docs(simulation): accept worker-gated polygon ui

docs/01_IMPLEMENTATION_PLAN.md

@@ -24,7 +24,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
 | K1 application control | GO (physical staged cycle) — after fixing the PCAP-proven `sint64` time field, one explicit UI launch completed all 14 canonical operations on one control session, reached live `SCANNING + project + init_ready`, displayed real points, then one explicit STOP returned K1 to unbound `READY`. No retry or fallback command was sent. Native-project reuse through LixelGO/USB remains an independent verification |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
-| Simulation Polygon | SIM S0 GO; S1A complete; S1B lifecycle PASS; S1C registered live worker/UI PASS — exact commit `b7ccca3` passed 21 focused target tests and a UI-driven D-only PX4/Gazebo run. Mission Core registered the loopback-only unprivileged worker through a private Unix socket, rendered diagnostic ENU `VehicleState`, persisted eight events and stopped both provider groups with zero residue. The run sent zero commands; PX4 command delivery/motion, canonical PX4/ROS 2 telemetry, pause/step/reset, watchdog/failsafe, navigation/safety acceptance, auth/RBAC and real actuator authority remain absent; top-level Polygon remains gated |
+| Simulation Polygon | SIM S0 GO; S1A complete; S1B lifecycle PASS; S1C registered live worker PASS; UI-2 browser surface PASS — exact commit `60e7916` passed 35 focused tests on the immutable D-only generation, 157 frontend tests and the 705-test backend suite. A capability-gated `Полигон` root now opens one direct workspace with a procedural 3D Ackermann Rover, 360° azimuth orbit, bounded vertical orbit, zoom, pan and live diagnostic ENU state. UI-driven run `s1c-60e7916-20260724t182006z-2f164e` reached `completed` after 27.74 seconds of Gazebo time with eight events, zero commands and zero provider residue. PX4 command delivery/motion, canonical PX4/ROS 2 telemetry, pause/step/reset, watchdog/failsafe, navigation/safety acceptance, shared-deployment auth/RBAC and real actuator authority remain absent |
 
 USB project copying remains optional ground truth rather than a blocker for the
 now-verified network path. Owner-operated LixelGO traffic verifies the MQTT
@@ -163,27 +163,31 @@ fresh loopback-only namespace, the run reached `completed`, and both provider
 groups stopped without residue. S1C commit `b7ccca3` adds a persistent
 unprivileged worker agent in the same isolation boundary, a bounded Unix-socket
 gateway, an explicit `internal-virtual-only` backend gate and a browser-native
-live panel. The exact D-only generation passed 21 target tests and one
-UI-driven provider run with diagnostic Gazebo `VehicleState`, eight persisted
-lifecycle events, terminal `completed` and zero process residue. Its
-zero-command stationary rover does not close PX4 command delivery, canonical
-PX4/ROS 2 telemetry, pause/step/reset, heartbeat/watchdog or failsafe checkers;
-these remain the next S1 increments.
+live panel. UI-2 commit `60e7916` promotes that panel into a worker-gated
+top-level product root and replaces the diagnostic 2D marker with a
+browser-native Three.js Ackermann Rover scene. The exact D-only generation
+passed 35 target tests and one UI-driven provider run with diagnostic Gazebo
+`VehicleState`, eight persisted lifecycle events, terminal `completed` and zero
+process residue. Its zero-command stationary rover does not close PX4 command
+delivery, canonical PX4/ROS 2 telemetry, pause/step/reset, heartbeat/watchdog or
+failsafe checkers; these remain the next S1 increments.
 
-UI-0 now consumes the same append-only run repository through
+The archival surface consumes the same append-only run repository through
 `GET /api/v1/polygon/runs` and
 `GET /api/v1/polygon/runs/{run-id}`. `QualificationRunStore(read_only=True)`
 does not create, chmod or mutate the configured repository and rejects every
-write transition. The Control Station opens the internal
-`polygon-run-internal` workspace only for the direct
-`?workspace=polygon-run[&run=<id>]` route; it is filtered out of System
-navigation and adds no seventh top-level section. Browser QA loaded the accepted
-archive and the S1C live worker. The hidden UI-1 panel shows
-worker/run/provider status, sim time, ENU/FLU pose and a bounded 2D trajectory.
-Start/stop stays behind the backend gate and reaches the worker through a local
-Unix socket; SSH remains qualification bootstrap, never the product data plane.
-A shared operator-facing deployment still requires authentication/RBAC,
-service supervision and an accepted routed worker transport.
+write transition. When `/api/v1/polygon/worker` returns an admitted available
+worker, the Control Station adds `Полигон` as a seventh header root. One header
+click opens the direct `polygon-run` workspace without a System launcher panel.
+The old `?workspace=polygon-run[&run=<id>]` URL remains a compatible deep-link
+for review and exact-run selection, not the primary operator navigation.
+Browser QA loaded the accepted archive and the S1C live worker, rotated and
+zoomed the 3D rover, observed live run/provider status, Gazebo sim time and
+ENU/FLU pose, then completed a clean stop. Start/stop stays behind the backend
+gate and reaches the worker through a local Unix socket; SSH remains
+qualification bootstrap, never the product data plane. A shared
+operator-facing deployment still requires authentication/RBAC, service
+supervision and an accepted routed worker transport.
 
 Mission Core remains a distributed web product. React is served by a long-lived
 Gateway/API and renders canonical state through browser-native components.