diff --git a/apps/control-station/test/k1SupervisorPresentation.test.mjs b/apps/control-station/test/k1SupervisorPresentation.test.mjs
index d23cb45..b26c255 100644
--- a/apps/control-station/test/k1SupervisorPresentation.test.mjs
+++ b/apps/control-station/test/k1SupervisorPresentation.test.mjs
@@ -17,6 +17,7 @@ let physicalRecoveryConnectionDetail;
 let shouldRenderK1OperationalPanels;
 let K1ProvisioningPipeline;
 let RuntimeActionFenceTestContext;
+let LOCAL_OPERATION_PROGRESS_DELAY_MILLISECONDS;
 let emptySearchPresentation;
 let emptyProvisioningAttemptPresentation;
 let emptyReadOnlyReconnectPresentation;
@@ -127,6 +128,7 @@ before(async () => {
   ({
     K1ProvisioningPipeline,
     RuntimeActionFenceTestContext,
+    LOCAL_OPERATION_PROGRESS_DELAY_MILLISECONDS,
     emptySearchPresentation,
     emptyProvisioningAttemptPresentation,
     emptyReadOnlyReconnectPresentation,
@@ -3245,6 +3247,7 @@ test("replay and local-only stop branches use bounded process copy", () => {
 
   const stopState = runtimeState();
   stopState.compatibility.vendor_writes_enabled = false;
+  stopState.acquisition.control_mode = "operator-manual";
   stopState.connection_policy = {
     schema_version: "missioncore.xgrids-k1-connection-policy/v1",
     facts: { retained_context_is_presence: false },
@@ -3272,7 +3275,68 @@ test("replay and local-only stop branches use bounded process copy", () => {
   assertCanonicalConnectionCopy(stopMarkup);
 });
 
-test("physical STOP is fail-closed and both acquisition surfaces fall back to local cleanup", () => {
+test("software-commanded calibration exposes no teardown until canonical STOP is safe", () => {
+  const state = runtimeState();
+  state.snapshot_runtime_id = "runtime-calibration-001";
+  state.snapshot_revision = 31;
+  state.phase = "starting_live";
+  state.source_mode = "live";
+  state.acquisition.state = "awaiting_external_start";
+  state.acquisition.state_revision = 3;
+  state.application_control_session = {
+    session_generation: 5,
+    state_revision: 7,
+    state: "device-initializing",
+    can_stop: false,
+    control_socket_open: true,
+  };
+  state.connection_policy = {
+    schema_version: "missioncore.xgrids-k1-connection-policy/v1",
+    facts: { retained_context_is_presence: false },
+    allowed_actions: ["stop-local-receiver"],
+    actions: {
+      "stop-acquisition": {
+        allowed: false,
+        reason_codes: ["supervisor-action-not-allowed"],
+        target_source: "connection-supervisor",
+        required_transport_ref: null,
+        required_connection_mode: null,
+        requires_live_gatt_validation: false,
+        automatic_retry: false,
+      },
+      "stop-local-receiver": {
+        allowed: true,
+        reason_codes: [],
+        target_source: "local-runtime",
+        required_transport_ref: null,
+        required_connection_mode: null,
+        requires_live_gatt_validation: false,
+        automatic_retry: false,
+      },
+    },
+  };
+
+  const pipelineMarkup = renderToStaticMarkup(createElement(K1AcquisitionPipeline, {
+    controller: acquisitionController(state),
+    desiredConnectionMode: "bridge",
+    openSpatialScene() {},
+    activateAutomaticSpatialSource() {},
+  }));
+  const spatialMarkup = renderToStaticMarkup(createElement(K1SpatialControlsView, {
+    controller: acquisitionController(state),
+  }));
+
+  assert.match(pipelineMarkup, /Кнопка остановки появится только после подтверждённого SCANNING/);
+  assert.match(spatialMarkup, /K1 калибруется и готовит облако точек/);
+  for (const markup of [pipelineMarkup, spatialMarkup]) {
+    assert.equal(buttonMarkupWithText(markup, "Завершить локальный приём").length, 0);
+    assert.equal(buttonMarkupWithText(markup, "Аварийно завершить локальный приём").length, 0);
+    assert.equal(buttonMarkupWithText(markup, "Остановить устройство и запись").length, 0);
+    assert.equal(buttonMarkupWithText(markup, "Отменить запуск до START").length, 0);
+  }
+});
+
+test("physical STOP is fail-closed across both acquisition surfaces", () => {
   const state = runtimeState();
   state.snapshot_runtime_id = "runtime-stop-001";
   state.snapshot_revision = 40;
@@ -3442,13 +3506,15 @@ test("physical STOP is fail-closed and both acquisition surfaces fall back to lo
     },
   ));
   assert.doesNotMatch(dismissedFailureMarkup, /Остановить устройство и запись/);
-  assert.match(dismissedFailureMarkup, /Повторная команда устройству не отправляется/);
   const localButtons = buttonMarkupWithText(
     dismissedFailureMarkup,
     "Завершить локальный приём",
   );
-  assert.equal(localButtons.length, 1);
-  assert.doesNotMatch(localButtons[0], /\bdisabled(?:=|\s|>)/);
+  assert.equal(localButtons.length, 0);
+  assert.match(
+    dismissedFailureMarkup,
+    /Повторная команда и локальное завершение заблокированы/,
+  );
   assertCanonicalConnectionCopy(dismissedFailureMarkup);
 
   const classifiedStopState = structuredClone(state);
@@ -3485,7 +3551,11 @@ test("physical STOP is fail-closed and both acquisition surfaces fall back to lo
       activateAutomaticSpatialSource() {},
     },
   ));
-  assert.match(localCleanupPendingMarkup, /Завершение локального приёма…/);
+  assert.doesNotMatch(localCleanupPendingMarkup, /Завершение локального приёма…/);
+  assert.match(
+    localCleanupPendingMarkup,
+    /Повторная команда и локальное завершение заблокированы/,
+  );
   assert.doesNotMatch(localCleanupPendingMarkup, /Остановка устройства…/);
 
   const physicalStopPendingMarkup = renderToStaticMarkup(createElement(
@@ -5802,6 +5872,78 @@ test("physical recovery new-device action performs only an explicit scenario res
   assert.equal(reopenCalls, 0);
 });
 
+test("topology switch stays silent for two seconds and then uses only the inline loader", async () => {
+  const state = terminalConnectionRecoveryState();
+  state.connection_attempt = null;
+  let resolveReset;
+  const resetSettlement = new Promise((resolve) => {
+    resolveReset = resolve;
+  });
+  const resetRequests = [];
+  const controller = {
+    ...provisioningController(state),
+    selectConnectionMode: (request) => {
+      resetRequests.push(request);
+      return resetSettlement;
+    },
+  };
+  const props = {
+    controller,
+    desiredMode: "bridge",
+    onDesiredModeChange: () => undefined,
+  };
+  const originalSetTimeout = globalThis.setTimeout;
