docs(simulation): record S1 target bootstrap and UI gates

README.md

@@ -160,6 +160,12 @@ Pause/resume/step/reset/stop are owned by the application service through a
 worker port. Stock-rover provider specs, target-worker execution and PX4/Gazebo
 control mapping are still pending factual acceptance.
 
+Commit `630d1ae` has passed the first D-only `MissionCore-Sim` bootstrap
+(`20 passed`, no retained test process). The first visible milestone is now
+split explicitly: UI-0 is a read-only direct run view after real target
+start/stop/recovery is proven; the top-level Polygon control surface remains
+gated on S1 command and safety acceptance.
+
 See the [Polygon product/SRS](docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md),
 [ADR 0015](docs/adr/0015-simulation-polygon-qualification-boundary.md) and the
 [SIM S0 worker runbook](docs/runbooks/SIM_S0_AI_WORKER.md).

docs/01_IMPLEMENTATION_PLAN.md

@@ -24,7 +24,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
 | K1 application control | GO (physical staged cycle) — after fixing the PCAP-proven `sint64` time field, one explicit UI launch completed all 14 canonical operations on one control session, reached live `SCANNING + project + init_ready`, displayed real points, then one explicit STOP returned K1 to unbound `READY`. No retry or fallback command was sent. Native-project reuse through LixelGO/USB remains an independent verification |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
-| Simulation Polygon | SIM S0 GO; S1A complete; S1B ownership foundation implemented locally — immutable run/journal/command contracts, exact-S0/D-only admission, idempotent application lifecycle, one-active-run authority and PGID process supervision with deterministic shutdown are implemented and tested. Target stock-rover provider specs/execution, PX4 command delivery, telemetry/frames, watchdog/failsafe evidence, navigation/safety acceptance and real actuator authority remain absent |
+| Simulation Polygon | SIM S0 GO; S1A complete; S1B ownership foundation passed target bootstrap — exact commit `630d1ae` runs inside D-only `MissionCore-Sim` with 20 target tests and zero test-process residue. Target stock-rover provider specs/execution, PX4 command delivery, telemetry/frames, watchdog/failsafe evidence, navigation/safety acceptance and real actuator authority remain absent. UI-0 is planned after target lifecycle; top-level Polygon remains gated |
 
 USB project copying remains optional ground truth rather than a blocker for the
 now-verified network path. Owner-operated LixelGO traffic verifies the MQTT

docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md

@@ -564,6 +564,11 @@ pause/step/reset evidence remain open. The application service's port can be
 implemented worker-locally without turning SSH or an operator shell into the
 product data plane.
 
+The exact commit `630d1ae` has passed the first target bootstrap inside
+`MissionCore-Sim`: its immutable Git archive was admitted under D, both S1 test
+modules returned `20 passed`, and no test process residue remained. This proves
+target executability of the ownership foundation, not the real provider graph.
+
 ### S2
 
