feat(k1): complete primary acquisition lifecycle

docs/01_IMPLEMENTATION_PLAN.md

@@ -15,27 +15,55 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Stage 4 artifacts/flows | GO — bounded capture, hashes and negative control |
 | Stage 5 point cloud | GO — raw-LZ4 protobuf, 1,140 live frames decoded |
 | Stage 5 pose | GO — 1,215 live frames decoded and motion-correlated |
+| Stage 5 modeling telemetry | GO (read-only) — bounded `ModelingReport` decoder and device-reported scan time/distance/speed are integrated before the preview queue |
 | Stage 5 camera | GO (live) — left/right RTSP/H.264 preview observed, read-only runtime adapter and physical UI acceptance completed |
-| Stage 6 live viewer | GO — React Control Station, embedded self-hosted Rerun cloud/trajectory and Mac pipeline metrics |
-| Stage 7 observation archive | GO (point/pose) — durable catalog, recovery, background RRD preparation, saved-session timeline and atomic playback verified |
-| Stage 7 recorded cameras | GO (contract), acceptance pending — acquisition-owned fMP4 archive and player are implemented/tested; no real archived K1 camera session exists yet |
-| Plugin isolation | GO (laboratory control plane) — vendor backend/frontend are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
+| Stage 6 live viewer | GO — React Control Station, embedded self-hosted Rerun cloud/trajectory, plugin-owned spatial controls and live device/Mac metrics |
+| Stage 7 observation archive | GO (point/pose/telemetry contract) — durable catalog, recovery, capture-clock-bounded RRD preparation, archived metric time series, saved-session timeline and atomic playback are implemented |
+| Stage 7 recorded cameras | GO (contract), acceptance pending — acquisition-owned fMP4 archive and player are implemented/tested; one real archived K1 camera plus point-cloud session has not passed playback yet |
+| Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
 
 USB project copying remains optional ground truth rather than a blocker for the
 now-verified network path. Owner-operated LixelGO traffic verifies the MQTT
-start/stop mapping and RTSP camera transport. MQTT control publishing remains
-deliberately deferred because complete request/save/rollback semantics are not
-yet modeled and the physical button remains a known-safe fallback.
+start/stop mapping and RTSP camera transport. The exact start/stop protobuf
+encoder, response correlator and device-status state machine now exist without a
+publisher. Header construction is known: an explicit ASCII device ID and ASCII
+OpenAPI key are required, while the session ID is derived exactly as
+`${device_id}:ModelingRequest`. MQTT control publishing remains deliberately
+disabled because legitimate OpenAPI credential provenance/provisioning and a
+durable post-stop save gate are not proven. The physical button remains the
+known-safe fallback.
 
 The Stage 6 live path uses a bounded raw-first bridge: loss in the visualization
-queue cannot discard MQTT evidence. Stage 7 adds an independent durable
-observation-session lifecycle. Completed or recovered native captures are
-prepared once by a bounded backend worker into digest-bound RRD/cache-v7 and
-camera-manifest generations; a browser replay request never performs conversion.
-The saved scene, controller and timeline remain hidden until the complete RRD
-range and every declared camera pass admission. Sensor-to-display latency and
-camera/LiDAR sensor-clock alignment remain separate correlation tests.
+queue cannot discard MQTT evidence. The queue holds four preview messages;
+`ModelingReport` is consumed by a plugin-injected observer before that queue and
+does not compete with point/pose frames. A project name is mandatory at
+preparation, NFKC-normalized/trimmed on both sides, rejected for control
+or surrogate characters or more than 96 characters, and retained only as
+display metadata.
+
+Stage 7 adds an independent durable observation-session lifecycle. New native
+captures durably publish the clock origin before camera production, retain a
+transport-scoped provisional envelope and atomically switch the capture-summary
+pointer to a content-addressed session envelope after all producers stop.
+Completed or recovered captures are prepared once by a bounded backend worker
+into digest-bound RRD/cache-v9 and camera-manifest generations;
+a browser replay request never performs conversion. The RRD materializes real
+origin/end rows plus archived device-reported distance, speed and scan-time
+series. The saved scene, controller and timeline remain hidden until the
+complete RRD range and every declared camera pass admission. Sensor-to-display
+latency and camera/LiDAR sensor-clock alignment remain separate correlation
+tests.
+
+The generic host clears a prior manual or archived spatial source only after a
+plugin-owned live/file-replay start succeeds; a failed start preserves the
+current scene. Once an acquisition is nonterminal, a fail-closed guard blocks
+saved-session switching, persisted replay reattach and manual source
+input/apply/reset until that acquisition has been finalized. The successful
+automatic-source action is an internal start-result boundary and intentionally
+does not masquerade as an operator source switch. The K1 scene-level stop
+control is plugin-owned; with the active read-only profile it stops and seals
+local reception only and never claims to stop the scanner.
 
 ## Stage 0 — repository and host baseline
 
@@ -221,6 +249,9 @@ useful stream is decoded or structurally identified.
 - automated scan-button electronics;
 - OpenWrt/monitor-mode infrastructure;
 - firmware or internal-Linux analysis;
-- physical end-to-end replay acceptance for newly archived left/right cameras;
+- physical end-to-end shared-timeline playback for a newly archived session
+  containing point cloud plus one selected K1 camera;
+- legitimate K1 OpenAPI credential provisioning, authorized command transport
+  and stable-artifact proof after the observed stop lifecycle;
 - long-running large-session WebViewer/WASM memory telemetry;
 - production retention, replication, encryption and cross-platform packaging.