feat: add Polygon UI-0 run view

docs/adr/0015-simulation-polygon-qualification-boundary.md

@@ -2,9 +2,11 @@
 
 ## Status
 
-Accepted for architecture; SIM S0 qualification returned `GO` and the S1B
-real-provider start/health/stop boundary passed on 2026-07-24. Navigation
-behavior, safety behavior and real actuator authority are not accepted.
+Accepted for architecture; SIM S0 qualification returned `GO`, the S1B
+real-provider start/health/stop boundary passed on 2026-07-24, and the direct
+read-only UI-0 view is implemented and visually verified against that accepted
+journal. Navigation behavior, safety behavior and real actuator authority are
+not accepted.
 
 ## Context
 
@@ -51,9 +53,10 @@ reports easy to misuse.
     backend is C-backed and currently serves unrelated co-tenants.
 13. S1 uses exact `px4_msgs` directly. The experimental
     `px4-ros2-interface-lib` is not a mandatory S1 dependency.
-14. A read-only direct UI-0 run view may follow proven target S1B lifecycle and
-    persisted history. Top-level Polygon UI and control remain gated on accepted
-    S1 target command/lifecycle behavior.
+14. The read-only direct UI-0 run view consumes proven target S1B persisted
+    history through GET-only server routes. It is hidden from navigation and
+    cannot mutate a run. Top-level Polygon UI and control remain gated on
+    accepted S1 target command/lifecycle behavior.
 15. Real actuator authority requires a new decision and physical safety gate.
 16. S0 processes run inside an ephemeral loopback-only Linux network namespace.
     Micro XRCE-DDS Agent's UDP wildcard bind is acceptable only inside that
@@ -113,10 +116,14 @@ PX4 startup and DDS-writer markers existed. No arm, setpoint or other PX4 shell
 command was sent. Stop produced `completed`, eight events, zero commands and no
 process residue.
 
-This decision accepts UI-0 implementation against persisted run history. It
-does not widen command authority or accept pause/step/reset, canonical
-telemetry, frame conversion, watchdog/failsafe behavior, navigation or physical
-control.
+UI-0 now implements that decision. `QualificationRunStore(read_only=True)`
+opens an existing repository without creating or chmodding it and rejects every
+mutating method. The web process exposes only run catalog/detail GET routes,
+and the hidden Control Station workspace opens only from
+`?workspace=polygon-run[&run=<id>]`. Browser QA loaded the accepted
+`s1b-6cb1495-20260724t1535z` journal. This does not widen command authority or
+accept pause/step/reset, canonical telemetry, frame conversion,
+watchdog/failsafe behavior, navigation or physical control.
 
 ## S1A implementation
 
@@ -159,14 +166,16 @@ the accepted S0 dependency graph. `k1link.simulation.worker` binds that
 primitive to the exact accepted S0 profile digest and canonical D-only S1 run
 artifact and process-runtime layouts.
 
-This is not target-worker acceptance. Provider specifications, loopback network
-namespace creation, live readiness probes, restart-safe PID/start-token
-reconciliation and Gazebo world-control/PX4 command adapters remain open. The
-worker port deliberately fixes ownership semantics without prematurely fixing
-the eventual transport.
+The later exact generation `6cb1495` supplied the target provider
+specifications, loopback namespace and live readiness probes and passed the
+real-provider start/health/stop boundary described above. Restart-safe
+PID/start-token reconciliation after orchestrator loss and Gazebo
+world-control/PX4 command adapters remain open. The worker port deliberately
+fixes ownership semantics without making SSH or the browser a provider
+transport.
 
 Commit `630d1ae` subsequently passed a D-only `MissionCore-Sim` bootstrap:
 the exact Git archive SHA was verified, both S1 test modules returned
 `20 passed`, and the test process-residue record was empty. This accepts target
-executability of the foundation only; it does not change the open real-provider
-boundaries above.
+executability of the foundation only; the later `6cb1495` evidence, not that
+bootstrap, closes the real-provider lifecycle boundary.