 - Gazebo LiDAR/odometry feed the ROS 2/Nav2 baseline.
@@ -600,15 +605,33 @@ Polygon is planned as the seventh top-level bounded context:
 Center | Fleet | Observation | Polygon | Missions | Data | System
 ```
 
+Two UI gates are intentionally distinct.
+
+### UI-0 — early read-only run view
+
+After target S1B proves persisted start/stop/recovery history, a direct internal
+run view may expose:
+
+- run identity, lifecycle and terminal reason;
+- authoritative clock and current pause/running state;
+- provider health/process ownership;
+- qualification events and admitted artifact links;
+- explicit limitations and gate status.
+
+UI-0 has no PX4 transport, no control commands and no top-level Polygon
+navigation claim. It is a development/acceptance surface backed only by the
+server-owned run repository.
+
+### UI-1 — top-level Polygon
+
 Top-level UI implementation begins only after:
 
 1. this SRS and the clock/frame/authority contracts are accepted;
-2. S1 backend lifecycle is proven;
+2. S1 target backend lifecycle and command authority are proven;
 3. run history is persisted independently of a browser session.
 
-The future UI may present Scenarios, Run, Control, History, Compare and Report.
+UI-1 may present Scenarios, Run, Control, History, Compare and Report. It cannot
-It cannot own provider processes, bypass authority checks or write directly to
+own provider processes, bypass authority checks or write directly to PX4.
-PX4.
 
 ## 21. Change control
 

docs/adr/0015-simulation-polygon-qualification-boundary.md

@@ -51,8 +51,9 @@ reports easy to misuse.
     backend is C-backed and currently serves unrelated co-tenants.
 13. S1 uses exact `px4_msgs` directly. The experimental
     `px4-ros2-interface-lib` is not a mandatory S1 dependency.
-14. A top-level Polygon UI is gated on accepted contracts and a proven S1
+14. A read-only direct UI-0 run view may follow proven target S1B lifecycle and
-    backend lifecycle with persisted run history.
+    persisted history. Top-level Polygon UI and control remain gated on accepted
+    S1 target command/lifecycle behavior.
 15. Real actuator authority requires a new decision and physical safety gate.
 16. S0 processes run inside an ephemeral loopback-only Linux network namespace.
     Micro XRCE-DDS Agent's UDP wildcard bind is acceptable only inside that
@@ -147,3 +148,9 @@ namespace creation, live readiness probes, restart-safe PID/start-token
 reconciliation and Gazebo world-control/PX4 command adapters remain open. The
 worker port deliberately fixes ownership semantics without prematurely fixing
 the eventual transport.
+
+Commit `630d1ae` subsequently passed a D-only `MissionCore-Sim` bootstrap:
+the exact Git archive SHA was verified, both S1 test modules returned
+`20 passed`, and the test process-residue record was empty. This accepts target
+executability of the foundation only; it does not change the open real-provider
+boundaries above.

docs/lab/008_SIM_S1_BOOTSTRAP_20260724.redacted.md

@@ -0,0 +1,72 @@
+# SIM S1 target bootstrap — 2026-07-24
+
+## Result
+
+`PASS` for the exact S1 source-generation/bootstrap boundary. This proves that
+the committed S1A/S1B contracts, repository, application service, worker guard
+and process-supervisor tests execute inside the accepted `MissionCore-Sim`
+target. It does not accept the stock-rover provider lifecycle, PX4 commands,
+telemetry, frames, watchdog behavior or S1 as a whole.
+
+## Exact source generation
+
+- Mission Core commit: `630d1ae`.
+- Branch: `feat/simulation-polygon-s1`.
+- Archive: `NODEDC_MISSION_CORE-s1-630d1ae.tgz`.
+- Archive SHA-256:
+  `0ca5d3ffb008add6e793428e96b88920fdc65fa8d9982e5018ce7a4e83958dae`.
+- Source:
+  `/mnt/d/NDC_MISSIONCORE/simulation/source/NODEDC_MISSION_CORE-630d1ae`.
+- Cache:
+  `/mnt/d/NDC_MISSIONCORE/simulation/cache/mission-core-s1/`.
+
+The archive was produced with `git archive` from the exact commit and an
+explicit path set. The pre-existing S0 source and evidence generations were not
+modified.
+
+## Target and storage
+
+- WSL distribution: `MissionCore-Sim`.
+- Python: `3.12.3`.
+- Kernel: WSL2 Linux `6.18.33.1-microsoft-standard-WSL2`, x86-64.
+- Mutable source, cache and evidence: D-only.
+- D free bytes at bootstrap: `392483127296`.
+- Evidence:
+  `/mnt/d/NDC_MISSIONCORE/simulation/artifacts/s1/bootstrap/20260724T150000Z-630d1ae`.
+
+## Validation
+
+```text
+PYTHONPATH=src python3 -m pytest -q \
+  tests/test_simulation_s1_run_store.py \
+  tests/test_simulation_s1_orchestrator.py
+```
+
+Result:
+
+```text
+20 passed in 14.73s
+```
+
+The evidence generation retains environment and source identity, target pytest
+output, source-file SHA-256 values, an empty process-residue record, an evidence
+digest index and `verdict=pass`.
+
+## Accepted and open boundaries
+
+Accepted:
+
+- exact committed S1 source executes on the target worker;
+- the D-only source/cache/artifact split is viable;
+- local process-group tests stop without retained test processes;
+- S1 requires neither a global Python package install nor Docker.
+
+Still open:
+
+- concrete Gazebo/PX4/XRCE/ROS provider specifications;
+- product-owned loopback target namespace;
+- real-provider health and deterministic shutdown;
+- restart-safe PID/start-token reconciliation;
+- live pause/resume/step/reset;
+- Ackermann/Differential command mapping;
+- canonical `VehicleState`, frame conversion and failsafe evidence.