docs: add final execution contract

prompt.md

@@ -0,0 +1,90 @@
+# Lardon3D — Final Execution Contract
+
+This file is the entry point for the collective Lardon3D execution contract.
+
+```text
+CONTRACT_SCOPE=ENTIRE_PROMPT_TREE
+CONTRACT_LANGUAGE=ENGLISH
+WORK_FIRST_RETURN_LAST=REQUIRED
+CANONICAL_WORKING_BRANCH=main
+CURRENT_STATE_AUTHORITY=main
+GIT_CLOSURE_OWNER=HUMAN
+IMPLEMENTATION_AUTHORIZATION=NO
+```
+
+## Mandatory reading order
+
+Before any major implementation tranche, read:
+
+1. `AGENTS.md`
+2. `README.md`
+3. `docs/README.md`
+4. `docs/product/product_definition.md`
+5. `docs/roadmap/roadmap.md`
+6. every file under `prompt/` in numeric order from `00_AUTHORITY.md` through `33_DEFINITION_OF_DONE.md`
+7. the specialized canonical `docs/architecture/**` documents cited by the tranche
+
+The files under `prompt/` form one collective contract. No child file may be interpreted in isolation when another child file defines a complementary constraint.
+
+## Absolute rules
+
+- Preserve all applicable PASS/FROZEN scientific and architectural boundaries.
+- Never invent calibration, lens identity, metric scale, campaign equivalence, provenance, or scientific identity.
+- Never create a Project DB version or production Task Kind without explicit human authorization.
+- Never create a second Task Runtime, Queue, scheduler, Resource Governor, generic executor, or backend framework merely for convenience.
+- Never modify `scan3d/` without explicit human authorization.
+- Never use retained real scientific projects as destructive scratch/test workspaces.
+- Never reinterpret historical checkpoints as current state.
+- Never treat GitHub and Forgejo as different project authorities; they are mirrors of the same canonical `main`.
+- Never stage with `git add -A`.
+- Never commit or push unless the human explicitly authorizes Git closure.
+- Never force-push unless the human explicitly authorizes that exact operation.
+
+## STOP
+
+STOP before any change that would:
+
+- reopen a PASS/FROZEN boundary;
+- change a FROZEN scientific threshold or identity;
+- introduce pseudo-calibration or silent calibration substitution;
+- introduce an unauthorized Project DB schema version;
+- introduce an unauthorized production Task Kind;
+- create an unnecessary parallel runtime/scheduler/backend framework;
+- modify `scan3d/`;
+- perform a destructive operation;
+- create/switch/merge/rebase branches without authorization;
+- resolve an unexplained mirror divergence by overwriting one remote;
+- contradict executable code/schema and a canonical contract;
+- resolve a material product ambiguity by assumption.
+
+A STOP report contains only the relevant authority, the exact contradiction, and the minimum human decision required.
+
+## Execution discipline
+
+For an authorized tranche:
+
+1. identify the governing authority;
+2. inspect only the context needed to execute correctly;
+3. define the exact file and subsystem scope;
+4. implement the complete tranche;
+5. run proportional delta-based validation;
+6. fix defects within scope;
+7. run `git diff --check`;
+8. report only after the tranche is complete or a real STOP condition is reached.
+
+Do not return after each file. Do not repeat global A-to-Z audits when unchanged FROZEN systems already have retained evidence.
+
+## Current head assumptions
+
+This contract was prepared against the repository state that declares:
+
+```text
+CURRENT_PROJECT_DB_SCHEMA=v25
+PRODUCTION_TASK_KINDS=16
+PRODUCT_DEFINITION_V1=PASS/FROZEN
+PROMPT_TREE=NEXT
+REAL_S21_TRACKS=PASS/FROZEN
+REAL_A6000_PRE_SFM=PASS/FROZEN
+```
+
+Before implementation, verify these assumptions against current `main`. If current `main` has legitimately advanced, update only the CURRENT statements that are stale; never rewrite historical or FROZEN meaning silently.

prompt/00_AUTHORITY.md

@@ -0,0 +1,63 @@
+# 00 — Authority
+
+## Status
+
+```text
+AUTHORITY_CONTRACT=REQUIRED
+```
+
+## Authority
+
+Primary authority is the repository on canonical branch `main`.
+
+Read and apply, in order of role rather than by blindly overriding specialized contracts:
+
+- `AGENTS.md`: global agent obligations and repository limits.
+- `docs/product/product_definition.md`: final product destination.
+- specialized `docs/architecture/**`: acquired scientific, persistence, runtime, identity and resource contracts.
+- `docs/roadmap/roadmap.md`: lifecycle and current sequencing.
+- `README.md` and `docs/README.md`: current navigation and summary.
+- historical audits/tags/checkpoints: evidence for their own checkpoint only.
+- executable code/schema: authority when exact APIs, constants, DDL or runtime behavior are being quoted.
+
+
+## CURRENT
+
+The canonical working branch is `main`.
+
+```text
+CANONICAL_WORKING_BRANCH=main
+CURRENT_STATE_AUTHORITY=main
+OTHER_BRANCHES_ARE_NOT_AUTHORITY
+```
+
+## FROZEN
+
+A specialized PASS/FROZEN contract is not superseded by this prompt tree. This tree references and constrains execution around those contracts; it does not duplicate them.
+
+## Git authority
+
+The local working tree is the current working authority. GitHub (`github`) and Forgejo (`origin`) are mirrors of the same project, not independent variants.
+
+After an explicitly authorized Git closure:
+
+```text
+local main
+  -> github/main
+  -> origin/main
+```
+
+should normally identify the same commit.
+
+## Required Git inspection before Git-sensitive work
+
+```sh
+git branch --show-current
+git status --porcelain
+git remote -v
+git rev-parse HEAD
+git rev-parse github/main
+git rev-parse origin/main
+```
+
+If a remote is missing, inaccessible, or unexpectedly divergent: STOP. Do not choose one mirror as the winner by assumption.

prompt/01_PRODUCT_VISION.md

@@ -0,0 +1,49 @@
+# 01 — Product Vision
+
+## Status
+
+```text
+PRODUCT_VISION=FROZEN_TARGET
+```
+
+## Authority
+
+`docs/product/product_definition.md` is the product authority.
+
+## REQUIRED_PRODUCT_TARGET
+
+Lardon3D is a persistent, incremental, resource-aware Linux photogrammetry system controlled primarily by an ncurses TUI, with a required companion graphical viewer.
+
+The product must let a user:
+
+- create and reopen durable projects;
+- ingest traceable still, future live-device, and video-derived captures;
+- manage camera/lens/optical configurations without code changes for ordinary equipment;
+- reach explicit calibration readiness;
+- execute the existing scientific pre-SfM and Sparse SfM pipeline without invented science;
+- produce durable Dense/MVS, mesh, refinement, texturing and exports;
+- inspect sparse/dense/mesh/texture and camera evidence;
+- analyze coverage;
+- receive actionable supplementary-capture guidance;
+- use live A6000 HDMI and S21 acquisition adapters without forking the scientific pipeline;
+- restart after crashes/reboots without hidden transient knowledge.
+
+## Principles
+
+```text
+SCIENTIFIC_TRACEABILITY=REQUIRED
+DETERMINISM=REQUIRED
+PERSISTENT_PROGRESS=REQUIRED
+ATOMIC_PUBLICATION=REQUIRED
+BOUNDED_EXECUTION=REQUIRED
+MAXIMUM_SAFE_USEFUL_THROUGHPUT=REQUIRED
+SERIALISM_REQUIRES_PROOF=REQUIRED
+NO_SILENT_SCIENTIFIC_SUBSTITUTION=REQUIRED
+NO_DESTRUCTIVE_AUTOMATION=REQUIRED
+```
+
+The system must expose uncertainty rather than replace it with guesses.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/02_CURRENT_FROZEN_STATE.md

