feat: prove and decode K1 realtime MQTT streams

docs/00_TECHNICAL_AUDIT.md

@@ -1,14 +1,19 @@
 # Technical audit
 
-Status: pre-production planning, 2026-07-15.
+Status: live feasibility validated, 2026-07-15.
 
 ## Executive finding
 
-The project is feasible as a disciplined black-box investigation, but the
-existence of a complete K1-to-Mac realtime link is not yet established. The
-first hard problem is not decoding points or images. It is bootstrapping the K1
-from BLE availability into Wi-Fi association and then opening the proprietary
-application data session without LixelGO.
+The K1-to-Mac realtime link is feasible and has been demonstrated without
+LixelGO. The tested Mac provisioned firmware 3.0.2 over BLE, confirmed K1 LAN
+association, opened the device's MQTT 3.1.1 service on TCP 1883, captured a
+physical-button scan and decoded both point-cloud and pose reports.
+
+All 1,140 captured `lio_pcl` frames decoded as raw-LZ4 protobuf blocks, yielding
+4,165,862 points. All 1,215 `lio_pose` messages decoded, and the resulting
+approximately 1.566 m displacement matched the controlled movement. The
+remaining feasibility question is the panoramic camera branch, not the core
+realtime LiDAR/pose path.
 
 The supplied Bible is useful as an OSINT dossier. It is not an executable plan
 for the actual stand because many experiments assume a phone and LixelGO. The
@@ -31,16 +36,16 @@ writes.
 Each of these remains scoped to the actual firmware/hardware state observed in
 the lab. The physical unit is authoritative.
 
-### Strong hypotheses
+### Resolved hypotheses
 
-- BLE is the bootstrap/control plane and Wi-Fi is the likely high-rate data
-  plane.
-- The user-provided SSID and PSK are transported inside a vendor-defined GATT
-  protocol.
-- The application may need a second token, certificate, handshake, or stream
-  subscription after ordinary Wi-Fi association.
-- The externally exposed point cloud is more likely a processed/downsampled
-  preview than raw LiDAR packets.
+- BLE is the bootstrap/provisioning plane and Wi-Fi/MQTT is the high-rate data
+  plane on the tested firmware.
+- SSID and PSK use a verified fixed 99-byte GATT frame; the hidden credential
+  path never persists the password.
+- The report subscriptions require no second MQTT credential, certificate or
+  application publish handshake on the direct LAN path.
+- The external `lio_pcl` stream is a processed point cloud rather than raw
+  LiDAR packets.
 
 XGRIDS provides stronger product evidence for an external point-cloud path than
 the local LAS alone: current LixelStudio materials describe K1 remote control
@@ -49,18 +54,18 @@ and this does not disclose or guarantee access to the protocol from macOS. It
 does, however, justify keeping realtime point cloud as the primary stream target.
 No comparable official evidence proves an exportable raw panorama/camera stream.
 
-### Unsupported until measured
+### Still unsupported until measured
 
-- K1 remembers an existing Wi-Fi profile.
-- K1 exposes its own access point.
-- Provisioning fields are plain UTF-8, JSON, TLV, CBOR, or protobuf.
-- A writable GATT characteristic can be used without bonding or an app token.
 - Local `map.las` layout resembles the network stream.
-- Live pose or camera frames leave the device.
-- A point stream contains simple float32 XYZ tuples.
-- Network payloads are unencrypted.
+- Raw or stitched panoramic camera frames leave the device.
+- The upper 24 bits of point `rgbi` are usable packed RGB.
+- MQTT application commands can be published safely without first reproducing
+  device/session header state and response handling.
 
-## Major corrections to the source plan
+## Initial corrections to the source plan
+
+These corrections governed the safe experiment. The resolved outcomes above
+and the verified profiles now supersede their pre-lab uncertainty.
 
 1. Experiments requiring LixelGO are removed from the active critical path.
    There will be no app-session capture, provisioning diff, app-start comparison,
@@ -142,6 +147,11 @@ device baseline
   -> point cloud / pose / status / optional camera decoders
 ```
 
+The chain through point-cloud/pose decoding is now complete. See the
+[MQTT stream profile](05_K1_MQTT_STREAM_PROFILE.md) and
+[redacted lab report](lab/001_K1_LIVE_MQTT_20260715.redacted.md) for measured
+formats, counts and artifact hashes.
+
 ## Verified primary references
 
 - [XGRIDS K1 firmware and release notes](https://www.xgrids.com/intl/support/download?page=K1)