+  const originalClearTimeout = globalThis.clearTimeout;
+  const timers = [];
+  globalThis.setTimeout = (callback, delay, ...args) => {
+    const timer = { callback, delay, args, cleared: false };
+    timers.push(timer);
+    return timer;
+  };
+  globalThis.clearTimeout = (timer) => {
+    timer.cleared = true;
+  };
+  const harness = createStatefulProvisioningHarness(props);
+  try {
+    let tree = harness.render();
+    harness.flushEffects();
+    const modeSelect = elementByProp(tree, "label", "Способ подключения");
+    assert.ok(modeSelect);
+    modeSelect.props.onChange("quick-connect");
+    assert.equal(resetRequests.length, 1);
+
+    tree = harness.render();
+    harness.flushEffects();
+    let markup = renderToStaticMarkup(tree);
+    assert.doesNotMatch(markup, /Переключаем способ подключения/);
+    assert.doesNotMatch(markup, /Завершение прежней локальной границы/);
+    const progressTimer = timers.find(
+      (timer) => timer.delay === LOCAL_OPERATION_PROGRESS_DELAY_MILLISECONDS,
+    );
+    assert.ok(progressTimer);
+    assert.equal(progressTimer.cleared, false);
+
+    progressTimer.callback(...progressTimer.args);
+    tree = harness.render();
+    markup = renderToStaticMarkup(tree);
+    assert.match(markup, /Переключаем способ подключения/);
+    assert.match(markup, /connection-action-progress/);
+    assert.doesNotMatch(markup, /dialog|modal|window/i);
+
+    resolveReset(true);
+    await Promise.resolve();
+    await Promise.resolve();
+    tree = harness.render();
+    harness.flushEffects();
+    markup = renderToStaticMarkup(tree);
+    assert.doesNotMatch(markup, /Переключаем способ подключения/);
+  } finally {
+    harness.dispose();
+    globalThis.setTimeout = originalSetTimeout;
+    globalThis.clearTimeout = originalClearTimeout;
+  }
+});
+
 test("physical retirement dispatch refuses a rendered runtime A after runtime B is current", async () => {
   let currentRuntimeId = "runtime-B";
   let mutationRequests = 0;
@@ -6360,7 +6502,7 @@ test("unknown and cold durable recovery offer one reconnect and one new-device p
       ...provisioningController(coldQuickState),
       getConnectionRecoveryObservationTarget: () => coldQuickTarget,
     },
-    desiredMode: "bridge",
+    desiredMode: "quick-connect",
   });
   const coldQuickReconnect = buttonMarkupWithText(
     coldQuickMarkup,
@@ -6374,6 +6516,32 @@ test("unknown and cold durable recovery offer one reconnect and one new-device p
   );
   assert.match(coldQuickMarkup, /Quick Connect/);
 
+  const quickTargetInsideBridgeMarkup = renderProvisioning({
+    controller: {
+      ...provisioningController(coldQuickState),
+      getConnectionRecoveryObservationTarget: () => coldQuickTarget,
+    },
+    desiredMode: "bridge",
+  });
+  assert.equal(
+    buttonMarkupWithText(
+      quickTargetInsideBridgeMarkup,
+      "Переподключиться",
+    ).length,
+    0,
+  );
+  assert.equal(
+    buttonMarkupWithText(
+      quickTargetInsideBridgeMarkup,
+      "Найти по Bluetooth",
+    ).length,
+    1,
+  );
+  assert.doesNotMatch(
+    quickTargetInsideBridgeMarkup,
+    /Сохранённое подключение/,
+  );
+
   const unrelatedMarkup = renderProvisioningWithAttempt({
     controller: {
       ...controller,
@@ -6385,6 +6553,41 @@ test("unknown and cold durable recovery offer one reconnect and one new-device p
   assert.match(unrelatedMarkup, /Сохранённое подключение/);
 });
 
+test("saved Bridge reconnect stays hidden in a fresh Quick Connect draft", () => {
+  const state = terminalConnectionRecoveryState();
+  state.connection_attempt = null;
+  const bridgeTarget = recommendedConnectionRecoveryObservationTarget(state);
+  assert.equal(bridgeTarget?.connectionMode, "bridge");
+  const controller = {
+    ...provisioningController(state),
+    getConnectionRecoveryObservationTarget: () => bridgeTarget,
+  };
+
+  const quickConnectMarkup = renderProvisioning({
+    controller,
+    desiredMode: "quick-connect",
+  });
+  assert.equal(
+    buttonMarkupWithText(quickConnectMarkup, "Переподключиться").length,
+    0,
+  );
+  assert.equal(
+    buttonMarkupWithText(quickConnectMarkup, "Найти по Bluetooth").length,
+    1,
+  );
+  assert.doesNotMatch(quickConnectMarkup, /Сохранённое подключение/);
+
+  const bridgeMarkup = renderProvisioning({
+    controller,
+    desiredMode: "bridge",
+  });
+  assert.equal(
+    buttonMarkupWithText(bridgeMarkup, "Переподключиться").length,
+    1,
+  );
+  assert.match(bridgeMarkup, /Сохранённое подключение/);
+});
+
 test("read-only reconnect keeps its card and loader across a transient projection", async () => {
   const initialState = terminalConnectionRecoveryState();
   initialState.connection_attempt = null;
diff --git a/docs/04_K1_WIFI_PROVISIONING_PROFILE.md b/docs/04_K1_WIFI_PROVISIONING_PROFILE.md
index fa95b66..758b02e 100644
--- a/docs/04_K1_WIFI_PROVISIONING_PROFILE.md
+++ b/docs/04_K1_WIFI_PROVISIONING_PROFILE.md
@@ -96,6 +96,15 @@ Core Quick Connect intent emits one AP-enable frame even when the baseline mode
 already says `WIFI_AP`, then polls for the byte-51 ready flag for at most 15
 seconds. It never retries the device write automatically.
 
+For that exact explicit intent, a completed write-with-response followed by
+the same canonical `WIFI_AP / 192.168.56.1 / ready` observation is an
+idempotent ensure-target success: the K1 AP was already ready, and the host may
+continue into the bounded exact-SSID CoreWLAN association. This exception
+requires the durable ledger to record `write_confirmed=true`. An unconfirmed
+dispatch, a timeout, or an unchanged read-only observation without that exact
+confirmed write remains ambiguous and cannot authorize host association or an
+automatic retry.
+
 Static review of the original client also established a lifecycle requirement:
 LixelGO keeps the same BLE manager connected after AP-ready and invokes native
 Wi-Fi association from that live session. Mission Core now retains the same
diff --git a/docs/adr/0013-k1-local-connection-matrix.md b/docs/adr/0013-k1-local-connection-matrix.md
index d8f84b7..37b2de9 100644
--- a/docs/adr/0013-k1-local-connection-matrix.md
+++ b/docs/adr/0013-k1-local-connection-matrix.md
@@ -163,6 +163,13 @@ contract coverage but remains a distinct physical acceptance gate; it must not
 be reported as field-accepted until one redacted live run records both sides of
 the transition.