@@ -0,0 +1,102 @@
+# 02 — Current and Frozen State
+
+## Status
+
+```text
+CURRENT_PROJECT_DB_SCHEMA=v25
+PRODUCTION_TASK_KINDS=16
+```
+
+## Authority
+
+`README.md`, `AGENTS.md`, `docs/roadmap/roadmap.md`, specialized architecture documents, and retained checkpoint evidence.
+
+## CURRENT
+
+```text
+Project DB head                         v25
+Production Task kinds                   16
+Feature Store                           IMPLEMENTED
+Visual Index                            IMPLEMENTED
+Candidate Pair                          IMPLEMENTED
+Matcher                                 IMPLEMENTED
+TUI operational observatory            VALIDATED
+External SSD controller                 VALIDATED
+Calibration Solver Preflight v1         PASS
+```
+
+The additive schema lineage is:
+
+```text
+v22 selected scientific execution foundation
+v23 generic optical-context overlay
+v24 raw.develop.batch/1
+v25 features.extract.batch/1
+```
+
+## FROZEN
+
+Preserve at their documented boundaries:
+
+- Capture / Asset Provenance;
+- acquisition ingestion and durable campaign execution;
+- Photo Quality Triage;
+- Selected Scientific Execution;
+- Geometric Verifier v3;
+- Track Model / Track Builder;
+- Sparse SfM capability through Gate G (detailed lifecycle: Gate A decision/historical; Gates B-G PASS/FROZEN);
+- Phase H v1;
+- MVS-M1 external OpenMVS 2.4.0 boundary;
+- Calibration Science v1;
+- Calibration Tooling v1;
+- Calibration Bootstrap v1;
+- Internal Parallelism / Compute Resources;
+- Resource / Compute Governor;
+- ORB Vulkan backend;
+- Global Maintenance Audit;
+- Real S21 Tracks;
+- Real A6000 pre-SfM.
+
+`FROZEN` protects meaning and boundary, not necessarily every file byte.
+
+## Retained real S21 checkpoint
+
+```text
+REAL_S21_TRACKS=PASS/FROZEN
+project=/home/fy59/Documents/Lardon/.real-pre-sfm-2026-08-31/s21-gv-v3
+Tracks=912447
+Track observations=2495768
+Track length min/max=2/42
+digest=c30eba192627bf73eaf21ff30d81038d8cc6bbf36a69226f88cdc8c37f7d74a1
+Sparse SfM=NOT EXECUTED
+Dense/MVS=NOT EXECUTED
+```
+
+## Retained real A6000 checkpoint
+
+```text
+REAL_A6000_PRE_SFM=PASS/FROZEN
+tag=real-a6000-pre-sfm-2026-09-02
+project=/home/fy59/Documents/Lardon/.real-pre-sfm-2026-09-01/a6000-pre-sfm-v23-final
+Project DB=v25
+Selected images=689
+Feature Sets=689
+Candidate Pairs=38420
+Match Results=38420
+Applicable GVRs=37805
+Verified GVRs=10952
+Rejected GVRs=26853
+Track Sets=1
+Tracks=130714
+Track observations=318944
+Sparse SfM Tasks=0
+Sparse Reconstructions=0
+Dense/MVS=0
+GV v3 fingerprint=6944a471d611d8ffc59dac7cf15a5b79b97e2371d4c51785c477d68c1577f74c
+```
+
+The project-directory name is historical and must not be mistaken for schema head.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/03_END_PRODUCT.md

@@ -0,0 +1,57 @@
+# 03 — End Product
+
+## Status
+
+```text
+END_PRODUCT=REQUIRED_PRODUCT_TARGET
+```
+
+## Authority
+
+`docs/product/product_definition.md`.
+
+## REQUIRED_PRODUCT_TARGET
+
+The finished product is not complete at Sparse SfM. It is complete only when the durable workflow reaches usable reconstruction, inspection, improvement and export.
+
+Required top-level capabilities:
+
+- data-driven optics onboarding;
+- calibration assistant and accepted calibration import;
+- real known-calibration Sparse SfM;
+- durable restartable Dense/OpenMVS execution;
+- mesh, refinement, texturing and consolidation;
+- interoperable traceable export;
+- passive graphical viewer;
+- offline coverage analysis;
+- actionable capture guidance;
+- live localization and truthful loss/confidence states;
+- stock A6000 HDMI integration;
+- S21 integration without root;
+- deterministic video keyframes;
+- safe optional SSD scratch;
+- recovery, diagnostics and resource-aware performance;
+- local-first operation with no cloud dependency for core workflows;
+- explicit preview-before-delete cleanup/storage management.
+
+## Local-first and cleanup requirements
+
+Core project operation, reconstruction, calibration processing, viewer, coverage analysis, capture guidance and export must not require a cloud service. Future optional network/device adapters must make network use explicit; user project imagery is not uploaded merely to operate the product.
+
+Cleanup is explicit and reviewable. The product may identify orphan temporary assets, superseded immutable generations, export caches and stale scratch, but it must show what will be removed before destructive cleanup. FROZEN/historical evidence is never deleted automatically because a newer generation exists.
+
+## REJECTED
+
+
+The final product does not require:
+
+- a GUI replacement for the TUI;
+- camera firmware or hardware modification;
+- cloud reconstruction;
+- generic backend frameworks without demonstrated need;
+- a second scheduler/runtime;
+- invented metric scale.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/04_PIPELINE_END_TO_END.md

@@ -0,0 +1,61 @@
+# 04 — End-to-End Pipeline
+
+## Status
+
+```text
+PIPELINE_TARGET=REQUIRED
+```
+
+## Authority
+
+`docs/product/product_definition.md` plus specialized architecture contracts for each existing stage.
+
+## REQUIRED_PRODUCT_TARGET
+
+```text
+project
+-> acquisition / Capture / provenance
+-> optics assignment
+-> calibration readiness
+-> quality selection
+-> deterministic selected scientific representation
+-> Features
+-> Visual Index
+-> Candidate Pairs
+-> Matcher
+-> Geometric Verification
+-> Tracks
+-> Sparse SfM
+-> incremental enrichment when lineage permits
+-> explicit multi-campaign registration when required
+-> Dense / MVS
+-> mesh
+-> refinement
+-> texturing
+-> consolidation
+-> coverage analysis
+-> viewer / capture guidance
+-> export
+```
+
+Video and live sources enter through acquisition boundaries and converge into the same normal scientific pipeline after durable Capture promotion.
+
+## Invariants
+
+Every scientific stage must consume explicit durable identities and publish atomically. A downstream failure must not invalidate a valid upstream immutable generation.
+
+## Quality boundary
+
+Existing quality recommendations remain explainable and non-destructive:
+
+```text
+GOOD
+SUSPECT
+REJECT
+```
+
+Where the FROZEN selection contract permits a human override, that override is explicit, durable and visible and does not rewrite measured quality evidence. Live guidance should reuse the same quality concepts where practical without turning preview evidence into a scientific Capture.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/05_SCIENTIFIC_INVARIANTS.md

