feat(plugins): isolate device integrations

docs/07_MISSION_CORE_MONOREPO.md

@@ -9,14 +9,15 @@ already exist. The accepted device-lifecycle decision is recorded in
 
 | Path | Current responsibility | Target responsibility |
 | --- | --- | --- |
-| `apps/control-station/` | React shell, device workflow, spatial scene | Vendor-neutral operator application |
+| `apps/control-station/` | React shell, model catalog, plugin host slots, spatial scene | Vendor-neutral operator application |
+| `apps/control-station/src/core/device-plugins/frontendSdk.ts` | Public React host surface for reviewed frontend contributions | Versioned frontend Plugin SDK package surface |
 | `packages/plugin-sdk/` | Installable v0alpha2 Pydantic contracts and JSON Schema export | Portable host/plugin identity, lifecycle, stream and evidence boundary |
-| `plugins/xgrids-k1/` | v1alpha2 manifest, exact compatibility profile, fail-closed loader and extraction documentation | Independently versioned XGRIDS device plugin |
-| `src/k1link/web/` | Local FastAPI host, in-memory operation/acquisition lifecycle and transitional XGRIDS facade | Generic host APIs plus isolated plugin supervisor |
-| `src/k1link/mqtt/` | Raw-first K1 MQTT capture | Plugin-owned transport behind an EvidenceStore |
-| `src/k1link/protocol/` | Firmware-scoped K1 codecs and explicit vendor normalizer | Plugin-owned protocol adapter |
+| `plugins/xgrids-k1/` | v1alpha2 manifest, exact profile/loader and plugin-owned React connection/acquisition UI | Independently versioned XGRIDS device plugin |
+| `plugins/xgrids-k1/frontend/` | XGRIDS provisioning, acquisition/replay, diagnostics, metrics, runtime mapping and scoped CSS | Plugin-owned reviewed frontend contribution |
+| `src/k1link/web/` | Local FastAPI host, plugin composition, in-memory operation/acquisition lifecycle and generic session API | Generic host APIs plus isolated plugin supervisor |
+| `src/k1link/device_plugins/xgrids_k1/` | Physically isolated K1 BLE/MQTT/protobuf/LZ4/camera/replay/CLI compatibility implementation | Independently built XGRIDS device plugin process |
 | `src/k1link/data_plane/` | Transport-neutral decoded in-process consumer views | Local projections hydrated from portable SDK envelopes |
-| `src/k1link/viewer/` | Rerun consumer, visualization runtime and legacy Foxglove regression module | Replaceable canonical scene sink and presentation adapters |
+| `src/k1link/viewer/` | Vendor-neutral Rerun consumer, metrics and recorded blueprint | Replaceable canonical scene sink and presentation adapters |
 | `src/k1link/sessions/` | Host-owned SQLite catalog, evidence discovery/recovery, background preparation and derived-cache lifecycle | Device-neutral observation archive service |
 | `src/k1link/web/session_api.py` | Opaque saved-session, immutable RRD/media and workspace-layout API | Versioned Control/Edge observation contract |
 | `apps/control-station/src/core/observation/` | Session selection, replay admission, recorded-source and layout state | Device-neutral observation UI runtime |
@@ -41,7 +42,7 @@ The host-owned recorded path is separate from the disposable live preview:
 ```text
 sealed or recovered native observation session
   -> SQLite catalog and bounded single-worker preparation
-  -> atomic RRD cache v6 + immutable recorded-media manifest v2
+  -> atomic RRD cache v7 + immutable recorded-media manifest v2
   -> generation-bound same-origin HTTP
   -> aggregate RRD/camera admission
   -> native Rerun HTTP receiver + recorded fMP4 player
@@ -56,8 +57,17 @@ The Plugin SDK v0alpha2 separately defines model/device/session identity,
 operation events, acquisition-related session state, canonical stream
 envelopes, payload handles, evidence lineage and compatibility assessments. It
 is importable through the root editable path dependency and independently
-buildable from `packages/plugin-sdk`. The hot K1 path does not yet instantiate
-all SDK envelopes or use the SDK `EvidenceStore` protocol.
+buildable from `packages/plugin-sdk`. Backend actions now instantiate immutable
+SDK `RuntimeActionInvocation` and `RuntimeActionResult` envelopes in the real
+dispatcher path. The live spatial path does not yet instantiate portable SDK
+stream envelopes or use the SDK `EvidenceStore` protocol.
+
+Frontend device workflows follow the same ownership rule. The generic host
+selects a manifest model and mounts its `device.connection` component. Concrete
+XGRIDS source lives under `plugins/xgrids-k1/frontend`, imports the host only via
+`@mission-core/plugin-sdk`, and is connected by the single reviewed import in
+`apps/control-station/src/composition/devicePlugins.ts`. BLE/Wi-Fi provisioning,
+exact-profile confirmation and acquisition/replay UI are not Core components.
 
 ## Experimental vocabulary, not Platform Ontology
 
@@ -138,17 +148,16 @@ for the measured gate and remaining limits.
 
 ## Remaining extraction order
 
-1. Preserve native replay parity and repeat the exact-profile physical
-   point/pose regression through the explicit normalizer boundary.
-2. Map portable SDK stream/evidence contracts onto the hot path without
-   replacing raw evidence or changing consumer output.
-3. Extract codecs, normalizer and raw capture physically behind the XGRIDS
-   plugin package boundary.
-4. Add process isolation and a durable operation/evidence supervisor.
-5. Replace compatibility routes and singleton state with multi-device session
+Native replay parity, exact-profile physical point/pose regression, immutable
+SDK runtime-action envelopes and physical extraction of K1 transports/codecs are
+complete. Portable SDK stream/evidence envelopes remain separate from the
+allocation-conscious in-process preview views.
+
+1. Add process isolation and a durable operation/evidence supervisor.
+2. Replace compatibility routes and singleton state with multi-device session
    routing.
-6. Split Edge execution from the Control Station behind authenticated transport.
-7. Physically accept a newly archived left/right K1 session, then package the
+3. Split Edge execution from the Control Station behind authenticated transport.
+4. Physically accept a newly archived left/right K1 session, then package the
    read-only RTSP/H.264 adapter for each target OS, add disk-backed sealed media
    caching and evolve same-host MSE delivery toward an authenticated Edge media
    plane; keep the modeling-command publisher disabled until its separate safety