docs(observation): document durable sessions and viewer lifecycle

docs/06_K1_LIVE_VIEWER.md

@@ -1,9 +1,11 @@
 # K1 live console and embedded Rerun bridge
 
-Status: the Rerun alpha milestone is implemented for the verified firmware-3
-MQTT streams. Live capture and replay use real K1 point-cloud and pose messages;
-the application does not generate a placeholder cloud, trajectory, camera frame
-or latency value.
+Status: the Rerun live and saved-session milestones are implemented for the
+verified firmware-3 point/pose streams. Live and adapter file-replay use the
+process-wide gRPC source; saved observation sessions use private digest-bound
+RRD over same-origin HTTP. Left/right RTSP preview is delivered separately from
+the spatial Rerun stream. The application does not generate placeholder cloud,
+trajectory, camera frame or latency values.
 
 ## Active device-to-scene path
 
@@ -36,10 +38,12 @@ React console <-- REST + WebSocket state --> FastAPI on 127.0.0.1:8000
 ```
 
 The Paho MQTT callback does not decode or render the point cloud. It first
-writes and flushes the raw frame and metadata, then enqueues a preview message.
-If visualization cannot keep up, the oldest queued preview is discarded while
-the raw capture continues. Rerun work stays on the dedicated publisher thread
-and cannot block raw-first evidence capture.
+appends the raw frame, flushes it to the operating-system page cache and stages
+its aligned metadata, then enqueues a preview message. Raw bytes and metadata
+become a durable pair at the bounded group-commit boundary (at most 0.5 s,
+4 MiB or 32 messages), not at every callback. If visualization cannot keep up,
+the oldest queued preview is discarded while capture continues. Rerun work
+stays on the dedicated publisher thread and cannot block that raw-first path.
 
 The current live/replay runtime instantiates only `RerunBridge`. The former
 Foxglove implementation is not a parallel runtime and does not listen on TCP
@@ -53,7 +57,7 @@ Prerequisites are the repository-local Python environment and Node.js 20.19+ or
 ```bash
 uv sync --group dev
 cd apps/control-station
-npm install
+npm ci
 npm run typecheck
 npm run build
 cd ../..
@@ -112,18 +116,20 @@ directly and use their sibling metadata receive timestamps when present.
 9. Double-click K1 again to stop physical scanning, wait for steady green, then
    stop the local session so captures and summaries are finalized.
 
-Each live run creates an ignored `sessions/<UTC>_viewer_live/` directory with a
-redacted manifest, operator notes, raw MQTT frames, per-message metadata and a
-hash summary. The connector subscribes to the fixed report-topic allowlist and
-does not publish an application request or modeling command.
+Each new live run creates a direct child below `MISSIONCORE_EVIDENCE_DIR`, or
+`.runtime/mission-core/evidence/sessions/` by default, with raw MQTT frames,
+per-message metadata and a hash summary. Repository-level
+`sessions/*_viewer_live` is legacy import-only evidence and is never selected by
+the current writer. The connector subscribes to the fixed report-topic
+allowlist and does not publish an application request or modeling command.
 
 ## Automatic Rerun source and lifecycle
 
-On the first live or replay session, `RerunBridge`:
+On the first live or adapter file-replay session, `RerunBridge`:
 
 - creates an explicit `RecordingStream("nodedc_mission_core_spatial")`;
 - installs the default spatial blueprint;
-- starts the gRPC/proxy server on TCP 9876 with a 512 MiB late-client buffer;
+- starts the gRPC/proxy server on TCP 9876 with a 32 MiB late-client buffer;
 - reports `rerun+http://127.0.0.1:9876/proxy` only after the server is ready;
 - accepts the local development and production browser origins used by this
   repository;
@@ -150,7 +156,7 @@ stream directly from the Rerun gRPC/proxy endpoint.
 | `/world` | `ViewCoordinates` | right-handed Z-up display convention |
 | `/world/points` | `Points3D` | decoded metric XYZ with computed or available RGB colors |
 | `/world/sensor_pose` | `Transform3D` + `TransformAxes3D` | current decoded translation, xyzw quaternion and pose axes |
-| `/world/trajectory` | `LineStrips3D` | bounded path of up to 20,000 decoded poses |
+| `/world/trajectory` | `LineStrips3D` | bounded path of up to 2,000 decoded poses |
 
 Point count, frame rate, queue drops and measured pipeline time remain product
 metrics in the outer Control Station; they are not logged as Rerun entities and
@@ -189,9 +195,34 @@ shows only the current frame. RGB mode falls back to the verified scalar
 coloring path when the active point format has no RGB fields. The current
 `class`/custom behavior is a selected solid color, not semantic segmentation.
 
-Projection switching, a custom playback timeline, semantic object/mask layers,
-camera frustums and persisted RBL/layout profiles are not wired yet and must not
-be inferred from the implemented controls above.
+Projection switching, semantic object/mask layers and camera frustums are not
+wired yet. The host-owned `observation.spatial` layout profile does persist the
+implemented scene controls, tool-window state, dynamic source visibility and
+normalized floating-window geometry. It is separate from Rerun's internal
+blueprint and from observation evidence.
+
+## Saved observation sessions
+
+Every completed native live run is indexed by the local host session store. A
+valid crash prefix without its final summary is indexed as `interrupted`. The
+**Сохранённые сессии** control shows the three newest runs and launches an
+opaque same-origin RRD rather than starting a second live bridge.
+
+Sealing, recovery or legacy import makes the session eligible for the bounded
+backend preparation worker. The worker reads every native message once and
+atomically publishes a private cache-v6 RRD using the zero-based `session_time`
+duration timeline. A SHA sidecar binds the generation to native evidence.
+Replay-open never performs conversion: it returns HTTP 202 and a preparation
+handle or reuses the verified artifact. The embedded viewer opens the exact
+generation through Rerun's native incremental HTTP receiver. The bottom Control
+Station timeline then controls play/pause and seek directly; it does not
+approximate time with a React timer.
+
+The native `.k1mqtt` remains the evidence master. RRD generation does not use
+the bounded live-preview queue, so it retains every frame accepted by the
+reviewed normalizer. See
+[`09_OBSERVATION_SESSIONS.md`](09_OBSERVATION_SESSIONS.md) for storage,
+recovery and HTTP Range details.
 
 ## Time and latency semantics
 
@@ -228,7 +259,7 @@ and host firewall as appropriate, and never forward it directly to the public
 Internet or cellular WAN. Remote operation requires an authenticated TLS reverse
 proxy or another reviewed secure transport before deployment.
 
-The 512 MiB Rerun server buffer limits retained late-client data but is not an
+The 32 MiB Rerun server buffer limits retained late-client data but is not an
 access-control mechanism. The listener and embedded viewer intentionally remain
 ready between acquisition sessions. Stop `k1link serve` when the network
 listener and its process memory must be closed unconditionally.
@@ -236,8 +267,10 @@ listener and its process memory must be closed unconditionally.
 ## Current boundaries
 
 - Raw panoramic camera frames were absent from the observed MQTT report topics.
-  This milestone contains point cloud and pose/trajectory; operational metrics
-  are rendered by the outer Control Station.
+  The Rerun spatial recording contains point cloud and pose/trajectory;
+  left/right compressed RTSP preview and acquisition-owned fMP4 archive use a
+  separate generic media path. Historical sessions predating that archive have
+  no recoverable video.
 - Physical double-click remains the K1 scan start/stop control. Any MQTT command
   publisher needs a separately reviewed state-changing profile.
 - No terrain map, elevation model, obstacle segmentation, localization fusion,