@@ -0,0 +1,35 @@
+# 05 — Scientific Invariants
+
+## Status
+
+```text
+SCIENTIFIC_INVARIANTS=MANDATORY
+```
+
+## Authority
+
+Specialized PASS/FROZEN architecture documents remain authoritative.
+
+## FROZEN
+
+- No pseudo-calibration.
+- No EXIF-as-calibration fallback.
+- No silent lens identity inference.
+- No silent calibration substitution or interpolation.
+- No metric-scale claim for arbitrary monocular gauge.
+- No silent merging of independent campaigns.
+- No mutation of immutable upstream scientific generations.
+- No treating an external process success code as scientific acceptance.
+- No anonymous temporary representation may become a durable scientific result without provenance.
+- Deterministic scientific identities and parameter fingerprints remain explicit.
+- Scientific identity must not depend on CPU thread count, worker scheduling, host model, temporary path or wall-clock duration.
+- GPU/CPU execution choice is operational unless a scientific contract explicitly makes a backend scientifically non-transparent.
+- Where exact bit identity cannot honestly be guaranteed across dependency/hardware versions, the owning scientific contract must define the reproducibility boundary explicitly.
+
+## STOP
+
+If a planned feature requires a new threshold, weighting function, estimator, classification policy, frame-selection science, coverage score or other scientific rule that is not already FROZEN, first define and validate a versioned scientific contract. Do not hide new science inside implementation code.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/06_IDENTITY_MODEL.md

@@ -0,0 +1,42 @@
+# 06 — Identity Model
+
+## Status
+
+```text
+IDENTITY_DISCIPLINE=REQUIRED
+```
+
+## Authority
+
+`AGENTS.md`, persistence/project database documents, Capture/provenance and scientific model documents.
+
+## FROZEN
+
+Never silently equate:
+
+```text
+Capture != file
+Capture != asset
+Capture != image_id
+Capture != SHA-256
+Capture != path
+Capture != filename/basename
+Capture != Task ID
+Capture != campaign group ID
+Task ID != scientific acquisition identity
+campaign group ID != Capture identity
+```
+
+Current meanings:
+
+- SHA-256: immutable asset bytes.
+- `capture_id`: physical acquisition representation in Project DB.
+- `image_id`: scientific image representation.
+- Task ID: durable operational work.
+- campaign group ID: stable operational grouping within an acquisition request.
+
+Future Dense, mesh, texture, coverage, registration, live-promotion and video-keyframe identities must be explicit, versioned, durable and provenance-linked. They must not be inferred from paths or timestamps.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/07_PERSISTENCE_RECOVERY.md

@@ -0,0 +1,63 @@
+# 07 — Persistence and Recovery
+
+## Status
+
+```text
+PERSISTENCE_RECOVERY=REQUIRED
+```
+
+## Authority
+
+`docs/architecture/persistence.md`, `docs/architecture/project_database.md`, `docs/architecture/runtime.md`, `docs/architecture/task_system.md`.
+
+## FROZEN
+
+Existing persistence semantics, task recovery and schema lineage are consumed as-is.
+
+## REQUIRED_PRODUCT_TARGET
+
+New long-running product stages must be:
+
+- durable;
+- restartable;
+- failure-atomic;
+- bounded;
+- explicit about immutable inputs and published generations;
+- recoverable without private solver/process state.
+
+Do not persist transient library internals merely to resume work.
+
+External-process orchestration must durably preserve enough exact input/output identity and checkpoint state to restart safely.
+
+### Project portability
+
+The durable project must not depend on:
+
+- absolute temporary paths;
+- current CPU topology;
+- current GPU device;
+- current external-scratch mount path;
+- a live camera connection;
+- a previous process ID;
+- a specific Task worker instance.
+
+Hardware-specific operational state is rediscovered; scientific identities remain stable.
+
+### Recovery cases
+
+Final-product long-running stages must define recovery behavior for application close, system reboot, Task cancellation, process crash, external-process failure, safe-drained scratch disconnect and partial physical-asset publication where existing orphan semantics permit it.
+
+Restart must never infer the scientific input from filename, timestamp or another heuristic.
+
+## Schema rule
+
+```text
+NEW_PROJECT_DB_VERSION_REQUIRES_HUMAN_AUTHORIZATION
+NEW_PRODUCTION_TASK_KIND_REQUIRES_HUMAN_AUTHORIZATION
+```
+
+A planned capability does not itself grant that authorization.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/08_RESOURCE_POLICY.md

@@ -0,0 +1,48 @@
+# 08 — Resource Policy
+
+## Status
+
+```text
+RESOURCE_UTILIZATION_POLICY=MAXIMUM_SAFE_USEFUL_THROUGHPUT
+SERIALISM_REQUIRES_PROOF=CANONICAL
+```
+
+## Authority
+
+`AGENTS.md`, `docs/architecture/resource_governor.md`, `docs/architecture/internal_parallelism.md`, `docs/architecture/resource_aware_pipeline.md`.
+
+## FROZEN
+
+First preserve normal interactive workstation use. Then use all remaining resources that are both safe and useful.
+
+Reference-host evidence only:
+
+```text
+16 logical CPUs
+~4 logical CPUs interactive reserve
+~12 logical CPUs compute
+~3 GiB MemAvailable hard reserve
+Radeon 780M UMA
+```
+
+These are not product constants.
+
+## Rules
+
+- per-item atomicity does not imply cross-item serialization;
+- owner-only publication does not imply serial preparation;
+- bounded internal fan-out is expected when independent useful work exists;
+- all participants are bounded, accounted, cancellable and joined;
+- UMA is charged once against host RAM;
+- swap and zram are pressure mechanisms, not admitted RAM;
+- scratch is storage, not RAM;
+- pressure may reduce admission;
+- safe useful capacity must be readmitted when pressure clears;
+- I/O or measured scaling knees may justify under-utilization;
+- fixed historical `CPU1`, `-j8`, batch sizes or worker counts never become universal policy;
+- normal users observe but do not need to select authoritative CPU width, batch/window, inflight depth, participant count, GPU backend, scratch mode or RAM budget;
+- no stage may introduce an unbounded whole-project load merely for implementation convenience.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/09_TASK_QUEUE_GOVERNOR.md

@@ -0,0 +1,33 @@
+# 09 — Task, Queue and Governor
+
+## Status
+
+```text
+TASK_RUNTIME_AUTHORITY=SINGLE
+QUEUE_AUTHORITY=SINGLE
+RESOURCE_GOVERNOR_AUTHORITY=SINGLE
+```
+
+## Authority
+
+`docs/architecture/task_system.md`, `task_queue.md`, `task_kind_registry.md`, `resource_governor.md`, `scheduler_resource_integration.md`.
+
+## CURRENT/FROZEN
+
+The current production Queue executes one active callback at a time. Reuse the existing Task -> Queue -> Resource Governor ownership model.
+
+Do not introduce:
+
+- a second scheduler;
+- a second production queue;
+- a generic executor;
+- an uncontrolled worker pool;
+- a parallel resource authority.
+
+General inter-Task parallelism remains deferred unless a future dependency and correctness proof requires it.
+
+Bounded internal parallelism within one admitted Task is allowed and expected when scientifically independent work exists and publication semantics remain deterministic.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/10_CAMERA_MODEL.md

