feat(simulation): add S1 worker lifecycle ownership

docs/01_IMPLEMENTATION_PLAN.md

@@ -24,7 +24,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
 | K1 application control | GO (physical staged cycle) — after fixing the PCAP-proven `sint64` time field, one explicit UI launch completed all 14 canonical operations on one control session, reached live `SCANNING + project + init_ready`, displayed real points, then one explicit STOP returned K1 to unbound `READY`. No retry or fallback command was sent. Native-project reuse through LixelGO/USB remains an independent verification |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
-| Simulation Polygon | SIM S0 GO; S1A repository boundary implemented — dedicated Docker-free D-only worker and exact stack/clock/resource evidence are accepted. Typed immutable run identity, lifecycle journal, canonical rover command envelopes, authority/TTL checks, artifact index, reset identity and fail-closed restart recovery are implemented locally. Provider process orchestration, PX4 command delivery, watchdog/failsafe evidence, navigation/safety acceptance and real actuator authority remain absent |
+| Simulation Polygon | SIM S0 GO; S1A complete; S1B ownership foundation implemented locally — immutable run/journal/command contracts, exact-S0/D-only admission, idempotent application lifecycle, one-active-run authority and PGID process supervision with deterministic shutdown are implemented and tested. Target stock-rover provider specs/execution, PX4 command delivery, telemetry/frames, watchdog/failsafe evidence, navigation/safety acceptance and real actuator authority remain absent |
 
 USB project copying remains optional ground truth rather than a blocker for the
 now-verified network path. Owner-operated LixelGO traffic verifies the MQTT
@@ -152,9 +152,11 @@ Without the exact admitted target-worker evidence its correct result remains
 `INCOMPLETE`. S1 starts from the accepted S0 version/storage/time/process
 boundary. Its S1A increment implements server-owned immutable run identity,
 legal lifecycle transitions, canonical rover command envelopes, authority/TTL
-admission, append-only artifacts and restart reconciliation. Process ownership,
-PX4 delivery, heartbeat/watchdog execution and captured failsafe outcomes remain
-the next S1 increments.
+admission, append-only artifacts and restart reconciliation. The local S1B
+increment adds idempotent application lifecycle, single active ownership, an
+exact-profile/D-only worker guard and deterministic POSIX PGID supervision.
+Target provider launch/control, PX4 delivery, heartbeat/watchdog execution and
+captured failsafe outcomes remain the next S1 increments.
 
 ## Stage 0 — repository and host baseline
 

docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md

@@ -534,6 +534,36 @@ portable. The target Simulation Orchestrator must bind that root under the
 accepted `/mnt/d/NDC_MISSIONCORE` storage boundary; S1 provider orchestration
 and target evidence are not implied by this increment.
 
+#### S1B ownership foundation status
+
+The next local increment implements the provider-neutral ownership boundary:
+
+- `SimulationApplicationService` is the only caller allowed to drive persisted
+  start, pause, resume, single-step, stop, reset and restart reconciliation;
+- start and stop requests are journal-bound to idempotency keys, and a
+  different request cannot rebind the same run operation;
+- a second `starting|running|paused|stopping` run cannot acquire the same worker
+  authority;
+- the worker port exposes lifecycle operations without exposing a browser-to-PX4
+  channel or choosing a remote transport;
+- `S0WorkerGuard` requires the run's exact accepted S0 profile ID/SHA-256, the
+  canonical `/mnt/d/NDC_MISSIONCORE/simulation/artifacts/s1/runs/<run-id>`
+  artifact layout and the actual
+  `/mnt/d/NDC_MISSIONCORE/simulation/runtime/s1/runs/<run-id>` supervisor
+  working layout before provider start;
+- `PosixProcessSupervisor` launches argv without a shell, creates one dedicated
+  session/PGID per provider, writes run-scoped stdout/stderr and a process
+  registry, rolls back partial starts, and stops in ascending S0 shutdown order;
+- failure, profile drift or process residue becomes a persisted terminal
+  failure rather than a successful stop.
+
+This is a tested local foundation, not S1B target acceptance. Concrete
+Gazebo/PX4/XRCE/ROS provider specs, loopback namespace creation, target
+health probes, post-restart PID identity reconciliation and live
+pause/step/reset evidence remain open. The application service's port can be
+implemented worker-locally without turning SSH or an operator shell into the
+product data plane.
+
 ### S2
 
 - Gazebo LiDAR/odometry feed the ROS 2/Nav2 baseline.

docs/adr/0015-simulation-polygon-qualification-boundary.md

@@ -125,3 +125,25 @@ own provider processes, transmit a PX4 setpoint, execute heartbeat/watchdog
 failsafe behavior, or qualify navigation/safety behavior. The target
 orchestrator must place the caller-supplied repository root under the accepted
 D-only worker boundary.
+
+## S1B ownership foundation
+
+`k1link.simulation.orchestrator` now owns the application lifecycle through a
+transport-neutral worker port. Start and stop requests are persisted with
+idempotency identity, one active run owns a worker at a time, and
+pause/resume/step/reset cannot bypass run-state validation. Provider start
+failure, S0 profile drift, stop residue and restart interruption all become
+explicit run events and terminal failures.
+
+`k1link.simulation.process_supervisor` provides the worker-local POSIX ownership
+primitive: shell-free argv, dedicated provider PGIDs, run-scoped logs, atomic
+process registry, partial-start rollback and ascending shutdown order matching
+the accepted S0 dependency graph. `k1link.simulation.worker` binds that
+primitive to the exact accepted S0 profile digest and canonical D-only S1 run
+artifact and process-runtime layouts.
+
+This is not target-worker acceptance. Provider specifications, loopback network
+namespace creation, live readiness probes, restart-safe PID/start-token
+reconciliation and Gazebo world-control/PX4 command adapters remain open. The
+worker port deliberately fixes ownership semantics without prematurely fixing
+the eventual transport.