feat(k1): wire canonical control session to UI

docs/06_K1_LIVE_VIEWER.md

@@ -115,44 +115,45 @@ directly and use their sibling metadata receive timestamps when present.
    complete visible-device list.
 4. Enter the existing router SSID/password and explicitly authorize the reviewed
    provisioning write. The backend does not retry the write automatically.
-5. Enter the required project name. Mission Core NFKC-normalizes and trims it,
-   rejects control/surrogate characters or more than 96 characters, and stores
-   it as local display metadata rather than a path. The read-only profile does
-   not send it to K1.
-6. When K1 reports a non-AP private address, choose **Подготовить локальный
-   приём данных**. The stronger “initiate device work” wording appears only for
-   a future profile that actually authorizes a vendor write.
-7. Wait until the UI reports that the local Rerun bridge is ready. No manual
-   viewer URL is needed.
-8. Open **Наблюдение → Пространственная сцена**. The K1 plugin's optional scene
-   block shows the local preparation/acquisition phase and stop action.
-9. Double-click the physical K1 button to start scanning. Real point frames and
-   pose/trajectory updates then appear in the embedded viewport.
+5. Confirm operator presence, closed LixelGO, storage/power and steady green;
+   choose **Подключить управление K1**. This emits only connection operations
+   1–6 and then waits indefinitely for the next UI action.
+6. Choose **Открыть рабочее пространство K1** for operation 7.
+7. Enter the required project name and choose **Сохранить проект и подготовить
+   локальный приём**. Mission Core normalizes it, prepares evidence reception
+   and releases only operations 8–10; the name itself is not sent yet.
+8. After the project step is ready, choose **Запустить сканирование K1** once.
+   The project name is carried by canonical START. Mission Core opens
+   **Наблюдение → Пространственная сцена** and shows calibration while the same
+   control socket waits for `SCANNING + project + init_ready`.
+9. Real point frames and pose/trajectory updates then appear in the embedded
+   viewport. Do not use the physical button or open LixelGO during this cycle.
 10. When K1 emits `ModelingReport`, the same plugin block shows its current scan
     time, route distance and speed. These are device reports, not values inferred
     from a browser timer or accumulated across a device counter reset.
-11. Double-click K1 again to stop physical scanning and wait for steady green,
-    then choose **Остановить локальный приём** in the scene or device workflow
-    so capture, camera archive and summaries are finalized. That UI action does
-    not stop K1 on the active profile.
+11. Choose **Остановить устройство и запись** in the scene. The
+    plugin-commanded path emits one canonical STOP on the original socket,
+    waits for live unbound READY, and asks the operator to confirm the constant
+    green indicator before capture, camera archive and summaries are finalized.
 
 Each new live run creates a direct child below `MISSIONCORE_EVIDENCE_DIR`, or
 `.runtime/mission-core/evidence/sessions/` by default, with raw MQTT frames,
 per-message metadata and a hash summary. Repository-level
 `sessions/*_viewer_live` is legacy import-only evidence and is never selected by
-the current writer. The connector subscribes to the fixed report-topic
-allowlist and does not publish an application request or modeling command.
+the current writer. The data connector remains subscribe-only. Application
+requests are isolated in the separate canonical control-session owner and can
+be emitted only by explicit staged UI actions.
 
-The recovered command substrate is intentionally inert. It byte-matches the ten
+The recovered command substrate byte-matches the ten
 observed pre-START requests plus START/STOP, correlates DeviceInfo and modeling
-responses, and classifies live device states without importing MQTT or
-publishing anything. One private application-level OpenAPI authority is kept
+responses, and classifies live device states before any command transition. One
+private application-level OpenAPI authority is kept
 separate from the transient vendor ID/serial returned by the BLE-selected K1.
-The fixed Keychain loader, bounded execution lease and dormant facade
-orchestrator now exist. No emission method or live MQTT sink is installed, and
-an acceptance-only transport exists outside the facade. Keychain provisioning,
-physical START/STOP and durable save completion remain open, so
-`vendor_writes_enabled` is false and the physical-button workflow is canonical.
+The fixed Keychain loader and dormant shadow coordinator remain available for
+inspection. Plugin v0.5.0 additionally installs a continuous interactive MQTT
+owner: operations 1–6 at connection, 7 at workspace entry, 8–10 at project
+preparation, then separately permitted START and STOP. Physical START/STOP and
+durable native-project completion still require operator acceptance.
 
 ## Automatic Rerun source and lifecycle