@@ -0,0 +1,41 @@
+# 10 — Camera Model
+
+## Status
+
+```text
+CAMERA_MODEL_V1=FROZEN
+```
+
+## Authority
+
+`docs/architecture/sparse_sfm.md` and calibration contracts.
+
+## FROZEN
+
+Sparse SfM v1 is known-calibration only.
+
+The v1 model is binary64 pinhole with zero skew and OpenCV-compatible distortion:
+
+```text
+fx, fy, cx, cy
+k1, k2, p1, p2
+```
+
+or explicit zero distortion.
+
+Image coordinates: top-left origin, +x right, +y down.
+
+Camera frame: x right, y down, z forward.
+
+Pose is world-to-camera:
+
+```text
+Xc = R_cw * Xw + t_cw
+Cw = -transpose(R_cw) * t_cw
+```
+
+Higher-order lens models are outside this FROZEN v1 boundary unless separately authorized and scientifically contracted.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/11_OPTICS_ONBOARDING.md

@@ -0,0 +1,66 @@
+# 11 — Optics Onboarding
+
+## Status
+
+```text
+OPTICS_ONBOARDING=PLANNED
+```
+
+## Authority
+
+`docs/product/product_definition.md`; current v23 optical-context architecture and persistence remain authoritative.
+
+## REQUIRED_PRODUCT_TARGET
+
+```text
+NEW_CAMERA_REQUIRES_CODE_CHANGE=NO
+NEW_LENS_REQUIRES_CODE_CHANGE=NO
+ELECTRONIC_LENS_WITH_METADATA=SUPPORTED
+MANUAL_LENS_WITHOUT_EXIF=SUPPORTED
+MULTIPLE_LENSES_PER_CAMERA=SUPPORTED
+ZOOM_MULTIPLE_FOCALS=SUPPORTED
+MULTIPLE_OPTICAL_CONFIGURATIONS_PER_PROJECT=SUPPORTED
+SILENT_CALIBRATION_SUBSTITUTION=FORBIDDEN
+SILENT_LENS_IDENTITY_INFERENCE=FORBIDDEN
+OPTICS_TUI_WORKFLOW=REQUIRED
+PROFILE_IMPORT_EXPORT=REQUIRED
+OPTICS_PROFILE_ONBOARDING_TARGET<=5_MINUTES
+```
+
+The time target excludes physical calibration acquisition.
+
+Aliases must be exact and reviewable. Fuzzy metadata matching may assist discovery but may never silently create scientific identity.
+
+Profile import/export must be bounded and versioned, support preview/dry-run, reject incompatible required semantics, preserve identities, and never be implemented as a raw SQLite dump.
+
+
+## Portable profile encoding decision
+
+The v1 portable equipment-profile encoding is a single deterministic bounded binary container:
+
+```text
+OPTICS_PROFILE_PORTABLE_FORMAT=L3DOPRF1
+OPTICS_PROFILE_PORTABLE_VERSION=1
+BYTE_ORDER=LITTLE_ENDIAN
+NATIVE_STRUCT_SERIALIZATION=FORBIDDEN
+RAW_SQLITE_EXPORT=FORBIDDEN
+UNBOUNDED_JSON=FORBIDDEN
+```
+
+`L3DOPRF1` carries camera-body profiles, lens profiles, explicit aliases and optical configurations. All integers/floating-point fields use explicit fixed widths; variable UTF-8 strings and record arrays are length/count-prefixed and must have explicit hard maxima in the public format contract before parser implementation. Unknown required semantics or unsupported versions are rejected before database mutation.
+
+Calibration scientific payloads are not re-encoded as profile data. Portable calibrations remain exact `L3DCALB1` artifacts and continue through Calibration Bootstrap v1. The optics-profile import preview may report compatible/missing calibration requirements but may not synthesize or merge calibration.
+
+Import is two-phase:
+
+```text
+bounded parse + validation + conflict preview
+-> explicit human acceptance
+-> one failure-atomic database mutation
+```
+
+Conflicting profile identities are never silently merged.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/12_CALIBRATION.md

@@ -0,0 +1,62 @@
+# 12 — Calibration
+
+## Status
+
+```text
+CALIBRATION_SCIENCE_V1=PASS/FROZEN
+CALIBRATION_TOOLING_V1=PASS/FROZEN
+CALIBRATION_BOOTSTRAP_V1=PASS/FROZEN
+CALIBRATION_WORKFLOW=PLANNED
+```
+
+## Authority
+
+`docs/architecture/calibration_science_v1.md`, `docs/architecture/calibration_bootstrap.md` and `docs/architecture/calibration_solver_preflight_v1.md` are the current specialized calibration documents.
+
+At this checkpoint there is no `docs/architecture/calibration_tooling.md`. Calibration Tooling v1 is nevertheless an acquired PASS/FROZEN implementation boundary. For its exact current API/constant behavior, inspect the executable/public implementation authority, beginning with `include/lardon3d/calibration_tooling.h`, together with the lifecycle declarations in `README.md`, `docs/roadmap/roadmap.md` and `docs/product/product_definition.md`. Do not invent a missing documentation file or treat this prompt file as a replacement architecture specification.
+
+## CURRENT
+
+Historical S21 and A6000 Engine Bay campaigns:
+
+```text
+CALIBRATION_UNAVAILABLE
+BLOCKED_BY_KNOWN_CALIBRATION_DATA
+```
+
+Do not retro-calibrate them by invention.
+
+## FROZEN flow
+
+```text
+dedicated physical calibration acquisition
+-> external OpenCV 5.x solver
+-> Calibration Tooling v1
+-> deterministic L3DCALB1 v1
+-> Calibration Bootstrap v1
+-> exact optical assignment
+-> READY
+-> real Sparse SfM
+```
+
+## REQUIRED_PRODUCT_TARGET
+
+The TUI calibration assistant must expose:
+
+```text
+READY
+CALIBRATION_REQUIRED
+SELECTION_REQUIRED
+```
+
+It must guide physical evidence acquisition, exact optical configuration, accepted/rejected evidence and remaining evidence requirements.
+
+Solver exit success is never sufficient acceptance.
+
+## REJECTED
+
+Pseudo-calibration, EXIF calibration, nearby focal substitution, lens substitution, silent interpolation, silent backfill, and silent identity inference.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/13_SPARSE_SFM.md

