feat: wire physical K1 surface shadow

docs/13_LIDAR_WORKER_PRODUCT_AND_ROADMAP.md

@@ -517,10 +517,28 @@ immutable replay derivative: zero state, point-class or step-candidate
 mismatches and zero scalar delta. The accepted result is
 `k1-local-surface-shadow-04f14d8c580f74cbd5b0a452867563ebc6b3ef93d872129e4918680932253ab7`.
 
-The next gate is not another replay tuning pass. It is an explicit bounded
-LiDAR↔pose binder on the authenticated external worker stream followed by a
-physical K1 shadow run, still without commands, free-space, navigation or
-safety authority.
+The authenticated external worker now contains the next bounded seam.
+`missioncore.k1-local-surface-pose-binder/v1` accepts decoded map-frame
+`lio_pcl` and `lio_pose` in either arrival order, binds by bounded worker
+host-arrival time, and publishes only matched pairs to the capacity-two
+latest-wins estimator queue. Point backlog is bounded to two, pose history to
+16 and the diagnostic result ring to eight. Shutdown flushes or explicitly
+counts every point frame; the final report records pose-binding misses,
+binder/runtime overflow, exact queue accounting, processing failures and p95
+result age.
+
+The pinned physical profile is
+`experiments/perception/worker/e28_physical_k1_local_surface_profile.json`.
+It requires at least `100` bound frames, at most `5%` pose misses, `1%` binder
+point replacement, `1%` runtime replacement and `80 ms` p95 worker-local
+result age. The existing D-only PowerShell worker launcher accepts this
+physical profile and verifies that the minimal hash-addressed package contains
+the local-surface geometry, binder/runtime and ground primitives.
+
+This is implementation readiness, not a physical result. The next gate is to
+build and stage the new content-addressed worker package on D, execute the
+profile against an attached K1 and retain the generated report. Commands,
+free-space, navigation and safety authority remain disabled.
 
 Exit: one immutable K1 session yields both a persistent reconstruction and a
 bounded local world state without hard-coded terrain height or scanner-side
@@ -545,6 +563,9 @@ independent gate without increasing unsafe false-free or false-dynamic output.
 
 - [x] Add a provider-neutral bounded LiDAR local-surface queue independent of
   camera cadence and qualify it at recorded 1× source pace.
+- [x] Bind authenticated decoded physical `lio_pcl + lio_pose` to that queue
+  with bounded buffers, exact accounting and a pinned physical acceptance
+  profile.
 - [ ] Run the accepted K1 local-surface/local-map profile on the NVIDIA worker.
 - [ ] Fuse K1 geometric evidence with E26 camera evidence as independent
   sources; a LiDAR-native detector remains optional.
@@ -612,7 +633,7 @@ large for a free-space claim. Deterministic triage has reduced the first manual
 inspection set to four high-priority frames in two episodes. Prior-plane
 residual explainability now shows that episode `09` is a localized positive
 structure rather than symmetric plane drift. The highest-value immediate work
-is therefore a bounded live-shadow queue, followed by a separate
-dynamic-observation layer. Nvblox,
+is therefore the physical K1 run through the now-implemented bounded
+live-shadow seam, followed by a separate dynamic-observation layer. Nvblox,
 raw-scan detectors and alternative SLAM remain optional later gates because the
 current report contract does not carry their required ray/timing semantics.

docs/14_LIDAR_DATASET_GATEWAY.md

@@ -92,10 +92,12 @@ Not implemented:
 - no model training or production promotion;
 - no RELLIS ROS bag admission, continuous synchronized playback or production
   promotion;
-- no ray-cleared free-space or planner-authoritative rolling occupancy map.
+- no ray-cleared free-space or planner-authoritative rolling occupancy map;
 - the accepted K1 local-surface profile now passes a 15-second
-  recorded-source-paced bounded shadow gate; physical K1 worker binding is not
-  implemented yet, and the residual overlay remains non-authoritative.
+  recorded-source-paced bounded shadow gate; authenticated physical
+  `lio_pcl + lio_pose` binding and its pinned acceptance profile are
+  implemented, but no attached-K1 run has qualified them yet. The residual
+  overlay remains non-authoritative.
 
 ## Product surface boundary