feat(simulation): add S1 worker lifecycle ownership

docs/01_IMPLEMENTATION_PLAN.md

@@ -24,7 +24,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
 | K1 application control | GO (physical staged cycle) — after fixing the PCAP-proven `sint64` time field, one explicit UI launch completed all 14 canonical operations on one control session, reached live `SCANNING + project + init_ready`, displayed real points, then one explicit STOP returned K1 to unbound `READY`. No retry or fallback command was sent. Native-project reuse through LixelGO/USB remains an independent verification |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
-| Simulation Polygon | SIM S0 GO; S1A repository boundary implemented — dedicated Docker-free D-only worker and exact stack/clock/resource evidence are accepted. Typed immutable run identity, lifecycle journal, canonical rover command envelopes, authority/TTL checks, artifact index, reset identity and fail-closed restart recovery are implemented locally. Provider process orchestration, PX4 command delivery, watchdog/failsafe evidence, navigation/safety acceptance and real actuator authority remain absent |
+| Simulation Polygon | SIM S0 GO; S1A complete; S1B ownership foundation implemented locally — immutable run/journal/command contracts, exact-S0/D-only admission, idempotent application lifecycle, one-active-run authority and PGID process supervision with deterministic shutdown are implemented and tested. Target stock-rover provider specs/execution, PX4 command delivery, telemetry/frames, watchdog/failsafe evidence, navigation/safety acceptance and real actuator authority remain absent |
 
 USB project copying remains optional ground truth rather than a blocker for the
 now-verified network path. Owner-operated LixelGO traffic verifies the MQTT
@@ -152,9 +152,11 @@ Without the exact admitted target-worker evidence its correct result remains
 `INCOMPLETE`. S1 starts from the accepted S0 version/storage/time/process
 boundary. Its S1A increment implements server-owned immutable run identity,
 legal lifecycle transitions, canonical rover command envelopes, authority/TTL
-admission, append-only artifacts and restart reconciliation. Process ownership,
-PX4 delivery, heartbeat/watchdog execution and captured failsafe outcomes remain
-the next S1 increments.
+admission, append-only artifacts and restart reconciliation. The local S1B
+increment adds idempotent application lifecycle, single active ownership, an
+exact-profile/D-only worker guard and deterministic POSIX PGID supervision.
+Target provider launch/control, PX4 delivery, heartbeat/watchdog execution and
+captured failsafe outcomes remain the next S1 increments.
 
 ## Stage 0 — repository and host baseline