@@ -0,0 +1,48 @@
+# 13 — Sparse SfM
+
+## Status
+
+```text
+SPARSE_SFM_V1=IMPLEMENTED
+GATE_A=DECISION/HISTORICAL
+GATE_B=PASS/FROZEN
+GATE_C=PASS/FROZEN
+GATE_D=PASS/FROZEN
+GATE_E=PASS/FROZEN
+GATE_F=PASS/FROZEN
+GATE_G=PASS/FROZEN
+```
+
+## Authority
+
+`docs/architecture/sparse_sfm.md` is the detailed authority.
+
+## FROZEN
+
+Sparse SfM consumes one exact immutable Track Set and one exact compatible known-calibration scope.
+
+It does not recover unknown intrinsics, infer metric scale, mutate Tracks, or merge unrelated campaigns.
+
+The production Task remains:
+
+```text
+sparse_sfm.run/1
+```
+
+Its FROZEN CPU1/BATCH1 execution is a specific validated Sparse v1 choice and must not be generalized to unrelated stages.
+
+## CURRENT
+
+```text
+REAL_S21_SPARSE_SFM=NOT_EXECUTED
+REAL_A6000_SPARSE_SFM=NOT_EXECUTED
+REAL_SPARSE_SFM_BLOCKER=KNOWN_CALIBRATION_DATA
+```
+
+## PLANNED
+
+Run a dedicated physically calibrated real campaign, reach `READY`, then execute the existing Sparse SfM path as a retained real proof. Do not use historical uncalibrated campaigns to bypass the calibration contract.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/14_MULTI_CAMPAIGN.md

@@ -0,0 +1,46 @@
+# 14 — Multi-Campaign Reconstruction
+
+## Status
+
+```text
+MULTI_CAMPAIGN_REGISTRATION=PLANNED
+MULTI_CAMPAIGN_FUSION=PLANNED
+RAW_PROJECT_MERGE_WITHOUT_REGISTRATION=REJECTED
+```
+
+## Authority
+
+`docs/product/product_definition.md`, Phase H documentation and reconstruction architecture.
+
+## FROZEN
+
+Phase H v1 is used only when its FROZEN lineage prerequisites are actually satisfied. It is not a generic merger of independent campaigns.
+
+## REQUIRED_PRODUCT_TARGET
+
+Independent campaigns such as separate S21 and A6000 reconstructions require:
+
+```text
+independent reconstruction A
++
+independent reconstruction B
+-> explicit registration
+-> durable transform
+-> registration quality/provenance
+-> explicit accepted alignment
+-> fusion/consolidation
+```
+
+Use rigid or similarity transform according to explicit scale knowledge.
+
+Campaign contribution and provenance must remain inspectable after alignment and fusion.
+
+Registration may use automatic overlap evidence and may offer explicit manual control-point assistance as a fallback. The registration algorithm, acceptance thresholds and quality policy are future science and must be versioned/validated before implementation.
+
+## REJECTED
+
+Naively combining independent Feature Sets, Tracks or reconstructions merely because they depict the same object.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/15_DENSE_MVS.md

@@ -0,0 +1,39 @@
+# 15 — Dense / MVS
+
+## Status
+
+```text
+MVS_M1=PASS/FROZEN
+DURABLE_DENSE_EXECUTION=PLANNED
+```
+
+## Authority
+
+`docs/architecture/reconstruction_pipeline.md` and the canonical MVS-M1 boundary documented there.
+
+## FROZEN
+
+OpenMVS is the first dense backend target. MVS-M1 defines the existing external OpenMVS v2.4.0 boundary.
+
+Do not begin by inventing a generic backend framework.
+
+## REQUIRED_PRODUCT_TARGET
+
+Dense execution must become:
+
+- durable;
+- restartable;
+- Resource-Governor controlled;
+- scratch-aware;
+- bounded;
+- cancellable;
+- failure-atomic;
+- inspectable in the TUI.
+
+Validate produced assets before publication. A zero external-process exit code is not sufficient proof.
+
+Dense failure must never invalidate the source Sparse Reconstruction.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/16_MESH_TEXTURE_EXPORT.md

@@ -0,0 +1,46 @@
+# 16 — Mesh, Refinement, Texture and Export
+
+## Status
+
+```text
+MESH_TEXTURE_EXPORT=PLANNED
+```
+
+## Authority
+
+`docs/product/product_definition.md` and future scoped architecture contracts created before implementation.
+
+## REQUIRED_PRODUCT_TARGET
+
+```text
+Dense
+-> mesh
+-> refinement
+-> texturing
+-> consolidation
+-> export
+```
+
+Every stage publishes an explicit immutable generation with provenance.
+
+Minimum target formats:
+
+```text
+point cloud: PLY
+mesh: PLY, OBJ
+textured mesh: OBJ + MTL + texture assets
+portable viewer/export: GLB/GLTF
+STL: optional
+```
+
+Export must preserve scale truth. Never label arbitrary monocular gauge units as millimetres or metres.
+
+Exports must carry a manifest or sidecar sufficient to identify the source reconstruction, mesh/texture generation and scale status.
+
+Consolidation selects an explicit user-facing result from immutable upstream generations. It does not delete those generations; selection remains explicit and reversible until deliberate cleanup.
+
+Intermediate external-tool artifacts must not become authoritative until validated and atomically published.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/17_TUI.md

@@ -0,0 +1,67 @@
+# 17 — TUI
+
+## Status
+
+```text
+TUI=PRIMARY_CONTROL_SURFACE
+USER_INTERFACE_LANGUAGE=ENGLISH
+```
+
+## Authority
+
+`AGENTS.md`, `README.md`, current TUI architecture and `docs/product/product_definition.md`.
+
+## CURRENT/FROZEN
+
+ncurses remains on its designated/main thread. Reuse the current business-logic / TUI / layout separation and current Queue/Project lifetime boundary.
+
+Validated sizing includes:
+
+```text
+full >=100x30
+reference compact 72x20
+minimum supported 60x15
+```
+
+Below minimum, render only the bounded terminal-too-small fallback.
+
+## REQUIRED_PRODUCT_TARGET
+
+The TUI progressively controls:
+
+- project;
+- acquisition;
+- optics;
+- calibration;
+- quality;
+- pipeline;
+- Tasks;
+- Governor;
+- SSD/scratch;
+- reconstructions;
+- viewer;
+- coverage;
+- capture guidance;
+- export;
+- diagnostics/help.
+
+Displayed actions and actual handlers must remain consistent.
+
+Diagnostics must distinguish at least:
+
+- scientific rejection;
+- invalid input;
+- missing prerequisite;
+- resource wait/throttle;
+- runtime failure;
+- corruption;
+- unsupported version/backend;
+- user cancellation.
+
+A generic unowned `failed` state is insufficient for final-product workflows.
+
+Remaining non-English executable UI text converges to English only in explicitly scoped implementation work.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/18_VIEWER.md

@@ -0,0 +1,50 @@
+# 18 — Viewer
+
+## Status
+
+```text
+VIEWER=PLANNED
+VIEWER_ROLE=PASSIVE_SNAPSHOT_CONSUMER
+VIEWER_CAN_BE_DISABLED=REQUIRED
+VIEWER_BLOCKS_ENGINE=NO
+```
+
+## Authority
+
+`docs/architecture/viewer.md` plus `docs/product/product_definition.md`.
+
+## REQUIRED_PRODUCT_TARGET
+
+The graphical viewer is required but does not replace the TUI.
+
+It never owns mutable scientific truth, Task scheduling or Resource Governor policy.
+
+It must be able to slow down, drop frames, close or crash without corrupting or blocking the engine.
+
+Target visualization includes:
+
+- sparse landmarks;
+- dense cloud;
+- mesh;
+- textured mesh;
+- registered cameras/frustums;
+- reconstruction components;
+- Track support;
+- reprojection diagnostics;
+- campaign/ScanSet contribution;
+- coverage heatmap;
+- weak/unseen areas and holes;
+- live camera pose;
+- suggested capture targets.
+
+Required interaction includes orbit/pan/zoom, reset/focus, element/region selection, camera selection, visibility toggles, diagnostic inspection, valid-scale measurement and region-of-interest selection for coverage/guidance.
+
+Visual snapshot buffering must remain bounded. When the viewer falls behind, obsolete snapshots are dropped rather than accumulated without bound.
+
+Viewer annotations do not silently become scientific input. They may enter science only through an explicit supported operation such as a future control-point registration workflow.
+
+Functional isolation is mandatory. A separate Unix process is allowed if it improves isolation without duplicating authority.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/19_LIVE_CAPTURE.md

