feat(k1): complete primary acquisition lifecycle

README.md

@@ -23,6 +23,13 @@ archive sources, recovery hooks and recording exporters only through the plugin
 runtime contribution. The verified wire protocol and raw evidence format are
 unchanged.
 
+The K1 acquisition now also requires an operator project name. Frontend and
+backend normalize it with NFKC plus surrounding-whitespace trimming, reject
+control/surrogate characters and values above 96 Unicode characters, and
+preserve it as local session/catalog display metadata. It is never used as a
+filesystem path. Because K1 command publishing is disabled, the current runtime
+does not claim that this value has been transmitted to the scanner.
+
 Plugin SDK v0alpha2 now provides executable, vendor-neutral identity, session,
 operation, runtime-action, stream, evidence and compatibility contracts. Every
 backend runtime must now pass a versioned descriptor/handshake against its
@@ -123,10 +130,20 @@ Open `http://127.0.0.1:8000`. The static application, REST/WebSocket control
 plane and credential endpoint bind to loopback only. The current K1 adapter
 still provides real CoreBluetooth discovery, one operator-triggered reviewed
 BLE Wi-Fi provisioning write, read-only MQTT live capture, native `.k1mqtt` and
-reviewed-TSV replay, raw-first evidence storage and measured preview metrics.
-Physical K1 scanning is still started and stopped by the verified double-click;
-the connector publishes no modeling command. The observed LixelGO action mapping
-remains descriptive and write-disabled.
+reviewed-TSV replay, raw-first evidence storage, device-reported scan
+time/distance/speed and measured preview metrics. Its frontend contribution now
+also owns an optional spatial-scene control block, including acquisition phase,
+telemetry and the stop action. On the active laboratory profile that stop action
+finalizes local reception only; physical K1 scanning is still started and
+stopped by the verified double-click.
+
+The exact recovered `ModelingRequest` start/stop encoder, response correlator
+and device-status state machine are implemented as inert protocol components.
+The command header derives `${device_id}:ModelingRequest` from an explicit ASCII
+device ID and requires an explicit ASCII OpenAPI key, but the key's legitimate
+provenance/provisioning and durable post-stop save evidence remain unresolved.
+There is no MQTT publisher in this path, `vendor_writes_enabled` remains false,
+and no modeling command is sent.
 
 This locked bootstrap is repeatable in the current workspace, not yet a
 standalone release install. The frontend consumes sibling `file:` packages from
@@ -149,15 +166,21 @@ The first K1 live session or adapter file-replay (`.k1mqtt`/reviewed TSV) in a
 gRPC/proxy server on TCP 9876 and publishes the resulting URL through
 control-plane state. Later live/file-replay sessions reset their session-local
 scene and metrics and reuse that process-wide stream. Saved observation sessions
-do not reuse this listener: they open a private digest-bound RRD generation over
-same-origin HTTP through Rerun's native incremental receiver. Unless an operator
-has entered a manual source, the React application assigns the applicable source
-to the embedded viewer. The complete live runtime path is K1 MQTT → raw-first
-evidence capture → bounded latest-wins preview queue → explicitly injected K1
+do not reuse this listener: they open a private digest-bound cache-v9 RRD
+generation over same-origin HTTP through Rerun's native incremental receiver.
+Unless an operator has entered a manual source, the React application assigns
+the applicable source to the embedded viewer. A generic host action clears a
+previous manual/archive selection only after a plugin-owned live or file-replay
+start succeeds; a failed start leaves the current scene mounted. A fail-closed
+guard blocks operator source switches for every nonterminal acquisition. The
+complete visual live runtime path is K1 MQTT → raw-first evidence capture →
+bounded four-message latest-wins preview queue → explicitly injected K1
 protobuf/LZ4 normalizer → transport-neutral decoded local views → Rerun
 `Points3D`, `Transform3D` and `LineStrips3D` → embedded Web Viewer. Rerun does
 not inspect K1 topics or raw payloads. These local decoded views are not yet the
-portable Plugin SDK wire envelopes.
+portable Plugin SDK wire envelopes. K1 `ModelingReport` status is consumed by an
+explicitly injected pre-preview observer, so scan telemetry cannot evict point
+or pose frames from that four-message queue.
 
 The default Rerun blueprint shows a 12-second sliding accumulation of real point
 frames. Product controls are connected for point size, intensity/height/distance
@@ -166,17 +189,24 @@ point and trajectory visibility, and the scene grid. The first disk action saves
 and restores the versioned spatial layout without mutating sensor evidence.
 Saved native point/pose sessions are materialized losslessly into private,
 digest-bound RRD recordings and can be played, paused and scrubbed on a
-zero-based `session_time` timeline. No synthetic point cloud, trajectory,
-camera frame or latency value is generated.
+zero-based `session_time` timeline. New captures durably publish a clock origin
+before camera production, retain a transport-scoped provisional envelope and
+atomically point their summary to a content-addressed session envelope after all
+producers stop. That session envelope becomes the real RRD origin/end range;
+archived `ModelingReport` distance, speed and scan time are logged as scalar
+time series. No synthetic point cloud, trajectory, camera frame or latency
+value is generated.
 
 A powered-device checkpoint passed 80 real MQTT messages through the current
 Rerun runtime: 38 point-cloud frames, 42 pose frames, 2,775 points in the last
 cloud and zero decode errors. The later RTSP camera preview is available through
 the generic floating observation windows and new acquisitions archive its fMP4
 segments independently of browser delivery. Historical sessions recorded before
-that archive contract contain no video. Rerun `capture_time` and the camera
-index use Mac receive/arrival timestamps, not proven K1 sensor timestamps or a
-photon-to-screen measurement.
+that archive contract contain no video. A real archived session containing one
+camera plus point cloud has not yet passed physical shared-timeline playback;
+the implementation and test contract do not close that hardware gate. Rerun
+`capture_time` and the camera index use Mac receive/arrival timestamps, not
+proven K1 sensor timestamps or a photon-to-screen measurement.
 
 The old Foxglove implementation is retained only in
 `src/k1link/device_plugins/xgrids_k1/viewer/foxglove_bridge.py` and its regression tests. The current