fix(k1): simplify response-gated launch UX

docs/01_IMPLEMENTATION_PLAN.md

@@ -21,7 +21,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Stage 7 observation archive | GO (point/pose/telemetry contract) — durable catalog, recovery, capture-clock-bounded RRD preparation, archived metric time series, saved-session timeline and atomic playback are implemented |
 | Stage 7 recorded cameras | GO (contract), acceptance pending — acquisition-owned fMP4 archive and player are implemented/tested; one real archived K1 camera plus point-cloud session has not passed playback yet |
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
-| K1 application control | OPERATOR ACCEPTANCE READY — the failed collapsed path and standalone START/STOP remain disabled. Plugin v0.5.0 installs one continuous control-session owner behind separate connection, workspace, project, START, STOP and steady-green UI actions. No wall-clock transition, automatic retry, navigation-triggered command or repository-test equipment I/O exists. A full operator-run physical cycle and native-project verification remain open |
+| K1 application control | OPERATOR ACCEPTANCE READY — the failed protocol-collapsed path and standalone START/STOP remain disabled. Plugin v0.5.0 installs one continuous control-session owner; one explicit UI launch intent advances connection, workspace, project and START only across live response barriers, while STOP and steady-green confirmation remain separate. No wall-clock transition, automatic retry, navigation-triggered command or repository-test equipment I/O exists. A full operator-run physical cycle and native-project verification remain open |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
 
 USB project copying remains optional ground truth rather than a blocker for the

docs/06_K1_LIVE_VIEWER.md

@@ -115,23 +115,24 @@ directly and use their sibling metadata receive timestamps when present.
    complete visible-device list.
 4. Enter the existing router SSID/password and explicitly authorize the reviewed
    provisioning write. The backend does not retry the write automatically.
-5. Confirm operator presence, closed LixelGO, storage/power and steady green;
-   choose **Подключить управление K1**. This emits only connection operations
-   1–6 and then waits indefinitely for the next UI action.
-6. Choose **Открыть рабочее пространство K1** for operation 7.
-7. Enter the required project name and choose **Сохранить проект и подготовить
-   локальный приём**. Mission Core normalizes it, prepares evidence reception
-   and releases only operations 8–10; the name itself is not sent yet.
-8. After the project step is ready, choose **Запустить сканирование K1** once.
-   The project name is carried by canonical START. Mission Core opens
+5. Enter the required project name, confirm operator presence, closed LixelGO,
+   storage/power and steady green, then choose **Запустить сканирование и
+   локальный приём** once.
+6. Mission Core emits operations 1–6, waits for their correlated device
+   responses, then performs operation 7 and operations 8–10 behind the same
+   operator intent. No captured human pause is treated as a timer and no device
+   command is automatically retried.
+7. Mission Core prepares evidence reception before emitting the single
+   canonical START. The project name is carried only by that START; there is no
+   separate K1 project-name write. Mission Core opens
    **Наблюдение → Пространственная сцена** and shows calibration while the same
    control socket waits for `SCANNING + project + init_ready`.
-9. Real point frames and pose/trajectory updates then appear in the embedded
+8. Real point frames and pose/trajectory updates then appear in the embedded
    viewport. Do not use the physical button or open LixelGO during this cycle.
-10. When K1 emits `ModelingReport`, the same plugin block shows its current scan
-    time, route distance and speed. These are device reports, not values inferred
-    from a browser timer or accumulated across a device counter reset.
-11. Choose **Остановить устройство и запись** in the scene. The
+9. When K1 emits `ModelingReport`, the same plugin block shows its current scan
+   time, route distance and speed. These are device reports, not values inferred
+   from a browser timer or accumulated across a device counter reset.
+10. Choose **Остановить устройство и запись** in the scene. The
     plugin-commanded path emits one canonical STOP on the original socket,
     waits for live unbound READY, and asks the operator to confirm the constant
     green indicator before capture, camera archive and summaries are finalized.
@@ -142,7 +143,8 @@ per-message metadata and a hash summary. Repository-level
 `sessions/*_viewer_live` is legacy import-only evidence and is never selected by
 the current writer. The data connector remains subscribe-only. Application
 requests are isolated in the separate canonical control-session owner and can
-be emitted only by explicit staged UI actions.
+be emitted only after the explicit launch or STOP intent and the corresponding
+live response gate.
 
 The recovered command substrate byte-matches the ten
 observed pre-START requests plus START/STOP, correlates DeviceInfo and modeling
@@ -151,8 +153,8 @@ private application-level OpenAPI authority is kept
 separate from the transient vendor ID/serial returned by the BLE-selected K1.
 The fixed Keychain loader and dormant shadow coordinator remain available for
 inspection. Plugin v0.5.0 additionally installs a continuous interactive MQTT
-owner: operations 1–6 at connection, 7 at workspace entry, 8–10 at project
-preparation, then separately permitted START and STOP. Physical START/STOP and
+owner: one UI launch intent advances operations 1–6, 7, 8–10 and START through
+their live response barriers; STOP remains a separate explicit action. Physical START/STOP and
 durable native-project completion still require operator acceptance.
 
 ## Automatic Rerun source and lifecycle

docs/adr/0012-device-bound-k1-command-authority.md

@@ -138,9 +138,12 @@ connection time.
 
 Plugin v0.5.0 installs this boundary through
 `application_session.py`. One background owner is the only thread allowed to
-touch the control MQTT client. REST/UI actions release exactly one checkpoint:
-session open (1–6), workspace entry (7), project preparation (8–10), START, STOP
-and steady-green confirmation. Preparing local reception happens before the
+touch the control MQTT client. The standard UI turns one explicit launch intent
+into response-gated REST actions for session open (1–6), workspace entry (7),
+project preparation (8–10) and START. This is control compression, not protocol
+compression: each next action waits for the exact server/device phase, and
+local polling never retries or times a K1 write. STOP and steady-green
+confirmation remain separate operator actions. Preparing local reception happens before the
 START event is released. After STOP, local capture remains owned until live
 unbound READY and explicit visual confirmation. Page close, model switching,
 polling and service state reads cannot emit START/STOP; model switching is