docs(milestone): record K1 control and archive acceptance

docs/07_MISSION_CORE_MONOREPO.md

@@ -128,15 +128,14 @@ requires every model to be covered by a reviewed, plugin-local, path-confined
 compatibility profile. The current XGRIDS profile matches exactly:
 
 - XGRIDS LixelKity K1;
+- wire-level platform type `A4`;
 - firmware `3.0.2`;
 - direct-LAN topology;
 - one retained physical laboratory evidence scope.
 
-Unknown or unattested firmware fails closed. The current runtime does not read
-firmware from the device: it activates this limited, read-only profile only
-after explicit operator attestation of firmware `3.0.2` and direct-LAN topology,
-and records the basis as `operator-attested`. That claim is not device-derived
-proof. The profile independently records observation, decode, replay,
+Unknown or mismatched firmware fails closed. The UI selects the profile and the
+canonical bootstrap verifies model, platform type, activation and firmware from
+a correlated live `DeviceInfo` before START. The profile independently records observation, decode, replay,
 physical-verification and write evidence. Loading it cannot authorize a
 transport mutation. BLE Wi-Fi provisioning and application control retain
 separate explicit operator gates.
@@ -149,30 +148,30 @@ is one private application-level authority; vendor ID and serial come from the
 BLE-selected live K1 and are cross-checked against status. Plugin v0.5.0 owns a
 single interactive MQTT session from connection through STOP/standby, with one
 explicit UI action per recorded lifecycle boundary and no automatic retry. A
-fixed Keychain loader and dormant shadow coordinator remain present. Stable
-physical proof after STOP remains unresolved; write capability is exposed only
-while that interactive socket owner is active.
+fixed Keychain loader and dormant shadow coordinator remain present. The staged
+physical START/live/STOP/unbound-READY cycle is accepted on the reviewed unit;
+write capability is exposed only while that interactive socket owner is active.
 
 ## Semantic lifecycle
 
 The transitional facade now creates separate provisional device,
 device-session, acquisition and operation IDs. Acquisition can be prepared,
 wait for receiver readiness, then wait for an external physical start, and become acquiring only after real point
-data, wait for an externally confirmed stop, finalize and complete. Capture-only
-stop reports the K1 physical state as unknown.
+data. Plugin-commanded STOP finalizes automatically after the same bound control
+session reports unbound READY. Operator-manual capture-only stop still reports
+the K1 physical state as unknown.
 
 Preparation requires a project name. The frontend and backend both apply NFKC
 normalization plus surrounding-whitespace trimming, reject control/surrogate
 characters and names above 96 Unicode characters, and store the result as
-session/catalog display metadata. It is not a path component. Because command
-publishing is off, the current integration does not claim that the name reaches
-K1.
+session/catalog display metadata. It is not a path component. The accepted
+interactive START carries this exact validated value to K1.
 
 The K1 contribution may mount a `SpatialControlsView` beside the host-owned
-viewport. It presents plugin lifecycle wording, the local stop action and live
-`ModelingReport` scan time, route distance and speed. Under the current
-capture-only profile the stop action seals local reception; it does not claim a
-device stop. `ModelingReport` is consumed before the visual preview queue through
+viewport. It presents plugin lifecycle wording, the stop action and live
+`ModelingReport` scan time, route distance and speed. In plugin-commanded mode
+the stop action sends the canonical device STOP; in operator-manual mode it
+seals only local reception. `ModelingReport` is consumed before the visual preview queue through
 an injected observer, preserving the generic normalizer/Rerun boundary.
 
 The operation journal is bounded and in memory. It records IDs, idempotency,
@@ -180,9 +179,9 @@ declared deadlines, progress and terminal results without action parameters or s
 It is not durable, distributed or recoverable after process restart.
 
 Semantic acquisition actions coexist with legacy `stream.*` actions for
-v1alpha1/UI compatibility. On this profile, start and stop operate the local
-receiver and operator workflow only. K1 scanning is still started and stopped
-by physical double-click; no modeling request is published.
+v1alpha1/UI compatibility. On the exact accepted profile, a plugin-commanded
+acquisition owns canonical START and STOP plus local reception. Physical
+double-click remains the independently verified device-local fallback.
 
 Left/right camera preview transport, endpoint paths and H.264 framing are now
 observed under the exact compatibility profile. The local read-only adapter
@@ -190,8 +189,8 @@ copy-remuxes one selected RTSP producer into bounded fMP4/WebSocket delivery for
 the generic MSE UI. New acquisitions archive selected-camera init/segments/index
 independently of browser delivery. The generic recorded player, manifest-v2
 validation and shared `session_time` controls are connected; historical sessions
-created before this archive contract contain no recoverable video, so physical
-recorded-camera acceptance remains open. Portable FFmpeg packaging, disk-backed
+created before this archive contract contain no recoverable video. The TEST007
+recorded-camera package and browser playback are physically accepted. Portable FFmpeg packaging, disk-backed
 browser buffering, fan-out and remote delivery also remain open. Device
 calibration command and sensor-to-vehicle extrinsics are unavailable.
 
@@ -223,9 +222,9 @@ views.
 4. Physically accept a newly archived left/right K1 session, then package the
    read-only RTSP/H.264 adapter for each target OS, add disk-backed sealed media
    caching and evolve same-host MSE delivery toward an authenticated Edge media
-   plane. Keep the modeling-command publisher disabled until operator-owned
-   Keychain item provisioning, physical acceptance of the reviewed uninstalled
-   transport and durable-save confirmation gate.
+   plane. Keep modeling commands limited to the installed operator-present,
+   exact-profile acceptance transport until durable-save confirmation is
+   physically accepted.
 
 Complex equipment will likely be assembled from separately useful component
 plugins into configured hardware packs, while standalone equipment remains