 
+Quick Connect Apply is an exact idempotent ensure-target operation when the
+selected K1 already reports the canonical AP-ready state. Mission Core accepts
+that unchanged state only after the one reviewed write-with-response is
+durably confirmed, then performs the normal exact device-SSID host association.
+An unconfirmed or merely read-only unchanged observation remains fail-closed;
+this rule neither retries the BLE write nor weakens Bridge admission.
+
 The corrected host boundary derives a non-secret, device-scoped profile ID from
 the selected SSID. The reviewed client contains per-device `WiFiAP_SSID` and
 `WiFiAP_Password` fields, but the 2026-07-20 review of the exact official K1
diff --git a/plugins/xgrids-k1/frontend/src/api.ts b/plugins/xgrids-k1/frontend/src/api.ts
index 6ad1963..0ac088a 100644
--- a/plugins/xgrids-k1/frontend/src/api.ts
+++ b/plugins/xgrids-k1/frontend/src/api.ts
@@ -1036,6 +1036,16 @@ export interface XgridsK1State {
     network_write_performed: false;
     automatic_scan: false;
     operation_sequence: number;
+    timing?: {
+      schema_version: "missioncore.xgrids-k1-connection-scenario-reset-timing/v1";
+      started_at_utc: string;
+      completed_at_utc: string;
+      total_ms: number;
+      lifecycle_boundary_wait_ms: number;
+      monitor_quiescence_wait_ms: number;
+      local_retirement_ms: number;
+      intent_commit_ms: number;
+    };
   } | null;
   connection_scenario_reset_pending?: {
     reset_id: string;
diff --git a/plugins/xgrids-k1/frontend/src/components/K1AcquisitionPipeline.tsx b/plugins/xgrids-k1/frontend/src/components/K1AcquisitionPipeline.tsx
index 345a69e..39f68de 100644
--- a/plugins/xgrids-k1/frontend/src/components/K1AcquisitionPipeline.tsx
+++ b/plugins/xgrids-k1/frontend/src/components/K1AcquisitionPipeline.tsx
@@ -207,9 +207,16 @@ export function K1AcquisitionPipeline({
     && canIssueCanonicalStop(state, physicalStopIntentSpent),
   );
   const physicalStopPresented = physicalStopInFlight || physicalStopExecutable;
+  const protectedSoftwareCommandedTransition = Boolean(
+    activeAcquisition
+    && activeAcquisition.control_mode === "plugin-commanded"
+    && activeAcquisition.state !== "prepared"
+    && !isTerminalAcquisitionState(activeAcquisition.state),
+  );
   const localReceiverStopExecutable = Boolean(
     connectionPolicyAllows(state, "stop-local-receiver")
-    && preparedAcquisition === null,
+    && preparedAcquisition === null
+    && !protectedSoftwareCommandedTransition,
   );
   const terminalPhysicalStopPending = terminalPhysicalStopObserved
     && physicalStopInFlight;
@@ -306,6 +313,10 @@ export function K1AcquisitionPipeline({
         : "Управляющая команда устройству сейчас недоступна. Завершите только разрешённый сервером локальный приём или выполните read-only восстановление."
     : terminalReadOnlyRecovery
       ? "Управляющие действия сейчас не разрешены. Дождитесь нового подтверждённого состояния или выполните read-only восстановление."
+    : protectedSoftwareCommandedTransition && !physicalStopPresented
+      ? physicalStopIntentSpent
+        ? "Команда остановки уже была принята интерфейсом. Повторная команда и локальное завершение заблокированы до нового подтверждённого состояния K1."
+        : "K1 выполняет переход к сканированию. Кнопка остановки появится только после подтверждённого SCANNING."
     : physicalStopGuidance
       ? `${physicalStopGuidance.reason} ${physicalStopGuidance.nextAction}`
     : gracefulStopTarget && !physicalStopPresented && physicalStopIntentSpent
@@ -572,7 +583,7 @@ export function K1AcquisitionPipeline({
               : physicalStopPresented ? recoveredPhysicalStop ? "Остановить сканирование" : "Остановить устройство и запись" : state?.source_mode === "replay" ? "Остановить повтор" : preparedAcquisition ? "Завершить подготовленный приём" : "Завершить локальный приём"}
           </Button>
         ) : null}
-        {activeAcquisition ? (
+        {activeAcquisition && !protectedSoftwareCommandedTransition ? (
           <Button variant="ghost" disabled={isBusy} onClick={() => void abort()}>
             {pendingAction === "abort" ? "Прерываем локальную операцию…" : preparedAcquisition ? "Отменить подготовку" : "Аварийно завершить локальный приём"}
           </Button>
diff --git a/plugins/xgrids-k1/frontend/src/components/K1ProvisioningPipeline.tsx b/plugins/xgrids-k1/frontend/src/components/K1ProvisioningPipeline.tsx
index 1ba00d8..f91325a 100644
--- a/plugins/xgrids-k1/frontend/src/components/K1ProvisioningPipeline.tsx
+++ b/plugins/xgrids-k1/frontend/src/components/K1ProvisioningPipeline.tsx
@@ -100,6 +100,31 @@ export function emptyReadOnlyReconnectPresentation():
   return null;
 }
 
+export const LOCAL_OPERATION_PROGRESS_DELAY_MILLISECONDS = 2_000;
+
+/**
+ * Keep short local lifecycle settlements visually silent. Safety interlocks
+ * still take effect immediately; only the progress presentation is deferred.
+ */
+export function useDelayedLocalOperationProgress(
+  active: boolean,
+  delayMilliseconds = LOCAL_OPERATION_PROGRESS_DELAY_MILLISECONDS,
+): boolean {
+  const [visible, setVisible] = useState(false);
+  useEffect(() => {
+    if (!active) {
+      setVisible(false);
+      return undefined;
+    }
+    const timer = globalThis.setTimeout(
+      () => setVisible(true),
+      delayMilliseconds,
+    );
+    return () => globalThis.clearTimeout(timer);
+  }, [active, delayMilliseconds]);
+  return active && visible;
+}
+
 export interface PhysicalReopenPresentation {
   key: string;
   snapshotRuntimeId: string;
@@ -1240,6 +1265,9 @@ export function K1ProvisioningPipeline({
     targetMode: ConnectionMode;
   } | null>(null);
   const modeResetInFlight = pendingAction === "mode" || modeResetPending !== null;
+  const modeResetProgressVisible = useDelayedLocalOperationProgress(
+    modeResetInFlight,
+  );
   const [selectedDeviceSnapshot, setSelectedDeviceSnapshot] = useState<BleDevice | null>(null);
   const [ssid, setSsid] = useState("");
   const [password, setPassword] = useState("");
@@ -1657,7 +1685,8 @@ export function K1ProvisioningPipeline({
       ? readOnlyReconnectPresentation
       : null;
   const connectionRecoveryVerificationPending =
-    currentReadOnlyReconnectPresentation?.kind === "connection";
+    currentReadOnlyReconnectPresentation?.kind === "connection"
+    && currentReadOnlyReconnectPresentation.connectionMode === connectionMode;
   const physicalRecoveryVerificationPending =
     currentReadOnlyReconnectPresentation?.kind === "physical";
   const provisioningMutationBusy = Boolean(
@@ -1796,7 +1825,7 @@ export function K1ProvisioningPipeline({
     state,
     connectionMode,
   );
-  const connectionRecoveryTarget = !physicalRecoveryRequired
+  const recommendedConnectionRecoveryTarget = !physicalRecoveryRequired
     && !unresolvedAppliedAttempt
     && !selectedModeConnected
     && !reconfigurationActive
@@ -1804,6 +1833,13 @@ export function K1ProvisioningPipeline({
     && connectionRecoveryObservationAllowed
       ? recommendedConnectionRecoveryObservationTarget(state)
       : null;
+  // A durable recovery target remains available when the operator returns to
+  // its mode, but it must never leak a Bridge reconnect action into a freshly
+  // selected Quick Connect draft (or vice versa).
+  const connectionRecoveryTarget =
+    recommendedConnectionRecoveryTarget?.connectionMode === connectionMode
+      ? recommendedConnectionRecoveryTarget
+      : null;
   const connectionRecoveryKey = connectionRecoveryEscapeKey({
     snapshotRuntimeId,
     attempt: connectionRecoveryAttempt,
@@ -3162,10 +3198,16 @@ export function K1ProvisioningPipeline({
           disabled={modeResetInFlight}
           variant="split"
         />
-        {modeResetInFlight ? (
-          <p className="safety-note" role="status">
-            Завершение прежней локальной границы. Новый поиск не начнётся автоматически.
-          </p>
+        {modeResetProgressVisible ? (
+          <div
+            className="connection-action-progress"
+            role="status"
+            aria-live="polite"
+            aria-busy="true"
+          >
+            <ActivityIndicator size="compact" />
+            <strong>Переключаем способ подключения…</strong>
+          </div>
         ) : null}
         {activeScenarioReset ? (
           <p className="safety-note" role="status">
diff --git a/plugins/xgrids-k1/frontend/src/components/K1SpatialControls.tsx b/plugins/xgrids-k1/frontend/src/components/K1SpatialControls.tsx
index 9edaffe..be2ef37 100644
--- a/plugins/xgrids-k1/frontend/src/components/K1SpatialControls.tsx
+++ b/plugins/xgrids-k1/frontend/src/components/K1SpatialControls.tsx
@@ -197,6 +197,7 @@ export function K1SpatialControlsView({
     && canIssueCanonicalStop(state, physicalStopIntentSpent),
   );
   const physicalStopPresented = physicalStopInFlight || physicalStopExecutable;
+  const pluginCommandedAcquisition = acquisition?.control_mode === "plugin-commanded";
   const stopping = ["awaiting_external_stop", "stopping", "finalizing"].includes(
     acquisition?.state ?? "",
   );
@@ -327,7 +328,10 @@ export function K1SpatialControlsView({
           </span>
         </Button>
       ) : null}
-      {!physicalStopPresented && localReceiverStopAllowed && !stopping ? (
+      {!physicalStopPresented
+      && localReceiverStopAllowed
+      && !pluginCommandedAcquisition
+      && !stopping ? (
         <Button
           size="compact"
           variant="ghost"
diff --git a/scripts/check_k1_quick_connect_guardrails.py b/scripts/check_k1_quick_connect_guardrails.py
new file mode 100755
index 0000000..ab201b4
--- /dev/null
+++ b/scripts/check_k1_quick_connect_guardrails.py
@@ -0,0 +1,233 @@
+#!/usr/bin/env python3
+"""Fail closed if Quick Connect work drifts from K1 protocol or Bridge baselines.
+
+This checker performs local filesystem, Git, and synthetic-test validation only.
+It never opens BLE, CoreWLAN, MQTT, RTSP, or a socket to the scanner.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import stat
+import subprocess
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+BASELINE_COMMIT = "1001a316385a742114523c9996c43034898c115d"
+
+
+@dataclass(frozen=True, slots=True)
+class CaptureOracle:
+    relative_path: str
+    size_bytes: int
+    sha256: str
+
+
+CAPTURE_ORACLES = (
+    CaptureOracle(
+        "sessions/iphone-k1-observation/"
+        "20260716T151239Z_lixelgo-clean-cycle_d547/"
+        "captures/iphone-network.pcapng",
+        126_962_848,
+        "e6e98e22156ba2ce041c5f6ff32a3116446aaae8b617c90c16b3f00de8d5100f",
+    ),
+    CaptureOracle(
+        "sessions/iphone-k1-observation/"
+        "20260716T151239Z_lixelgo-clean-cycle_d547/"
+        "captures/iphone-network.pcap",
+        116_785_317,
+        "45ebaebbba8c8f62ebc405eb0f7cdc496d84dcdf80c01decba61c56b4514a26f",
+    ),
+    CaptureOracle(
+        "sessions/iphone-k1-observation/"
+        "20260716T152407Z_lixelgo-controls-stop_9be0/"
+        "captures/iphone-network.pcapng",
+        254_161_132,
+        "59133299bb1c4dc2157e50401ddef4c131acd2196d7d2e2ccddd5c51b95e57cb",
+    ),
+    CaptureOracle(
+        "sessions/iphone-k1-observation/"
+        "20260716T152407Z_lixelgo-controls-stop_9be0/"
+        "captures/iphone-network.pcap",
+        234_691_027,
+        "6e267f0ab9b213e5dde732b94cf3f4b2f32fcf66f5569bcb511a13c952883606",
+    ),
+)
+
+FROZEN_PATHS = (
+    "src/k1link/device_plugins/xgrids_k1/protocol",
+    "src/k1link/device_plugins/xgrids_k1/ble/ap_activation.py",
+    "src/k1link/device_plugins/xgrids_k1/ble/wifi_provisioning.py",
+    "src/k1link/device_plugins/xgrids_k1/connection_supervisor.py",
+    "src/k1link/device_plugins/xgrids_k1/physical_command_coordinator.py",
+    "src/k1link/device_plugins/xgrids_k1/physical_command_ledger.py",
+    "src/k1link/device_plugins/xgrids_k1/mqtt",
+    "src/k1link/device_plugins/xgrids_k1/camera.py",
+    "src/k1link/device_plugins/xgrids_k1/viewer/runtime.py",
+    "src/k1link/device_plugins/xgrids_k1/archive.py",
+)
+
+PYTEST_TARGETS = (
+    "tests/test_xgrids_application_bootstrap.py",
+    (
+        "tests/test_xgrids_application_mqtt.py::"
+        "test_unanswered_optional_status_does_not_steal_same_identity_required_refresh"
+    ),
+    (
+        "tests/test_xgrids_application_mqtt.py::"
+        "test_already_arrived_optional_status_is_consumed_before_required_refresh"
+    ),
+    (
+        "tests/test_xgrids_application_mqtt.py::"
+        "test_unbound_optional_status_remains_distinct_from_bound_required_refresh"
+    ),
+    (
+        "tests/test_xgrids_application_session.py::"
+        "test_canonical_stages_require_operator_events_but_device_standby_does_not"
+    ),
+    (
+        "tests/test_connection_supervisor.py::"
+        "test_quick_to_bridge_revokes_authority_with_same_target_and_host_epoch"
+    ),
+    (
+        "tests/test_xgrids_acquisition_lifecycle.py::"
+        "test_applied_bridge_target_requires_explicit_wifi_client_mode"
+    ),
+    (
+        "tests/test_xgrids_acquisition_lifecycle.py::"
