feat: qualify bounded K1 surface shadow

docs/13_LIDAR_WORKER_PRODUCT_AND_ROADMAP.md

@@ -4,7 +4,8 @@ Date: 2026-07-26
 Status: accepted architecture plan; L0/L1 implemented; L2 diagnostic A/B
 complete; full GOOSE and RELLIS qualification complete; L2.6d K1 replay
 local-surface temporal qualification, operator triage and prior-plane residual
-explainability implemented; bounded live shadow next
+explainability implemented; L2.6e recorded-source-paced bounded shadow
+qualified; physical K1 shadow next
 Scope: passively received real-time K1 point/pose evidence, immutable replay and
 future live shadow processing
 Explicitly out of scope: K1 firmware modification, a new onboard exporter, new
@@ -419,8 +420,11 @@ Dataset expansion is no longer the next gate.
   aggregate p95.
 - [ ] Complete the remaining qualification report with per-frame latency,
   point age, obstacle preservation and memory growth.
-- [ ] Replay the same profiles through a bounded latest-wins live-shadow queue;
-  no K1 command, navigation or safety authority is added.
+- [x] Replay the same profile through a bounded latest-wins shadow queue at the
+  recorded 1× source rate; no K1 command, navigation or safety authority is
+  added.
+- [ ] Bind that runtime to physical live K1 point/pose evidence through the
+  existing authenticated external-worker seam.
 
 The implemented `missioncore.k1-local-surface/v1` derivative is reproducible
 through `experiments/perception/run_k1_local_surface.py` and is exposed
@@ -496,9 +500,27 @@ independent ground truth. Frame `1195` instead has only seven out-of-band cells
 together, preserving its separate interpretation as a surface-regime
 transition.
 
-No fit threshold was changed after this review. The next gate is a bounded
-latest-wins live-shadow queue using the same profile and evidence contract,
-still without commands, free-space, navigation or safety authority.
+No fit threshold was changed after this review.
+
+The L2.6e runtime contract
+`missioncore.k1-local-surface-shadow-runtime/v1` now copies and freezes one
+decoded map-point/pose pair, runs the accepted estimator behind a
+capacity-two latest-wins queue and retains only a bounded diagnostic result
+ring. It has no command method, never turns missing points into free space and
+publishes explicit false navigation/safety authority.
+
+LAB E27 passed a `14.995 s` source-paced 1× RAVNOVES00 slice: all `143`
+available frames were consumed, maximum queue depth was `1/2`, no work was
+replaced and no processing failed. Processing latency was `12.261 ms` p50,
+`14.777 ms` p95 and `33.135 ms` maximum. Every processed result matched the
+immutable replay derivative: zero state, point-class or step-candidate
+mismatches and zero scalar delta. The accepted result is
+`k1-local-surface-shadow-04f14d8c580f74cbd5b0a452867563ebc6b3ef93d872129e4918680932253ab7`.
+
+The next gate is not another replay tuning pass. It is an explicit bounded
+LiDAR↔pose binder on the authenticated external worker stream followed by a
+physical K1 shadow run, still without commands, free-space, navigation or
+safety authority.
 
 Exit: one immutable K1 session yields both a persistent reconstruction and a
 bounded local world state without hard-coded terrain height or scanner-side
@@ -521,7 +543,8 @@ independent gate without increasing unsafe false-free or false-dynamic output.
 
 ### L4 — live shadow integration
 
-- [ ] Add a bounded LiDAR queue independent of camera cadence.
+- [x] Add a provider-neutral bounded LiDAR local-surface queue independent of
+  camera cadence and qualify it at recorded 1× source pace.
 - [ ] Run the accepted K1 local-surface/local-map profile on the NVIDIA worker.
 - [ ] Fuse K1 geometric evidence with E26 camera evidence as independent
   sources; a LiDAR-native detector remains optional.

docs/14_LIDAR_DATASET_GATEWAY.md

@@ -93,8 +93,9 @@ Not implemented:
 - no RELLIS ROS bag admission, continuous synchronized playback or production
   promotion;
 - no ray-cleared free-space or planner-authoritative rolling occupancy map.
-- no bounded live-shadow execution of the accepted K1 local-surface profile
-  yet; the residual overlay remains replay-only and non-authoritative.
+- the accepted K1 local-surface profile now passes a 15-second
+  recorded-source-paced bounded shadow gate; physical K1 worker binding is not
+  implemented yet, and the residual overlay remains non-authoritative.
 
 ## Product surface boundary