}/>;
}
function CameraSourceCard({
diff --git a/apps/control-station/test/devicePluginFrontendBoundary.test.mjs b/apps/control-station/test/devicePluginFrontendBoundary.test.mjs
index 08d2add..8a51642 100644
--- a/apps/control-station/test/devicePluginFrontendBoundary.test.mjs
+++ b/apps/control-station/test/devicePluginFrontendBoundary.test.mjs
@@ -191,11 +191,13 @@ test("XGRIDS frontend is physically plugin-owned and split by operator pipeline"
assert.match(spatialControls, /role="alert"/);
assert.doesNotMatch(spatialControls, /Повторить остановку/);
assert.match(spatialControls, /stopLocalReceiver/);
- assert.match(spatialControls, /{
assert.match(markup,/Остановить устройство/);
assert.match(markup,/rerun-viewport__canvas/);
assert.match(markup,/>СтатусПространственная модельПространственная сцена{
const starting={...device,control:{...device.control,can_start:false},snapshot:{...device.snapshot,acquisition:'starting'}};
const markup=render(starting);
assert.match(markup,/]*aria-busy="true"[\s\S]*?nodedc-activity-indicator[\s\S]*?Запускаем устройство<\/button>/);
- assert.equal((markup.match(/nodedc-activity-indicator"/g)||[]).length,1);
- assert.doesNotMatch(markup,/Остановить устройство|k1-preview-spatial/);
+ assert.match(markup,/K1 калибруется и готовит облако точек/);
+ assert.doesNotMatch(markup,/Обновить просмотр/);
});
test('completed STOP remains visible while the control connection is checked again',()=>{
const stopped={...device,online:false,verified:false,control:{...device.control,phase:'completed',can_start:false,network_applied:true}};
diff --git a/apps/control-station/test/k1PreviewFrames.test.mjs b/apps/control-station/test/k1PreviewFrames.test.mjs
index 6477102..bafd1d1 100644
--- a/apps/control-station/test/k1PreviewFrames.test.mjs
+++ b/apps/control-station/test/k1PreviewFrames.test.mjs
@@ -78,3 +78,16 @@ test('onboard camera admits immediate sourceopen and ignores callbacks after clo
assert.equal(ready,1);assert.equal(failed,0);
}finally{globalThis.MediaSource=saved.media;URL.createObjectURL=saved.create;URL.revokeObjectURL=saved.revoke;}
});
+
+test('a recovered media peer resumes a recording without reinserting old RRD batches',async()=>{
+ const {previewRecording}=await server.ssrLoadModule('@xgrids-k1/frontend/sensors/previewFrames.ts');
+ const sent=[];const cursor=previewRecording(value=>sent.push(value));
+ const payload=new Uint8Array(12);payload.set([82,82,70,50]);
+ assert.equal(cursor.accept(1,payload),true);
+ // The ACK was lost, so the new peer resends the exact complete batch.
+ assert.equal(cursor.accept(1,payload),false);
+ assert.equal(cursor.after,1);
+ assert.throws(()=>cursor.accept(3,payload),/cursor gap/);
+ assert.equal(cursor.accept(2,payload),true);
+ assert.equal(sent.length,2);
+});
diff --git a/apps/node-agent/packaging/build_deb.py b/apps/node-agent/packaging/build_deb.py
index 12863ce..9182641 100644
--- a/apps/node-agent/packaging/build_deb.py
+++ b/apps/node-agent/packaging/build_deb.py
@@ -11,7 +11,7 @@ import sys
ROOT = Path(__file__).resolve().parents[1]
-VERSION = "0.8.9"
+VERSION = "0.8.10"
sys.path.insert(0, str(ROOT.parents[1] / "scripts/packaging"))
from debian import package
diff --git a/docs/audits/2026-09-07-k1-onboard-live-template-r12.md b/docs/audits/2026-09-07-k1-onboard-live-template-r12.md
index df87db0..1428e03 100644
--- a/docs/audits/2026-09-07-k1-onboard-live-template-r12.md
+++ b/docs/audits/2026-09-07-k1-onboard-live-template-r12.md
@@ -117,3 +117,12 @@ is preserved by package removal/upgrade; public R12 preparation leaves it in
place and the service consumes the same systemd credential. Thus this artifact
is an update for the existing R11 board, not a self-contained credential-bearing
installer for a new board. The older private release is not altered.
+
+## Installed outcome and failed stability acceptance
+
+The owner subsequently reported installer exit 0. Read-only dpkg inspection
+confirmed Node 0.8.9 and K1 0.1.9, with active service and zero service restarts.
+Camera and cloud appeared, but repeated outbox Full / media backpressure caused
+preview recording replacement and history loss. R12 is not accepted as stable.