+        "test_post_dispatch_bridge_accepts_exact_fw302_network_name_when_baseline_is_same"
+    ),
+    (
+        "tests/test_xgrids_acquisition_lifecycle.py::"
+        "test_post_dispatch_bridge_rejects_another_fw302_network_name"
+    ),
+    (
+        "tests/test_xgrids_acquisition_lifecycle.py::"
+        "test_bridge_read_only_verify_never_shortcuts_fresh_ble_status"
+    ),
+    (
+        "tests/test_xgrids_acquisition_lifecycle.py::"
+        "test_durable_restart_same_bridge_baseline_cannot_resolve_ambiguous_write"
+    ),
+    (
+        "tests/test_xgrids_acquisition_lifecycle.py::"
+        "test_quick_to_bridge_requires_new_explicit_scan_instead_of_retained_session"
+    ),
+    (
+        "tests/test_xgrids_acquisition_lifecycle.py::"
+        "test_quick_to_bridge_does_not_retrieve_old_handle_without_new_scan"
+    ),
+)
+
+
+def fail(message: str) -> None:
+    raise RuntimeError(message)
+
+
+def sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as source:
+        while chunk := source.read(4 * 1024 * 1024):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def verify_capture_oracles() -> None:
+    for oracle in CAPTURE_ORACLES:
+        path = REPOSITORY_ROOT / oracle.relative_path
+        try:
+            metadata = path.lstat()
+        except FileNotFoundError:
+            fail(f"capture oracle is missing: {oracle.relative_path}")
+        if not stat.S_ISREG(metadata.st_mode) or path.is_symlink():
+            fail(f"capture oracle is not a regular non-symlink file: {oracle.relative_path}")
+        if stat.S_IMODE(metadata.st_mode) != 0o600:
+            fail(f"capture oracle mode is not 0600: {oracle.relative_path}")
+        if metadata.st_size != oracle.size_bytes:
+            fail(
+                "capture oracle size changed: "
+                f"{oracle.relative_path} ({metadata.st_size} != {oracle.size_bytes})"
+            )
+        observed_sha256 = sha256_file(path)
+        if observed_sha256 != oracle.sha256:
+            fail(
+                "capture oracle SHA-256 changed: "
+                f"{oracle.relative_path} ({observed_sha256} != {oracle.sha256})"
+            )
+    print(f"[k1-guardrail] PASS capture oracles: {len(CAPTURE_ORACLES)}")
+
+
+def git_output(*args: str) -> str:
+    result = subprocess.run(
+        ("git", *args),
+        cwd=REPOSITORY_ROOT,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return result.stdout.strip()
+
+
+def verify_frozen_contour() -> None:
+    git_output("cat-file", "-e", f"{BASELINE_COMMIT}^{{commit}}")
+    changed = git_output("diff", "--name-only", BASELINE_COMMIT, "--", *FROZEN_PATHS)
+    untracked = git_output(
+        "ls-files",
+        "--others",
+        "--exclude-standard",
+        "--",
+        *FROZEN_PATHS,
+    )
+    drift = tuple(line for line in (changed, untracked) if line)
+    if drift:
+        fail("frozen K1 protocol/Bridge contour changed:\n" + "\n".join(drift))
+    print(
+        "[k1-guardrail] PASS frozen protocol/Bridge contour: "
+        f"baseline {BASELINE_COMMIT[:7]}"
+    )
+
+
+def run_checked(command: tuple[str, ...]) -> None:
+    print("[k1-guardrail] RUN " + " ".join(command), flush=True)
+    subprocess.run(command, cwd=REPOSITORY_ROOT, check=True)
+
+
+def verify_synthetic_contracts() -> None:
+    python = REPOSITORY_ROOT / ".venv" / "bin" / "python"
+    ruff = REPOSITORY_ROOT / ".venv" / "bin" / "ruff"
+    if not python.is_file():
+        fail("repository Python runtime is missing: .venv/bin/python")
+    if not ruff.is_file():
+        fail("repository Ruff runtime is missing: .venv/bin/ruff")
+    run_checked((str(python), "-m", "pytest", "-q", *PYTEST_TARGETS))
+    run_checked(
+        (
+            str(ruff),
+            "check",
+            "scripts/check_k1_quick_connect_guardrails.py",
+            "src/k1link/device_plugins/xgrids_k1/facade.py",
+            "tests/test_xgrids_acquisition_lifecycle.py",
+        )
+    )
+    run_checked(("git", "diff", "--check"))
+    print("[k1-guardrail] PASS synthetic protocol/Bridge sentinels")
+
+
+def main() -> int:
+    os.chdir(REPOSITORY_ROOT)
+    try:
+        verify_capture_oracles()
+        verify_frozen_contour()
+        verify_synthetic_contracts()
+    except (OSError, RuntimeError, subprocess.CalledProcessError) as exc:
+        print(f"[k1-guardrail] FAIL {exc}", file=sys.stderr)
+        return 1
+    print("[k1-guardrail] PASS all checks; no scanner I/O was performed")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/src/k1link/device_plugins/xgrids_k1/active_acquisition_recovery_checkpoint.py b/src/k1link/device_plugins/xgrids_k1/active_acquisition_recovery_checkpoint.py
index d05325b..9044a39 100644
--- a/src/k1link/device_plugins/xgrids_k1/active_acquisition_recovery_checkpoint.py
+++ b/src/k1link/device_plugins/xgrids_k1/active_acquisition_recovery_checkpoint.py
@@ -3045,16 +3045,25 @@ def _require_prepared_resolved_start_standby(
         raise ActiveAcquisitionRecoveryCheckpointTransitionError(
             "resolved START origin does not bind the exact prepared acquisition"
         )
-    if (
-        cessation_status_proof.binding.runtime_instance_id
+    recovery_binding = cessation_status_proof.binding
+    same_runtime = (
+        recovery_binding.runtime_instance_id
         == checkpoint.prepared_binding.runtime_instance_id
-        or cessation_status_proof.binding.control_session_id
+    )
+    if (
+        recovery_binding.control_session_id
         == checkpoint.prepared_binding.control_session_id
         or cessation_status_proof.evidence_session_id
         == checkpoint.original_evidence_session_id
+        or (
+            same_runtime
+            and recovery_binding.producer_generation
+            <= checkpoint.prepared_binding.producer_generation
+        )
     ):
         raise ActiveAcquisitionRecoveryCheckpointTransitionError(
-            "restart standby settlement requires new runtime, control and evidence sessions"
+            "standby settlement requires a new control/evidence boundary; "
+            "same-runtime recovery also requires a newer producer generation"
         )
     exact_terminal_lineage = bool(
         cessation_physical_proof.operation_id
@@ -3474,7 +3483,7 @@ def _require_active_reconciled_standby_shape(
         or (
             same_runtime
             and recovery_binding.producer_generation
-            == failed_binding.producer_generation
+            <= failed_binding.producer_generation
         )
     ):
         raise ActiveAcquisitionRecoveryCheckpointTransitionError(
diff --git a/src/k1link/device_plugins/xgrids_k1/facade.py b/src/k1link/device_plugins/xgrids_k1/facade.py
index 7fb9cda..c06c3a2 100644
--- a/src/k1link/device_plugins/xgrids_k1/facade.py
+++ b/src/k1link/device_plugins/xgrids_k1/facade.py
@@ -53,6 +53,7 @@ from k1link.device_plugins.xgrids_k1.active_acquisition_recovery_checkpoint impo
     ActiveAcquisitionRecoveryCheckpoint,
     ActiveAcquisitionRecoveryCheckpointError,
     ActiveAcquisitionRecoveryCheckpointStore,
+    ActiveAcquisitionRecoveryCheckpointTransitionError,
     ActiveAcquisitionRecoveryConnection,
     ActiveAcquisitionRecoveryFirstPublishedPclProof,
     ActiveAcquisitionRecoveryIdentity,
@@ -84,6 +85,7 @@ from k1link.device_plugins.xgrids_k1.ble.runtime_arbiter import (
     configure_ble_runtime_process_lease,
     defer_until_ble_runtime_idle,
     invalidate_ble_runtime_owner_loop,
+    wait_for_ble_runtime_idle,
 )
 from k1link.device_plugins.xgrids_k1.ble.scanner import (
     BLE_SCAN_HARD_TIMEOUT_GRACE_SECONDS,
@@ -450,6 +452,22 @@ _LocalStopRetirementDisposition = Literal[
 # LixelGo-parity discovery attempt at the old forty-second boundary.
 CONNECTION_VERIFY_HARD_TIMEOUT_SECONDS = 125.0
 CONNECTION_VERIFY_EXACT_UUID_SCAN_TIMEOUT_SECONDS = 30.0
+# A saved Quick Connect verification changes only the controller's Wi-Fi
+# association.  The K1 AP/profile pair was already durably established by the
+# reviewed BLE activation flow, so this recovery path must neither rediscover
+# nor write to the scanner.  Keep the native helper inside Verify's 125-second
+# browser/journal bound while allowing the same observed 30-second beacon
+# window as first-time Quick Connect.
+DURABLE_QUICK_CONNECT_ASSOCIATION_SCAN_TIMEOUT_SECONDS = 30.0
+DURABLE_QUICK_CONNECT_ASSOCIATION_TIMEOUT_SECONDS = 60.0
+# CoreWLAN's association call can complete before macOS installs the K1 AP's
+# DHCP address and direct route.  Keep that convergence inside the same
+# operator-owned Verify: inspect only the local kernel route, never repeat the
+# association or open TCP early, and leave enough of Verify's hard deadline
+# for the unchanged DeviceInfo bootstrap.
+DURABLE_QUICK_CONNECT_ROUTE_SETTLE_TIMEOUT_SECONDS = 12.0
+DURABLE_QUICK_CONNECT_ROUTE_SETTLE_INTERVAL_SECONDS = 0.5
+DURABLE_QUICK_CONNECT_BINDING_EVIDENCE_MAX_BYTES = 64 * 1024
 CONTROL_DEVICE_INFO_BOOTSTRAP_TIMEOUT_SECONDS = 30.0
 CONTROL_BOOTSTRAP_CONTINUATION_TIMEOUT_SECONDS = 60.0
 PHYSICAL_RECONCILIATION_PROOF_TIMEOUT_SECONDS = 5.0
@@ -978,6 +996,15 @@ class _ConfiguredEndpointHostObservation:
     path: HostPathProbeResult
     reachable: bool
     reason_code: str | None
+    initial_path: HostPathProbeResult | None = None
+    tcp_probe_performed: bool = True
+    tcp_reachable: bool | None = None
+    tcp_reason_code: str | None = None
+    fingerprint_unchanged: bool | None = None
+    route_settle_initial_path: HostPathProbeResult | None = None
+    route_settle_final_path: HostPathProbeResult | None = None
+    route_settle_sample_count: int = 0
+    route_settle_elapsed_ms: int = 0
 
 
 class BleScanRequest(StrictRequest):
@@ -1147,6 +1174,25 @@ class _ConnectionVerificationTarget:
     semantic_predecessor_revision: int
 
 
+@dataclass(frozen=True, slots=True)
+class _DurableQuickConnectHostBinding:
+    """Secret-free UUID -> AP/profile proof from a completed Quick handoff."""
+
+    transport_ref: str
+    target_ipv4: str
+    expected_ssid: str
+    profile_id: str
+    activation_evidence_path: Path
+
+
+@dataclass(frozen=True, slots=True)
+class _SavedQuickConnectHostAssociation:
+    """One completed host-side association and its secret-free evidence root."""
+
+    result: Mapping[str, Any]
+    evidence_session_dir: Path
+
+
 @dataclass(frozen=True, slots=True)
 class _ControlBootstrapContinuation:
     """Exact, read-only continuation of one durably applied network intent."""
@@ -2630,6 +2676,7 @@ class XgridsK1CompatibilityService:
         )
         if not exact_reachable_route:
             return None
+        exact_quick_bootstrap_observer_transition = False
         if association["reason_code"] == "association-identity-unavailable":
             exact_verified_control = bool(
                 intent is not None
@@ -2654,7 +2701,35 @@ class XgridsK1CompatibilityService:
                     endpoint_target=endpoint_target,
                 )
             )
-            if not (exact_verified_control or exact_active_stream_rebind):
+            # A saved Quick reconnect can finish CoreWLAN association while
+            # the first bounded identity observer is still waiting on macOS.
+            # If that timeout-bound route has already passed one exact TCP
+            # probe, a following privacy-limited observation is not a network
+            # transition.  Retain only that one configured-unverified Quick
+            # route until the immediately following DeviceInfo bootstrap.
+            # This grants no control/START authority, does not apply to Bridge,
+            # and still fails closed on any raw route/interface/source change.
+            exact_quick_bootstrap_observer_transition = bool(
+                intent is not None
+                and intent.requested_mode == "quick-connect"
+                and previous.reason_code == "host-wifi-operation-timeout"
+                and snapshot.device_identity.state == "unverified"
+                and snapshot.control_plane.state == "idle"
+                and snapshot.control_plane.session_id is None
+                and snapshot.control_plane.host_path_epoch == previous.epoch
+                and snapshot.lease.state == "configured-unverified"
+                and snapshot.lease.intent_id == intent.intent_id
+                and snapshot.lease.host_path_epoch == previous.epoch
+                and snapshot.lease.connection_mode == intent.requested_mode
+                and snapshot.lease.target == endpoint_target
+                and not snapshot.authority.control_allowed
+                and not snapshot.authority.acquisition_start_allowed
+            )
+            if not (
+                exact_verified_control
+                or exact_active_stream_rebind
+                or exact_quick_bootstrap_observer_transition
+            ):
                 return None
         return HostPathProbeResult(
             available=True,
@@ -2662,11 +2737,19 @@ class XgridsK1CompatibilityService:
             interface=path.interface,
             source_ipv4=path.source_ipv4,
             route_class=path.route_class,
-            # Do not project an observer timeout as a route failure.  The
-            # result still carries its narrow failure class for the monitor's
-            # continuity logic, while public route diagnostics remain true to
-            # the retained positive kernel/TCP evidence.
-            reason_code=None,
+            # Preserve the original timeout provenance only while this exact
+            # configured-unverified Quick route is crossing the two
+            # pre-DeviceInfo guards (open preflight, then publish dispatch).
+            # Clearing it after the first guard makes the second privacy-
+            # limited CoreWLAN observation look like a new association and
+            # rotates an otherwise unchanged kernel route.  The path remains
+            # available, grants no control authority, and the reason clears as
+            # soon as DeviceInfo establishes the verified-control branch.
+            reason_code=(
+                "host-wifi-operation-timeout"
+                if exact_quick_bootstrap_observer_transition
+                else None
+            ),
             observation_failure_class="association-observer",
             kernel_route_fingerprint=path.fingerprint,
         )
@@ -5037,6 +5120,102 @@ class XgridsK1CompatibilityService:
                 if state in {"failed", "closed", "completed", "idle"}:
                     failure = control.get("failure")
                     reported = failure.get("reason_code") if isinstance(failure, Mapping) else None
+                    if state == "failed":
+                        transport = control.get("transport")
+                        logger.error(
+                            "K1 DeviceInfo bootstrap terminal failure: reason_code=%s "
+                            "message=%s transport_state=%s connect_attempts=%s "
+                            "subscribe_attempts=%s publish_attempts=%s "
+                            "last_loop_result_code=%s last_loop_result_name=%s "
+                            "last_loop_phase=%s",
+                            reported,
+                            (
+                                failure.get("message")
+                                if isinstance(failure, Mapping)
+                                else None
+                            ),
+                            (
+                                transport.get("state")
+                                if isinstance(transport, Mapping)
+                                else None
+                            ),
+                            (
+                                transport.get("connect_attempts")
+                                if isinstance(transport, Mapping)
+                                else None
+                            ),
+                            (
+                                transport.get("subscribe_attempts")
+                                if isinstance(transport, Mapping)
+                                else None
+                            ),
+                            (
+                                transport.get("publish_attempts")
+                                if isinstance(transport, Mapping)
+                                else None
+                            ),
+                            (
+                                transport.get("last_loop_result_code")
+                                if isinstance(transport, Mapping)
+                                else None
+                            ),
+                            (
+                                transport.get("last_loop_result_name")
+                                if isinstance(transport, Mapping)
+                                else None
+                            ),
+                            (
+                                transport.get("last_loop_phase")
+                                if isinstance(transport, Mapping)
+                                else None
+                            ),
+                            extra={
+                                "event_code": "k1_device_info_bootstrap_terminal_failure",
+                                "reason_code": reported,
+                                "control_failure_message": (
+                                    failure.get("message")
+                                    if isinstance(failure, Mapping)
+                                    else None
+                                ),
+                                "transport_state": (
+                                    transport.get("state")
+                                    if isinstance(transport, Mapping)
+                                    else None
+                                ),
+                                "connect_attempts": (
+                                    transport.get("connect_attempts")
+                                    if isinstance(transport, Mapping)
+                                    else None
+                                ),
+                                "subscribe_attempts": (
+                                    transport.get("subscribe_attempts")
+                                    if isinstance(transport, Mapping)
+                                    else None
+                                ),
+                                "publish_attempts": (
+                                    transport.get("publish_attempts")
+                                    if isinstance(transport, Mapping)
+                                    else None
+                                ),
+                                "last_loop_result_code": (
+                                    transport.get("last_loop_result_code")
+                                    if isinstance(transport, Mapping)
+                                    else None
+                                ),
+                                "last_loop_result_name": (
+                                    transport.get("last_loop_result_name")
+                                    if isinstance(transport, Mapping)
+                                    else None
+                                ),
+                                "last_loop_phase": (
+                                    transport.get("last_loop_phase")
+                                    if isinstance(transport, Mapping)
+                                    else None
+                                ),
+                                "automatic_retry": False,
+                                "device_write_performed": False,
+                            },
+                        )
                     raise ConnectionVerificationError(
                         "K1 не завершил read-only проверку управляющего канала",
                         reason_code=(
@@ -7585,6 +7764,36 @@ class XgridsK1CompatibilityService:
                 connection_policy["recommended_action"] = "select-fresh-device"
         elif operator_retirement["allowed"] is True:
             connection_policy["recommended_action"] = "retire-unavailable-physical-target"
+        checkpoint_verify_retry_blocked = bool(
+            active_acquisition_checkpoint.get("reason_code")
+            == ActiveAcquisitionRecoveryCheckpointTransitionError.reason_code
+        )
+        if checkpoint_verify_retry_blocked:
+            # This error is a deterministic local reducer rejection. Repeating
+            # DeviceInfo/READY observation in the same service instance cannot
+            # change it and only churns a healthy Bridge/control connection.
+            # Fence the UI and the backend until a process boundary reloads the
+            # durable checkpoint under the current reducer implementation.
+            verify_action = connection_policy["actions"].get(
+                "verify-control-device-info"
+            )
+            if isinstance(verify_action, dict):
+                reasons = list(verify_action.get("reason_codes", []))
+                reasons.append(
+                    ActiveAcquisitionRecoveryCheckpointTransitionError.reason_code
+                )
+                verify_action["reason_codes"] = list(dict.fromkeys(reasons))
+                verify_action["allowed"] = False
+            connection_policy["allowed_actions"] = [
+                action_name
+                for action_name, action in connection_policy["actions"].items()
+                if action.get("allowed") is True
+            ]
+            connection_policy["recommended_action"] = "restart-mission-core"
+            facts = connection_policy.get("facts")
+            if isinstance(facts, dict):
+                facts["checkpoint_verify_retry_blocked"] = True
+                facts["checkpoint_verify_restart_required"] = True
         current_device_network = bool(
             supervisor_snapshot.intent is not None
             and supervisor_snapshot.device_network.state == "applied"
@@ -8592,9 +8801,25 @@ class XgridsK1CompatibilityService:
         """Queue reset intent ahead of old lifecycle work, then serialize it."""
