Reuse canonical home and settings on Node and admit local K1 viewer

docs/audits/2026-09-07-node-home-and-local-k1-r17.md

@@ -0,0 +1,94 @@
+# Node home and local K1 interface — R17
+
+## Approved product surface
+
+The owner requests the existing Mission Core home and avatar → Settings →
+Environment composition on the onboard application, with the same reusable
+components. They explicitly approve moving any missing reusable settings and
+background components into the Design Guideline. Only Home has configurable
+landing content on Node; System and Devices keep their existing workspaces.
+Logo navigation returns to Home. Text, uploaded/URL image/video playlist, order
+and image duration are editable. Remove the decorative fallback radial gradient.
+
+Operator job: personalize the onboard home, then enter existing system/device
+workflows. Home owns presentation, never acquisition or physical authority.
+The existing ApplicationShell stage is the selected placement. A separate
+dashboard/root or reimplemented Node settings form would duplicate the approved
+job and composition, so neither is selected. Avatar UserProfileMenu already
+exists in DG; the reusable EnvironmentSettingsWindow, playlist, background and
+LandingStage are extracted there from the existing implementation. Core and
+Node supply product pages/actions, storage and permissions through adapters.
+
+Initial state: Home without media. States: loading, ready, local draft, saving,
+uploading, saved, validation/storage conflict/error, media unavailable and
+unauthorized Node. Settings use FeatureSettingsWindow, SettingsCard, Field,
+Select, Switch, SortableList, MediaSourceField, RangeControl and canonical
+Button/WindowFooterActions. No new product root or device command is introduced.
+
+## Local K1 findings
+
+Both hosts already consume SensorWorkspace and xgridsK1SensorUi. NodeSensors
+adapts authenticated local enrollment/inventory/operation routes; remote Fleet
+adapts the same broker/plugin operations. Shared K1 fields, validation, connection
+proof and physical command guards remain the same. Local UI reuse alone is not
+physical acceptance on the onboard webview.
+
+The primary button inherited the DG theme's default pink accent on Node, whereas
+Core overrode primary tokens locally. Shared Button now admits a neutral primary
+tone, with white enabled and gray disabled states independent of accent/theme;
+the shared K1 start/configuration actions select it.
+
+The local server's CSP also denied frame ancestry for its own Rerun runtime,
+WebAssembly compilation and blob video. These are presentation transport gaps,
+not a missing second K1 controller. Fixes and tests must preserve same-origin
+authentication/control and allow only the existing viewer/runtime capabilities.
+
+## Acceptance
+
+Required: same settings component rendered for Core and Node, only home in Node
+page selector, text/media persist across reopening, playlist order/timing,
+invalid/stale saves rejected, logo returns home, neutral start states across
+themes, local/remote K1 broker parity and unchanged one-shot guards. Synthetic,
+browser and owner physical outcomes are recorded separately when obtained.
+
+No physical fault injection, automatic provisioning or START/STOP is authorized
+by the visual refactor. The R16 Bridge laboratory checkpoint remains bounded as
+recorded in the previous audit.
+
+## Source and validation — 2026-09-07
+
+Design Guideline: `b10fd5d645ddfb8c373ae6105efa0850aef2509c`. Node candidate: 0.8.14;
+K1 plugin remains 0.1.13. Builder provenance now includes ui-core source and
+compiled shared environment model as well as ui-react and styles.
+
+- Shared DG packages compiled; catalog production build and registry validation
+  passed (34 components, 48 icons). Three shared media/model/DOM tests passed.
+- Core architecture: 4 tests; complete frontend: 809/809; TypeScript and production
+  build passed. Existing operator-environment v3 API/storage is unchanged.
+- Node TypeScript and UI boundary check passed; all Go packages passed. Six new
+  Go test functions cover persistent trimmed home copy, simultaneous revision
+  conflict, rejection without overwriting, corrupt-state preservation, validated
+  PNG upload/hash/reopen/HTTP Range, session/Origin restrictions and scoped CSP.
+- Package lifecycle/installer regressions: 14 passed. No physical BLE, network
+  provisioning, START or STOP was dispatched during this task.
+- In-app browser at the canonical 8000 confirms shared Home renders without the
+  fallback radial gradient. Detailed settings interactions and the Ubuntu
+  webview require acceptance after installation; do not infer them from builds.
+- Core 8000 remains the original durable PID 88424; no 8765 listener and no
+  temporary test/build/server processes. Only the Docker networking helper is
+  present; Docker Desktop was not started.
+
+Local and Bridge commands enter the same DeviceEnrollment.Submit and
+Sensors.Submit; the boolean distinguishes local vs signed remote authority.
+Both use the same SensorWorkspace and xgridsK1SensorUi, including project name,
+mount/GNSS settings, one-shot controls and shared scene. The existing SSE path
+refreshes its write deadline per delivery. The R17 change admits same-origin
+Rerun iframe/WASM/blob media in the local server CSP; it does not change K1
+protocol state or the R16 laboratory acceptance boundary.
+
+Local presentation is authenticated, CAS-versioned and atomically persisted
+beside Node product state. Uploaded media is content-checked, hashed, private,
+limited to 256 MiB/file and 8 GiB total. External images/video are browser-loaded
+HTTP(S) URLs. Media cleanup beyond rejected-upload temporary files is not added;
+recordings, identity, pairing and the installed credential are not part of this
+store. No marketing-image fallback is supplied.