fix(polygon): focus runs on operator playback

docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md

@@ -847,7 +847,8 @@ show an explicit offline state.
 
 The Polygon navigation is task-oriented:
 
-- `Прогоны` owns live simulation lifecycle, history and qualification evidence;
+- `Прогоны` owns recorded replay/simulation history and operator review of
+  qualification evidence;
 - `Датасеты` owns admitted replay inputs and the entry point for a future
   qualification run.
 
@@ -857,16 +858,27 @@ remain under Fleet. A dataset preview is not a qualification result; the
 result is a versioned run with pipeline, sensor profile, metrics, provenance
 and decision.
 
+Live simulation is a different operator task. A rover scene, worker health and
+start/control actions must not be mounted above an archived dataset replay.
+They require a separate live surface that appears only when the Simulation
+Worker capability is available. The current `Прогоны` implementation is
+read-only and remains fully usable while that worker is offline.
+
 ### UI-0 — early read-only run view
 
-Target S1B proves persisted start/health/stop history. UI-0 is implemented as a
-direct internal run view and exposes:
+Target S1B proves persisted start/health/stop history. The first direct
+developer-oriented view exposed lifecycle, events, provider pins and artifact
+hashes on the main screen. Operator review rejected that composition. The
+current UI-0 makes the recorded evidence primary:
 
-- run identity, lifecycle and terminal reason;
-- authoritative clock and current pause/running state;
-- provider health/process ownership;
-- qualification events and admitted artifact links;
-- explicit limitations and gate status.
+- full source-order frame index instead of five selected examples;
+- Play/pause, previous/next and arbitrary scrub;
+- direct ground-truth, Current, Patchwork++ and error-map modes;
+- current-frame metrics and a clickable all-frame improvement/regression strip;
+- automatic best/worst ordering without preventing arbitrary manual selection;
+- aggregate comparison after, rather than before, visual evidence;
+- acceptance/degradation and run identity/provider/artifact details collapsed
+  below the operator workflow.
 
 The backend reads the configured repository from
 `MISSIONCORE_POLYGON_RUNS_ROOT` using
@@ -875,12 +887,17 @@ The backend reads the configured repository from
 ```text
 GET /api/v1/polygon/runs
 GET /api/v1/polygon/runs/{run-id}
+GET /api/v1/polygon/runs/{run-id}/qualification
+GET /api/v1/polygon/runs/{run-id}/qualification/review
+GET /api/v1/polygon/runs/{run-id}/qualification/review/frames/{frame-id}
 ```
 
 Missing/malformed configuration returns `503`; invalid or corrupt evidence
-fails closed. Responses never contain the configured root, artifact bytes or
-command payloads. `?workspace=polygon-run[&run=<run-id>]` remains a compatible
-deep-link into the same product workspace.
+fails closed. The review index exposes no paths or digests. A selected frame is
+verified against the content-bound review manifest before its bounded point
+preview is decoded. Responses never contain the configured root, raw dataset
+bytes or command payloads. `?workspace=polygon-run[&run=<run-id>]` remains a
+compatible deep-link into the same product workspace.
 
 UI-0 itself has no PX4 transport or lifecycle/command operations. It remains a
 read-only evidence contract backed by the server-owned run repository and is

docs/14_LIDAR_DATASET_GATEWAY.md

@@ -312,7 +312,7 @@ points (required `>= 7`), natural-ground recall gain is `24.46` points
 (required `>= 90%`), assigned fraction is `100%` (required `>= 99.9%`) and
 p95 latency is `23.40 ms` (required `<= 50 ms`). No frame exceeded the
 catastrophic regression boundary of `-20` Ground-IoU points; the worst observed
-delta was `-13.51` points and remains visible as a bounded failure preview.
+delta was `-13.51` points.
 
 | Deterministic profile | Source coverage | Ground IoU | Natural recall | p95 latency |
 | --- | ---: | ---: | ---: | ---: |
@@ -327,9 +327,28 @@ delta was `-13.51` points and remains visible as a bounded failure preview.
 Every degradation profile stayed inside the predeclared `15`-point Ground-IoU
 loss, `20`-point natural-recall loss and `50 ms` p95 limits. The sealed
 decision is therefore `shadow-candidate`, explicitly
-`promoted_to_navigation_or_safety = false`. The compact `12 MB` run journal,
-report and five worst-frame previews are available in `Polygon -> Runs`; the
-source archive and crash-resume frame cache remain only on worker D.
+`promoted_to_navigation_or_safety = false`.
+
+The first aggregate-only Polygon screen was rejected as an operator product:
+five selected failure previews could not let an operator verify the decision.
+Commit `b037076` adds a separate immutable visual derivative bound to the
+qualification report:
+
+- schema `missioncore.goose-ground-review-pack/v1`;
+- identity
+  `6ddc2de0154196088049b8654d9187fba0c52e28783e5ada6be5266dd16bd641`;
+- all `961/961` validation frames in source order;
+- deterministic `12,000`-point frame previews with remission, public
+  point-aligned ground truth, Current and Patchwork++ masks;
+- compact size `67 MB`, versus multiple gigabytes for equivalent JSON;
+- `Play`, frame scrubber, a clickable all-frame delta strip, best/worst
+  ordering and direct modes for geometry, ground truth, both providers and
+  both error maps.
+
+The source archive and full-resolution crash-resume cache remain only on worker
+D. A bounded review mirror may be served by a Mission Core backend, but SSH is
+not a product data plane. The replay UI does not render the unrelated live
+Ackermann rover and does not depend on Simulation Worker online status.
 
 Primary source evidence: