Admit onboard camera preview only after its acquisition producer is ready

docs/audits/2026-09-07-k1-onboard-live-template-r12.md

@@ -58,6 +58,15 @@ No operator/board wall-clock synchronization is required for the age gate.
 - Camera visibility is local presentation, with its decoder kept mounted when
   hidden. Acquisition and the durable camera producer remain onboard-owned.
 
+The camera delivery descriptor is available before its acquisition producer and
+first media commit. Onboard admission now waits for the active recording epoch,
+its live producer and committed first media. It reobserves a replacement epoch
+if admission races recovery. A `require_recording` lease guard forbids the Node
+preview from lazily spawning a producer after STOP; legacy direct preview keeps
+its existing default behavior. The camera gateway regression suite passes 43
+checks. Browser MSE setup also registers sourceopen before assigning the object
+URL and ignores callbacks after decoder disposal (synthetic event regression).
+
 ## Validation and acceptance
 
 Completed at draft time: both TypeScript projects; architecture/focused frontend
@@ -66,7 +75,13 @@ assert shared template and masked initial presentation); 12 Python checks across
 native subscriber and media, including one bounded loopback WebRTC peer with two
 channels and idle/resume. No real BLE/MQTT commands were issued for these checks.
 Full Control Station regression: 802/802 passed. Control Station production
-build passed. Node package build and physical acceptance remain pending.
+build passed. Node UI production build and package generation passed. Final packages are
+rebuilt from the final committed source after camera admission checks; physical
+acceptance remains pending.
+
+Additional focused checks: 27 frontend enrollment/control/media checks, 4 media
+framing/freshness/MSE checks, 25 Node bridge/subscriber checks, 14 installer
+lifecycle checks, and the Node UI control-boundary test passed.
 
 R12 packages target Node 0.8.9 and optional K1 0.1.9. Immutable source/artifact
 identity, installation and acceptance are recorded after packaging.