+The follow-up investigation and correction are recorded in
+`2026-09-07-k1-onboard-preview-continuity-r13.md`.
diff --git a/docs/audits/2026-09-07-k1-onboard-preview-continuity-r13.md b/docs/audits/2026-09-07-k1-onboard-preview-continuity-r13.md
new file mode 100644
index 0000000..2867909
--- /dev/null
+++ b/docs/audits/2026-09-07-k1-onboard-preview-continuity-r13.md
@@ -0,0 +1,93 @@
+# K1 onboard preview continuity and canonical scene R13
+
+## Observed regression
+
+The owner confirmed R12 installation exit 0. Read-only package inspection
+confirmed Node 0.8.9 and K1 0.1.9. The service was active with NRestarts=0.
+Camera, points and trajectory appeared, but the live scene repeatedly went black
+and accumulation/route restarted. A bounded journal selection for that exact run
+showed repeated `Node RRD subscriber failed exception=Full`, plus media delivery
+RuntimeErrors. This is failed preview acceptance, not an accepted R12 release.
+
+The encoded outbox previously raised Full after 500 ms. SCTP delivery also
+terminated a peer after two seconds of backpressure. Every replacement peer
+constructed a new RerunBridge, called begin_session and discarded trajectory and
+recording identity. Separately, the UI hid the entire scene whenever source age
+expired. No scanner/service restart is needed to explain these symptoms.
+
+## Continuity contract
+
+Preview protocol v3 keeps one native recording per acquisition view. The browser
+keeps its native channel and acknowledged batch cursor while disposable WebRTC
+peers recover. The board retains the corresponding subscriber for up to five
+minutes after disconnection. Every complete RRD batch is numbered and ACKed;
+a lost ACK causes retransmission of identical bytes, and the browser deduplicates
+it. Cursor mismatch/expired resumption reports a terminal reopen instruction;
+it must never silently create replacement history. Explicit view close frees
+capacity immediately; acquisition close retires every view.
+
+The encoded outbox is bounded to two queued batches, one pending batch and one
+encoder-held batch, each no larger than 8 MiB. It waits without killing the
+recording. Decoded input coalesces independently per modality. The acquisition
+producer/archive never waits for the preview. Route snapshots come from the
+already bounded acquisition-owned trajectory, including motion during preview
+congestion. This is a disposable live view, not a replay of every archived frame.
+The chosen accumulation window still governs how long points remain visible.
+
+Data-channel buffering is bounded at 256 KiB. Backpressure pauses sending while
+the peer is alive; a 30-second keepalive expiry bounds abandoned peers. Preview
+close/recovery does not send START, STOP, Wi-Fi, BLE or camera-producer commands.
+Camera lease renewal requires an existing active recording and restarts only
+the browser decoder. Source age includes time spent receiving each RRD payload;
+repeated metadata cannot make old points fresh. Stale history remains visibly
+marked instead of being replaced with a black canvas.
+
+## Exact scene composition
+
+The owner supplied the direct LAB scene as the composition reference. Shared
+`SpatialScene` now owns the existing toolbar, renderer allocation, device-control
+slot, source controls, engine status, metrics, navigation hint, timeline and media
+slots. Direct live and recorded hosts retain their existing renderers, profile
+factories, AI/replay controls and authority. Their markup is consumed through
+the shared scene instead of being independently re-created in the K1 Node UI.
+
+The original K1 phase/telemetry capsule is extracted as `K1SpatialSession`, with
+pure shared phase/metrics vocabulary. Direct and onboard views use the same
+calibration/completion copy, timing, route, speed and capsule geometry. The
+onboard adapter receives the actual acquisition phase; manual STOP uses the
+existing guarded operation. The scene stays mounted during calibration and STOP.
+
+The onboard scene uses the same ApplicationPanel header and floating camera
+window: title “Пространственная сцена”, live/wait status, expand and close. It
+omits LAB, descriptive subtitle, disk action and unused AI mode buttons. The
+three engine/layers/display tools, accumulation and movable/resizable camera
+remain. The enrollment “Настроить устройство” primary button occupies full width.
+No new Design Guideline primitive, navigation root, recorded blueprint, archive
+format, credential source or physical reconnection supervisor is introduced.
+
+## Validation
+
+- Full Control Station regression: 804/804 passed after shared composition/model
+ extraction. Focused UI checks are repeated after final media lifecycle changes.
+- Python: 92 relevant tests across native RRD (6), media (10), Node control (22),
+ installer (11) and camera gateway (43) covered by the combined pass and final
+ affected-subset pass. The final native/media/control subset passed 38/38.
+- Regressions include a blocked native outbox beyond 500 ms, ACK loss/resumption
+ of the same native subscriber, expired cursor rejection, explicit view disposal,
+ SCTP backpressure beyond two seconds, native RRD fragmentation, and idle/resume
+ of a real bounded loopback WebRTC peer with camera. No physical device commands.
+- Both UI typechecks and production/package builds are required before staging;
+ final artifacts and installation outcome are recorded below when available.
+
+The owner confirmed STOP; the paired Fleet snapshot was subsequently idle with
+control phase completed. Canonical Mission Core remains on port 8000. CUA exposes
+an in-app browser without documented cache/click controls, not the owner's
+Chrome session. Opening the home page is not clean-cache hardware acceptance.
+Required owner UI acceptance remains: clear Chrome cache before each run; START,
+calibration, camera/points, move the scanner, ensure route survives a delivery
+pause; move/resize camera; STOP and observe finalization. No Ops write or Git push
+is retried after the earlier automatic-approval rejections.
+
+R13 is a matched public update: Node 0.8.10 and K1 0.1.10, protocol v3. It uses the
+existing root-owned encrypted K1 credential. No Keychain read or secret-bearing
+installer is part of this build. The standard installer safe-state guard remains.
diff --git a/packages/sensor-ui/src/contracts.ts b/packages/sensor-ui/src/contracts.ts
index a314640..803de5c 100644
--- a/packages/sensor-ui/src/contracts.ts
+++ b/packages/sensor-ui/src/contracts.ts
@@ -1,7 +1,7 @@
export interface SensorProfile { id: string; sensor: number; stream: string; index: number; format: string; fps: number; width?: number; height?: number }
export interface SensorOption { id: string; sensor: string; label: string; value: number; min: number; max: number; step: number; read_only: boolean }
export interface Sensor {
- kind?:string; connection_label?:string; control?:{generation:number;revision:number;phase:string;can_start:boolean;can_stop?:boolean;can_verify?:boolean;network_applied?:boolean;reason_code?:string|null;acquisition_id:string|null};
+ kind?:string; connection_label?:string; control?:{generation:number;revision:number;phase:string;can_start:boolean;can_stop?:boolean;can_verify?:boolean;network_applied?:boolean;reason_code?:string|null;acquisition_id:string|null;acquisition_phase?:string};
live_settings?: Record;
id: string; name: string; model: string; prepared: boolean; configured?: boolean; verified: boolean; online: boolean; usb: string; firmware?: string; playback_id?: string | null;
snapshot: {context: {session_id: string; device: {device_id: string}; execution: {node_id: string}}; acquisition: string; enrollment: string; message?: string};
diff --git a/packages/spatial-ui/src/EmptySpatialStage.tsx b/packages/spatial-ui/src/EmptySpatialStage.tsx
new file mode 100644
index 0000000..3409639
--- /dev/null
+++ b/packages/spatial-ui/src/EmptySpatialStage.tsx
@@ -0,0 +1,8 @@
+import {Icon} from '@nodedc/ui-react';
+export function EmptySpatialStage({settings, title='Визуальный источник не назначен', detail='Область сцены не подставляет демонстрационные точки. Назначьте RRD или Rerun gRPC, чтобы открыть реальные данные.'}: {settings:{showGrid:boolean};title?:string;detail?:string}) {
+ return
+
+
XZ
+
{title}
{detail}
+
;
+}
diff --git a/packages/spatial-ui/src/SpatialScene.tsx b/packages/spatial-ui/src/SpatialScene.tsx
new file mode 100644
index 0000000..35ab3a0
--- /dev/null
+++ b/packages/spatial-ui/src/SpatialScene.tsx
@@ -0,0 +1,32 @@
+import type {ReactNode, RefObject} from 'react';
+import {StatusBadge} from '@nodedc/ui-react';
+
+/** The existing scene composition. Hosts supply transport/renderers and authority. */
+export function SpatialScene({viewportRef, focused, primaryFocused, mediaMaximized, toolbar,
+ renderer, deviceControls, sourceControls, status, metrics, timeline, media, overlays, footer,
+ navigationReady=false}: {
+ viewportRef: RefObject; focused?:boolean; primaryFocused?:boolean;
+ mediaMaximized?:boolean; toolbar:ReactNode; renderer:ReactNode; deviceControls?:ReactNode;
+ sourceControls?:ReactNode; status:{label:string;tone:'neutral'|'success'|'warning'|'danger';message?:string};
+ metrics:ReactNode; timeline?:ReactNode; media?:ReactNode; overlays?:ReactNode; footer?:ReactNode;
+ navigationReady?:boolean;
+}) {
+ return