fix(k1): gate control dialogue on live state

docs/01_IMPLEMENTATION_PLAN.md

@@ -21,7 +21,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Stage 7 observation archive | GO (point/pose/telemetry contract) — durable catalog, recovery, capture-clock-bounded RRD preparation, archived metric time series, saved-session timeline and atomic playback are implemented |
 | Stage 7 recorded cameras | GO (contract), acceptance pending — acquisition-owned fMP4 archive and player are implemented/tested; one real archived K1 camera plus point-cloud session has not passed playback yet |
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
-| K1 application control | PAUSE (first physical bootstrap failed closed before START) — plugin v0.4.0 runtime remains dormant/write-disabled; the uninstalled acceptance transport completed one connection, six QoS2 bootstrap publishes and five correlated responses, then rejected one live batch-3 response; K1 remained READY, START was not emitted, retry is forbidden and the temporary Keychain item was deleted |
+| K1 application control | PAUSE (accepted START followed by `ALGORITHM_ERROR`) — first live attempt stopped before START on a batch-3 correlation failure; a second attempt correlated all 10 pre-START requests plus START but collapsed UI stages into 365 ms and omitted the retained post-START/control-session lifecycle. The collapsed path and standalone START/STOP are disabled. An uninstalled offline executor now uses explicit UI checkpoints plus live DeviceStatus gates; no further physical write is authorized yet |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
 
 USB project copying remains optional ground truth rather than a blocker for the
@@ -61,7 +61,26 @@ required responses through batch 3, but the orchestrator raised
 `ApplicationBootstrapError` while correlating that batch. No START was emitted;
 live DeviceStatus stayed READY and the local point/pose counts remained zero.
 The local capture was sealed and the temporary Keychain item was deleted.
-Physical START/STOP therefore remain untested; the button is the safe fallback.
+The second physical attempt then correlated all ten bootstrap requests and one
+START success response. It nevertheless did not reproduce the full LixelGO
+lifecycle: all eleven publishes completed in 365 ms, the process did not retain
+the control session through initialization, and it omitted the immediate and
+post-initialization status reads present in both retained LixelGO START captures.
+K1 reported `SCAN_STARTING` for about 24 seconds, emitted system error
+`0x32040133` twice (the recovered `ALGORITHM_ERROR` namespace/value), returned
+to `OTHER_STATUS`, produced zero point/pose frames and showed steady red. The
+operator restored steady green through a normal power cycle. The legacy
+`run_bootstrap()` path now rejects before emission. The offline acceptance path
+maps requests 1–6 to connection, request 7 to explicit scan-workspace entry,
+requests 8–10 to explicit project-prompt opening and request 11 to the operator's
+START confirmation. Captured human delays are not replayed or treated as minimum
+timeouts. After the immediate operation-12 read, operations 13–14 wait for the
+same bound K1 to report `SCANNING`, a bound project and `init_ready=true`.
+The same transport is then serviced until an explicit STOP request; post-STOP
+ownership waits for live `READY` plus physical standby confirmation. System-error
+and status reports are decoded into redacted safety state. This path is not
+wired into the plugin runtime/UI and has only synthetic regression coverage;
+physical STOP/save remains untested and the button is the safe fallback.
 
 The Stage 6 live path uses a bounded raw-first bridge: loss in the visualization
 queue cannot discard MQTT evidence. The queue holds four preview messages;
@@ -280,8 +299,9 @@ useful stream is decoded or structurally identified.
 - firmware or internal-Linux analysis;
 - physical end-to-end shared-timeline playback for a newly archived session
   containing point cloud plus one selected K1 camera;
-- OS-independent plugin/edge authority provider, redacted live-response
-  diagnostics for bootstrap batch 3, a newly permitted operator-present full
-  START/STOP attempt and stable-artifact proof after STOP;
+- OS-independent plugin/edge authority provider, PCAP-to-executor transcript
+  regression, runtime ownership integration, a separately reviewed and newly
+  permitted operator-present START/STOP attempt, and stable-artifact proof after
+  STOP;
 - long-running large-session WebViewer/WASM memory telemetry;
 - production retention, replication, encryption and cross-platform packaging.