feat(k1): add device-bound shadow control gate

docs/01_IMPLEMENTATION_PLAN.md

@@ -3,7 +3,7 @@
 This plan supersedes the app-dependent experiment order in the reference Bible.
 Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 
-## Current checkpoint — 2026-07-17
+## Current checkpoint — 2026-07-18
 
 | Stage | Result |
 | --- | --- |
@@ -21,6 +21,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Stage 7 observation archive | GO (point/pose/telemetry contract) — durable catalog, recovery, capture-clock-bounded RRD preparation, archived metric time series, saved-session timeline and atomic playback are implemented |
 | Stage 7 recorded cameras | GO (contract), acceptance pending — acquisition-owned fMP4 archive and player are implemented/tested; one real archived K1 camera plus point-cloud session has not passed playback yet |
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
+| K1 application control | PAUSE (shadow gate implemented) — the exact captured codec is byte-matched, live status binds vendor identity plus serial, and START/STOP can be planned without publish authority; device-bound OpenAPI enrollment, one-shot publisher, physical save acceptance and recovery policy remain closed gates |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
 
 USB project copying remains optional ground truth rather than a blocker for the
@@ -30,9 +31,13 @@ encoder, response correlator and device-status state machine now exist without a
 publisher. Header construction is known: an explicit ASCII device ID and ASCII
 OpenAPI key are required, while the session ID is derived exactly as
 `${device_id}:ModelingRequest`. MQTT control publishing remains deliberately
-disabled because legitimate OpenAPI credential provenance/provisioning and a
-durable post-stop save gate are not proven. The physical button remains the
-known-safe fallback.
+disabled. A live-only shadow safety layer now observes the device-reported
+vendor identity and serial, rejects identity drift or malformed status, and can
+form a non-executable START only from unbound `READY` or STOP only from a bound
+`SCANNING` state. Its output contains a digest and wire metadata, never the
+device identity, serial, OpenAPI value or payload. Legitimate per-device OpenAPI
+provisioning, an authorized one-shot publisher and a durable post-stop save gate
+are not proven. The physical button remains the known-safe fallback.
 
 The Stage 6 live path uses a bounded raw-first bridge: loss in the visualization
 queue cannot discard MQTT evidence. The queue holds four preview messages;