@@ -0,0 +1,35 @@
+# 19 — Live Capture Foundation
+
+## Status
+
+```text
+LIVE_CAMERA_SOURCE=PLANNED
+```
+
+## Authority
+
+`docs/product/product_definition.md`; Capture/provenance contracts remain authoritative downstream.
+
+## REQUIRED_PRODUCT_TARGET
+
+Create one generic live-acquisition adapter boundary before device-specific integrations.
+
+An adapter may own:
+
+- discovery;
+- connection;
+- preview transport;
+- optional shutter/control;
+- metadata retrieval;
+- full-resolution file transfer;
+- disconnect/reconnect.
+
+It may not redefine scientific identities, calibration, Features, Tracks, reconstruction or resource accounting.
+
+Preview frames are ephemeral observations until explicitly promoted through the supported Capture/provenance path.
+
+Heavy reconstruction compute remains PC-side.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/20_A6000.md

@@ -0,0 +1,43 @@
+# 20 — Sony A6000
+
+## Status
+
+```text
+A6000_LIVE_INTEGRATION=PLANNED
+A6000_FIRMWARE_MODIFICATION=REJECTED
+A6000_HARDWARE_MODIFICATION=REJECTED
+```
+
+## Authority
+
+`docs/product/product_definition.md`.
+
+## REQUIRED_PRODUCT_TARGET
+
+The Sony A6000 remains stock.
+
+Primary live path:
+
+```text
+A6000 native HDMI
+-> external capture device
+-> Linux capture device (V4L2/UVC-class where available)
+-> Lardon3D live adapter
+-> viewer/localization/guidance
+```
+
+Discover actual capture-device capabilities; do not hard-code one USB capture card.
+
+USB may be used only for capabilities genuinely supported and verified: control, shutter, metadata and file transfer.
+
+Live preview correctness must not depend on USB control availability.
+
+If remote shutter is unavailable, on-camera capture followed by normal full-resolution ingestion remains valid.
+
+```text
+A6000_HEAVY_COMPUTE=PC_SIDE_ONLY
+```
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/21_S21.md

@@ -0,0 +1,31 @@
+# 21 — Samsung S21
+
+## Status
+
+```text
+S21_LIVE_INTEGRATION=PLANNED
+S21_ROOT_REQUIRED=NO
+```
+
+## Authority
+
+`docs/product/product_definition.md`.
+
+## REQUIRED_PRODUCT_TARGET
+
+The S21 uses a device-specific acquisition adapter only at the device/acquisition boundary.
+
+Required properties:
+
+- no root;
+- no scientific-core fork;
+- graceful disconnect/reconnect;
+- explicit full-resolution Capture ingestion;
+- preview frames remain ephemeral until promoted;
+- exact optical/calibration assignment for scientific use.
+
+The exact Android transport is deliberately deferred until implementation research proves the best supported mechanism.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/22_COVERAGE_ANALYSIS.md

@@ -0,0 +1,39 @@
+# 22 — Coverage Analysis
+
+## Status
+
+```text
+COVERAGE_ANALYSIS=PLANNED
+COVERAGE_SCIENCE=NOT_YET_FROZEN
+```
+
+## Authority
+
+`docs/product/product_definition.md` defines the product need; a separate versioned scientific contract is required before implementation.
+
+## REQUIRED_PRODUCT_TARGET
+
+Minimum classification:
+
+```text
+UNKNOWN
+UNSEEN
+WEAK
+ADEQUATE
+```
+
+Candidate evidence may include observation/view count, distinct camera count, angular diversity, parallax, incidence angle, camera distance, projected resolution, image quality, Feature/Track support, reprojection quality, triangulation quality, visibility/occlusion, dense/mesh evidence, hole/boundary evidence and campaign provenance.
+
+Coverage may operate on the complete meaningful reconstructed target surface or an explicit user-selected region of interest. A global `complete` claim is invalid when no meaningful target surface/ROI exists.
+
+Sparse-only coverage analysis is allowed only with an explicit lower-confidence/support boundary. Dense/mesh evidence may strengthen visibility and hole reasoning but must not retroactively falsify sparse uncertainty.
+
+## STOP
+
+Thresholds, weights, confidence computation and classification rules are science. Freeze and validate them before implementation.
+
+Never fabricate a closed surface from sparse points merely to claim that an area is covered.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/23_CAPTURE_GUIDANCE.md

@@ -0,0 +1,65 @@
+# 23 — Capture Guidance
+
+## Status
+
+```text
+CAPTURE_GUIDANCE=PLANNED
+AUTO_CAPTURE=IDEA
+```
+
+## Authority
+
+`docs/product/product_definition.md` and the future FROZEN coverage/localization contracts.
+
+## REQUIRED_PRODUCT_TARGET
+
+Guidance must transform a weakness into an actionable suggestion containing, where available:
+
+- target region;
+- suggested direction;
+- viewpoint/position zone;
+- angle;
+- distance;
+- baseline;
+- expected evidence improvement;
+- confidence;
+- reason.
+
+Target loop:
+
+```text
+existing reconstruction
+-> coverage analysis
+-> weak/unseen target
+-> live camera localization
+-> project target into live view
+-> guide operator
+-> operator acquires full-resolution capture
+-> normal ingestion
+-> normal incremental/re-registration scientific update as allowed by existing lineage contracts
+-> coverage refresh
+```
+
+Minimum live localization states:
+
+```text
+UNAVAILABLE
+SEARCHING
+LOCALIZED
+LOW_CONFIDENCE
+LOST
+```
+
+Never display a stale pose as current after tracking loss without an explicit stale/lost indication.
+
+Guidance must be actionable in operator terms where applicable: left/right/up/down, closer/farther, rotate toward/away from target, change incidence angle and change baseline.
+
+Weak/unseen semantics must not rely on color alone.
+
+When localization or coverage confidence is insufficient, do not assert a precise overlay or a certain `capture here` instruction. Fall back to a truthful search/diagnostic state.
+
+For v1, capture remains user-triggered.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/24_VIDEO_KEYFRAMES.md

@@ -0,0 +1,41 @@
+# 24 — Video and Deterministic Keyframes
+
+## Status
+
+```text
+VIDEO_INGESTION=PLANNED
+KEYFRAME_SCIENCE=NOT_YET_FROZEN
+```
+
+## Authority
+
+`docs/product/product_definition.md`.
+
+## REQUIRED_PRODUCT_TARGET
+
+Video is an acquisition source, not a second SfM pipeline.
+
+```text
+SOURCE video asset
+-> deterministic timeline/frame identity
+-> bounded deterministic keyframe extraction
+-> quality/blur/redundancy analysis
+-> explicit selected keyframes
+-> normal Capture/provenance
+-> existing scientific pipeline
+```
+
+Every retained keyframe must preserve:
+
+- source video asset identity;
+- exact frame/timestamp identity;
+- extraction algorithm/version;
+- parameter fingerprint.
+
+## STOP
+
+Define and validate the versioned keyframe scoring/selection science before implementation. Do not hide heuristic thresholds in unversioned code.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/25_SSD_SCRATCH.md

