feat(perception): integrate calibrated operator pipeline

Add calibrated K1 projection, recorded and near-live perception qualification, unified Rerun operator layers, bounded replay admission, audited viewer controls, worker experiments, and lab evidence.

plugins/xgrids-k1/README.md

@@ -20,11 +20,21 @@ The plugin owns:
   [`profiles/`](profiles/), with strict evidence flags and a fail-closed loader;
 - BLE discovery hints and K1 GATT metadata;
 - Bridge and Direct Connect through the reviewed firmware-3 BLE Wi-Fi
-  provisioning frame, plus a one-shot macOS CoreWLAN Quick Connect adapter;
-- K1 LAN status and private-address validation;
+  provisioning frame, plus the reviewed Quick Connect AP-enable frame and
+  one-shot host-profile association adapter;
+- read-only refresh of the selected K1's session-scoped DHCP address before a
+  new LAN operation; address changes rotate the device session and IP is never
+  treated as device identity;
 - subscribe-only data MQTT transport plus a separately bounded canonical
   application-control transport;
 - native `.k1mqtt` capture;
+- the read-only factory-calibration transport: one live `DeviceInfo` binding,
+  command-5 reads of exactly `camera.yaml` and
+  `extrinsic_camera_lidar.yaml`, and append-only private source snapshots; file
+  write and arbitrary paths are unavailable;
+- safe exact-schema normalization of KB4 intrinsics, the main-camera 800x600
+  resize and explicit `T_camera_N_from_lidar` matrices, with firmware-verified
+  `sensor.camera.left -> camera_0` and `sensor.camera.right -> camera_1` binding;
 - firmware-scoped protobuf/LZ4 and legacy codecs;
 - normalization of K1 point cloud and pose, plus raw-only preservation of the
   still-undecoded status and heartbeat channels;
@@ -89,11 +99,39 @@ Plugin v0.6.0 retains the physically accepted v0.5.0 control transport and adds
 the connection matrix behind the existing explicit `network.provision` action.
 Bridge remains the default. Direct Connect sends the same single reviewed
 99-byte frame with credentials for an already-running controller hotspot. Quick
-Connect sends no BLE write: a short-lived Swift/CoreWLAN helper receives the
-operator-entered K1 AP credentials only over stdin, performs at most one scan
-and one association, and never receives an automatic retry. Mission Core then
-uses the observed K1 AP data-plane address. Automatic extraction of AP
-credentials from undocumented BLE data is deliberately not implemented.
+Connect accepts no browser/API credential: it sends one reviewed fixed 100-byte
+AP-enable frame to the selected K1, waits up to 15 seconds for the canonical
+byte-51 AP-ready flag, and keeps that BLE session alive while the macOS adapter
+performs bounded exact-SSID CoreWLAN discovery and one association. Credentials
+are resolved by a preinstalled exact `3.0.2` firmware provider. Its optional laboratory importer
+validates the reviewed official archive, extracts the single AP declaration and
+installs firmware-scoped material in the OS secure store. The macOS helper then
+materializes the selected device profile entirely inside Keychain before any
+BLE write. The secret never enters the browser, API, argv, logs or evidence;
+the importer's short-lived mutable buffer is zeroized after the stdin handoff.
+There is no automatic BLE-write or association retry. A clean host cannot
+obtain the provider from BLE and the product does not download firmware during
+connection. Windows/Linux Quick Connect adapters are not planned while that
+bootstrap remains unresolved. Mission Core then uses the
+reviewed K1 AP data-plane address. The
+99-byte station-provisioning payload and 100-byte
+AP-enable payload share `7f01` but remain distinct exact reviewed frames; neither
+is a credential-read command.
+
+For retained laboratory reproduction only, an operator can install the reviewed
+source on a macOS host without displaying the credential:
+
+```bash
+uv run k1link authority import-k1-fw302-ap \
+  --firmware /private/path/to/the-official-3.0.2-archive.tar \
+  --confirm-reviewed-firmware
+```
+
+The 2026-07-20 UI run physically accepted the prepared-host path: one BLE discovery,
+one AP-enable write, AP-ready, one CoreWLAN association, control bootstrap and
+the normal acquisition lifecycle. It does not prove that the current build is
+portable to a clean Mac. Bridge/direct-LAN remains the default and continuing
+product route; Quick Connect stays available as laboratory functionality.
 
 Plugin v0.5.0 installed the reviewed application-control transport behind
 explicit plugin actions.
@@ -105,10 +143,8 @@ next reviewed action may be requested; it never schedules a device command by
 elapsed time. START waits for bound `SCANNING + project + init_ready` before
 operations 13–14. STOP is separately permitted, never retried, and keeps the same socket until K1
 reports unbound READY. That protocol state automatically completes local sealing;
-stable green is physical corroboration rather than a second UI gate. The
-admin CLI still provisions the fixed Keychain item through Apple's hidden
-prompt without accepting the private value as an argument. No physical command
-is emitted merely by loading the plugin, opening the page, navigating, polling
+stable green is physical corroboration rather than a second UI gate. No
+physical command is emitted merely by loading the plugin, opening the page, navigating, polling
 state or running repository tests. The full v0.5.0 START/live/STOP/save path is
 physically accepted on the reviewed K1/A4/FW 3.0.2 unit.