@@ -0,0 +1,44 @@
+# 25 — External SSD and Scratch
+
+## Status
+
+```text
+EXTERNAL_SSD_CONTROLLER=VALIDATED
+TASK_SCRATCH_CONSUMERS=PLANNED
+PROJECT_SCRATCH_OPT_IN=REQUIRED
+SWAP_OPT_IN=REQUIRED
+```
+
+## Authority
+
+Current SSD controller/resource documents and `docs/product/product_definition.md`.
+
+## REQUIRED_PRODUCT_TARGET
+
+Expose:
+
+- physical device identity;
+- mount state;
+- scratch state;
+- swap state;
+- capacity/usage;
+- active leases;
+- drain state;
+- safe-to-unplug state.
+
+Project scratch use is explicit opt-in. Swap enable/disable is also explicit user choice when supported by the validated controller. A newly connected device is never adopted automatically.
+
+Dense/mesh/refinement/texturing scratch consumers acquire storage only through the existing Governor-owned scratch lease boundary.
+
+```text
+SCRATCH!=RAM
+SWAP!=RAM
+```
+
+## REJECTED
+
+Automatic destructive repartitioning, formatting, destructive fsck, overwriting unknown filesystems, or force-unmounting an active lease.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/26_PERFORMANCE.md

@@ -0,0 +1,37 @@
+# 26 — Performance
+
+## Status
+
+```text
+PERFORMANCE_POLICY=MAXIMUM_SAFE_USEFUL_THROUGHPUT
+```
+
+## Authority
+
+`AGENTS.md`, resource-governor and internal-parallelism documents, plus measured tranche-specific evidence.
+
+## REQUIRED
+
+Performance work is evidence-driven and must preserve science, identity, publication order and boundedness.
+
+Use host-aware build/test parallelism and Governor-aware production execution.
+
+Do not freeze reference-host values such as `12` CPUs, `-j8`, a historic batch size, or `--num-processes 1` as universal policy.
+
+A long serial path with independent work and safe idle resources is a defect unless there is concrete proof of:
+
+- true dependency/scientific serialism;
+- useful-scaling knee;
+- memory bound/pressure;
+- I/O saturation;
+- validated GPU execution;
+- unavoidable deterministic publication constraint;
+- another measured bottleneck.
+
+Validated useful GPU backends are preferred automatically when eligible. Backend failure/fallback behavior must be explicit where the scientific stage supports fallback; do not silently change scientific identity.
+
+Optimize useful throughput, not utilization graphs.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/27_TESTS_VALIDATION.md

@@ -0,0 +1,35 @@
+# 27 — Tests and Validation
+
+## Status
+
+```text
+VALIDATION_STRATEGY=DELTA_BASED
+```
+
+## Authority
+
+`docs/development/testing.md`, `AGENTS.md`, global-maintenance evidence and specialized architecture documents.
+
+## REQUIRED
+
+Unchanged PASS/FROZEN boundaries inherit retained evidence unless the delta touches their assumptions.
+
+For unchanged globally reviewed foundations, the retained maintenance baseline is tag `global-maintenance-2026-09-01`; the later `real-a6000-pre-sfm-2026-09-02` checkpoint adds real-data evidence without replacing the maintenance authority. Use the relevant delta rather than replaying a global audit.
+
+For each tranche:
+
+1. identify changed contracts;
+2. build with safe host-aware parallelism;
+3. run focused unit/integration tests;
+4. run relevant persistence/restart/resource/concurrency checks;
+5. use ASan/UBSan and TSan only where applicable and preserve documented third-party qualifications;
+6. validate real-data only when the tranche explicitly requires it and use non-destructive copies/workspaces;
+7. run `git diff --check`.
+
+Do not claim blanket TSan validity for Vulkan unless explicitly proven.
+
+Do not rerun full historical A-to-Z qualification merely for confidence theater.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/28_DOCUMENTATION_COMMENTS.md

@@ -0,0 +1,40 @@
+# 28 — Documentation and Comments
+
+## Status
+
+```text
+DOCUMENTATION_LANGUAGE=ENGLISH
+SOURCE_COMMENT_LANGUAGE=ENGLISH
+```
+
+## Authority
+
+`AGENTS.md` repository language policy.
+
+## REQUIRED
+
+Current repository technical prose and production source comments converge on English.
+
+Comments should document mainly:
+
+- why;
+- contract;
+- invariant;
+- ownership/lifetime;
+- identity;
+- persistence ordering;
+- restart;
+- cancellation;
+- concurrency;
+- resource accounting;
+- FROZEN boundaries.
+
+Do not comment obvious statements line by line.
+
+Historical documents may be translated, but translation must not silently modernize their lifecycle, schema version, identities, numbers, evidence or conclusions.
+
+This prompt tree must not become a duplicate shadow architecture. Reference canonical documents and restate only execution-critical invariants.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/29_AGENT_ROUTING.md

@@ -0,0 +1,32 @@
+# 29 — Agent Routing
+
+## Status
+
+```text
+AGENT_ARCHITECTURE=IMPLEMENTATION_NEUTRAL
+```
+
+## Authority
+
+`AGENTS.md` and this collective prompt contract.
+
+## REQUIRED
+
+This contract must work with:
+
+- one coding agent;
+- Codex;
+- ChatGPT plus a coding agent;
+- future compatible coding agents.
+
+The primary executing agent owns tranche coherence.
+
+Sub-agents are optional and may be used only when they reduce cost/time without losing scope control, authority awareness or validation quality.
+
+Do not create agent hierarchies for appearance.
+
+For Codex specifically: read the entire prompt tree before major implementation, use `main`, do not choose historical branches, do not treat the two remotes as separate projects, and return only after complete scoped work or a real STOP.
+
+## Canonical-reference rule
+
+When implementation enters this area, read the cited canonical document in full before editing. If this prompt summary and the canonical document appear to conflict, do not silently choose the shorter text: determine whether this file is stale or whether a real contract contradiction exists, then apply the STOP rules where necessary.

prompt/30_GIT_SCOPE_STOP.md

@@ -0,0 +1,58 @@
+# 30 — Git, Scope and STOP
+
+## Status
+
+```text
+GIT_CLOSURE_OWNER=HUMAN
+PROTECTED_SCOPE=scan3d/
+```
+
+## Authority
+
+`AGENTS.md` and explicit human ticket scope.
+
+## Git rules
+
+Without explicit human authorization, do not:
+
+- stage;
+- commit;
+- push;
+- create/switch branches or continue development from a detached historical tag/checkpoint;
+- merge;
+- rebase;
+- reset;
+- restore;
+- stash;
+- clean;
+- amend;
+- force a Git operation.
+
+Never use `git add -A`.
+
+If Git closure is explicitly authorized, stage only exact tranche paths and synchronize both mirrors as a pair unless the human explicitly says otherwise.
+
+## Protected scope
+
+- do not modify `scan3d/`;
+- do not modify other repositories;
+- do not use retained real scientific projects destructively.
+
+## STOP conditions
+
+STOP before:
+
+- reopening PASS/FROZEN;
+- changing FROZEN science/identity;
+- pseudo-calibration;
+- unauthorized DB schema or Task Kind;
+- unnecessary generic runtime/backend subsystem;
+- destructive operations;
+- protected-scope edits;
+- unauthorized branch operations;
+- force push;
+- unilateral mirror overwrite;
+- real contradiction between executable code/schema and canonical contract;
+- material unresolved product ambiguity.
+
+Difficulty alone is not a STOP condition.

prompt/31_IMPLEMENTATION_ORDER.md

@@ -0,0 +1,43 @@
+# 31 — Implementation Order
+
+## Status
+
+```text
+IMPLEMENTATION_ORDER=DEPENDENCY_DRIVEN
+IMPLEMENTATION_AUTHORIZATION=NO
+```
+
+## Authority
+
+`docs/product/product_definition.md`, current roadmap and dependencies confirmed on current `main`.
+
+## PLANNED ORDER
+
+Implementation remains unauthorized until the human explicitly authorizes a tranche.
+
+Default dependency order:
+
+0. remaining repository/UI language normalization where appropriate;
+1. final usable calibration workflow;
+2. dedicated physical calibrated real campaign;
+3. real Sparse SfM proof;
+4. durable Dense/OpenMVS orchestration;
+5. mesh / refinement / texturing / export;
+6. viewer foundation;
+7. offline Coverage Analysis scientific contract and implementation;
+8. multi-campaign registration / fusion;
+9. generic live acquisition adapter foundation;
+10. A6000 HDMI integration;
+11. S21 integration;
+12. live camera localization;
+13. live coverage overlay;
+14. actionable Capture Guidance;
+15. video ingestion / deterministic keyframes;
+16. final integration, UX, restart and performance proof;
+17. Product Definition v1 Definition-of-Done closure.
+
+## Adjustment rule
+
+Change this order only when current repository inspection proves a real dependency difference. Preserve product intent and document the dependency.
+
+Do not jump to A6000 live work merely because it is visually interesting. Reconstruction/viewer/coverage foundations required for truthful guidance come first.

prompt/32_FEATURE_BACKLOG.md

@@ -0,0 +1,57 @@
+# 32 — Feature Backlog
+
+## Status
+
+```text
+BACKLOG_CLASSIFICATION=REQUIRED
+```
+
+## Authority
+
+`docs/product/product_definition.md` and this execution contract.
+
+## REQUIRED_V1
+
+- data-driven camera/lens onboarding;
+- manual lens support;
+- zoom/multi-focal configurations;
+- profile import/export;
+- usable calibration workflow;
+- real calibrated Sparse SfM;
+- durable Dense/OpenMVS;
+- mesh/refinement/texturing/export;
+- graphical viewer;
+- offline coverage;
+- multi-campaign registration/fusion where required;
+- generic live adapter;
+- stock A6000 HDMI integration;
+- S21 integration without root;
+- live localization;
+- live coverage overlay;
+- actionable capture guidance;
+- deterministic video keyframes;
+- restart/recovery;
+- safe useful resource utilization;
+- optional SSD scratch lifecycle.
+
+## OPTIONAL_FUTURE / DEFERRED
+
+```text
+AUTO_CAPTURE
+MULTI_GPU
+DISTRIBUTED_COMPUTE
+GENERAL_INTER_TASK_DAG
+GENERIC_BACKEND_FRAMEWORK
+CLOUD_RECONSTRUCTION
+```
+
+## REJECTED
+
+```text
+CAMERA_FIRMWARE_MODIFICATION
+CAMERA_HARDWARE_MODIFICATION
+SILENT_CALIBRATION_SUBSTITUTION
+SILENT_LENS_IDENTITY_INFERENCE
+```
+
+An IDEA or OPTIONAL item never becomes v1 scope because an agent prefers it.

prompt/33_DEFINITION_OF_DONE.md

@@ -0,0 +1,61 @@
+# 33 — Definition of Done
+
+## Status
+
+```text
+PRODUCT_DONE=OBJECTIVE_EVIDENCE_REQUIRED
+```
+
+## Authority
+
+`docs/product/product_definition.md` and all specialized FROZEN contracts.
+
+## Final objective evidence
+
+Lardon3D v1 is complete only when retained evidence demonstrates all of the following:
+
+- ordinary new camera-body onboarding requires no code change;
+- ordinary new-lens onboarding requires no code change;
+- manual lens without EXIF is supported;
+- zoom/multiple focal optical configurations are supported;
+- profile import/export is bounded, versioned and conflict-safe;
+- calibration workflow reaches truthful `READY`;
+- a dedicated calibrated real campaign completes real Sparse SfM;
+- Dense/OpenMVS execution is durable, restartable and failure-atomic;
+- mesh generation works;
+- refinement works;
+- texturing works;
+- interoperable exports are traceable;
+- arbitrary monocular scale is never mislabeled metric;
+- viewer displays sparse evidence;
+- viewer displays dense evidence;
+- viewer displays mesh;
+- viewer displays textured mesh;
+- registered cameras/frustums and components are inspectable;
+- viewer can be disabled, lag or close/crash without corrupting or blocking the engine;
+- offline Coverage Analysis classifies `UNKNOWN/UNSEEN/WEAK/ADEQUATE` with versioned validated science and confidence;
+- the system produces an actionable supplementary viewpoint;
+- live localization exposes truthful confidence and loss;
+- stock Sony A6000 works through native HDMI capture without camera modification;
+- a supplementary full-resolution capture returns through the normal provenance/scientific pipeline;
+- S21 integration requires no root and does not fork the scientific core;
+- independent multi-campaign reconstruction can produce an explicit durable registration transform with quality/provenance and accepted fusion without raw Feature/Track merging;
+- video ingestion produces deterministic bounded keyframes traceable to exact source timeline identity, algorithm/version and parameter fingerprint before normal Capture ingestion;
+- restart/recovery works across long-running stages;
+- safe useful CPU/GPU execution is demonstrated on representative hardware;
+- optional SSD scratch has complete lease/drain/safe-unplug lifecycle when used and swap remains explicit opt-in;
+- project portability does not depend on temporary paths, current hardware topology/device IDs, scratch mount path, live-device connection, process ID or worker instance;
+- core workflows remain local-first with no required cloud upload;
+- cleanup previews destructive removals and never automatically deletes FROZEN/historical evidence;
+- user-visible diagnostics distinguish scientific rejection, invalid input, missing prerequisite, resource wait/throttle, runtime failure, corruption, unsupported version/backend and cancellation;
+- no calibration, lens, scale, campaign relationship or provenance is invented;
+- historical identities and PASS/FROZEN checkpoints remain interpretable;
+- documentation and TUI behavior match the acquired product state.
+
+## Not sufficient
+
+The product is not done merely because it compiles, unit tests pass, Sparse SfM exists, OpenMVS can be launched manually, or a mesh can be produced by hand.
+
+## Closure
+
+Final closure requires a delta-based validation report showing how every REQUIRED_V1 item above is satisfied or explicitly identifying any remaining blocker. Only then may `PRODUCT_DEFINITION_V1` product implementation be considered fulfilled.