 
         reset_id = request.reset_id if request.reset_scenario is True else None
+        reset_started_monotonic = time.monotonic() if reset_id is not None else None
         reset_deadline = (
-            time.monotonic() + CONNECTION_SCENARIO_RESET_DRAIN_TIMEOUT_SECONDS
-            if reset_id is not None
+            reset_started_monotonic + CONNECTION_SCENARIO_RESET_DRAIN_TIMEOUT_SECONDS
+            if reset_started_monotonic is not None
+            else None
+        )
+        reset_timing: dict[str, Any] | None = (
+            {
+                "schema_version": (
+                    "missioncore.xgrids-k1-connection-scenario-reset-timing/v1"
+                ),
+                "started_at_utc": _utc_now_millisecond_iso(),
+                "started_monotonic": reset_started_monotonic,
+                "lifecycle_boundary_wait_ms": 0,
+                "monitor_quiescence_wait_ms": 0,
+                "local_retirement_ms": 0,
+                "intent_commit_ms": 0,
+            }
+            if reset_started_monotonic is not None
             else None
         )
         reset_writer_token = object() if reset_id is not None else None
@@ -8663,6 +8888,7 @@ class XgridsK1CompatibilityService:
                 request,
                 reset_deadline=None,
                 reset_writer_token=None,
+                reset_timing=None,
             )
         try:
             try:
@@ -8670,6 +8896,7 @@ class XgridsK1CompatibilityService:
                     request,
                     reset_deadline=reset_deadline,
                     reset_writer_token=reset_writer_token,
+                    reset_timing=reset_timing,
                 )
             finally:
                 if reset_id is not None:
@@ -8682,7 +8909,42 @@ class XgridsK1CompatibilityService:
             # `_select_connection_mode_owned()` constructs its snapshot before
             # the outer retirement marker is cleared.  Publish one post-finally
             # local snapshot while this exact writer still has priority.
-            return self.state()
+            state = self.state()
+            if reset_timing is not None and reset_timing.get("committed") is True:
+                timing = cast(
+                    Mapping[str, Any],
+                    cast(Mapping[str, Any], state["connection_scenario_reset"])["timing"],
+                )
+                logger.info(
+                    "K1 connection scenario reset timing: reset_id=%s mode=%s "
+                    "total_ms=%d lifecycle_boundary_wait_ms=%d "
+                    "monitor_quiescence_wait_ms=%d local_retirement_ms=%d "
+                    "intent_commit_ms=%d",
+                    reset_id,
+                    request.connection_mode,
+                    timing["total_ms"],
+                    timing["lifecycle_boundary_wait_ms"],
+                    timing["monitor_quiescence_wait_ms"],
+                    timing["local_retirement_ms"],
+                    timing["intent_commit_ms"],
+                    extra={
+                        "event_code": "k1_connection_scenario_reset_timing",
+                        "reset_id": reset_id,
+                        "desired_mode": request.connection_mode,
+                        "total_ms": timing["total_ms"],
+                        "lifecycle_boundary_wait_ms": timing[
+                            "lifecycle_boundary_wait_ms"
+                        ],
+                        "monitor_quiescence_wait_ms": timing[
+                            "monitor_quiescence_wait_ms"
+                        ],
+                        "local_retirement_ms": timing["local_retirement_ms"],
+                        "intent_commit_ms": timing["intent_commit_ms"],
+                        "device_command_performed": False,
+                        "network_write_performed": False,
+                    },
+                )
+            return state
         finally:
             if reset_writer_token is not None:
                 self._unregister_acquisition_lifecycle_writer(reset_writer_token)
@@ -8693,6 +8955,7 @@ class XgridsK1CompatibilityService:
         *,
         reset_deadline: float | None,
         reset_writer_token: object | None,
+        reset_timing: dict[str, Any] | None,
     ) -> dict[str, Any]:
         """Commit one mode draft or one explicit local scenario reset.
 
@@ -8742,11 +9005,16 @@ class XgridsK1CompatibilityService:
         if reset_wait:
             assert reset_deadline is not None
             assert reset_writer_token is not None
+            boundary_wait_started = time.monotonic()
             boundary_acquired = self._acquire_connection_scenario_reset_boundary(
                 request,
                 deadline=reset_deadline,
                 writer_token=reset_writer_token,
             )
+            assert reset_timing is not None
+            reset_timing["lifecycle_boundary_wait_ms"] = int(
+                round((time.monotonic() - boundary_wait_started) * 1_000)
+            )
             if not boundary_acquired:
                 return self.state()
             acquisition_gate_acquired = True
@@ -8771,7 +9039,13 @@ class XgridsK1CompatibilityService:
                 reason_code="connection-mode-selection-lifecycle-busy",
             )
         try:
-            if not self._wait_for_connection_monitor_quiescence():
+            monitor_wait_started = time.monotonic()
+            monitor_quiescent = self._wait_for_connection_monitor_quiescence()
+            if reset_timing is not None:
+                reset_timing["monitor_quiescence_wait_ms"] = int(
+                    round((time.monotonic() - monitor_wait_started) * 1_000)
+                )
+            if not monitor_quiescent:
                 raise NetworkProvisioningConflict(
                     "фоновая проверка подключения не завершилась вовремя",
                     reason_code="connection-mode-selection-lifecycle-busy",
@@ -8805,6 +9079,8 @@ class XgridsK1CompatibilityService:
                 acquisition_start_operation_id = self._acquisition_start_operation_id
             if request.reset_scenario is True:
                 assert reset_deadline is not None
+                assert reset_timing is not None
+                local_retirement_started = time.monotonic()
                 network_preflight = self._preflight_network_scenario_reset()
                 physical_retirement_id = (
                     "scenario-reset-"
@@ -8985,6 +9261,9 @@ class XgridsK1CompatibilityService:
                     if item.get("action") == ACTION_NETWORK_PROVISION
                     and isinstance(item.get("operation_id"), str)
                 )
+                reset_timing["local_retirement_ms"] = int(
+                    round((time.monotonic() - local_retirement_started) * 1_000)
+                )
                 reset_revision = request.expected_revision + 1
                 reset_intent_id = (
                     "connection-scenario-reset-"
@@ -8994,6 +9273,7 @@ class XgridsK1CompatibilityService:
                 # committed replay marker.  An exception here leaves the
                 # request revision unchanged, so the same reset_id can safely
                 # resume the idempotent durable retirement on retry.
+                intent_commit_started = time.monotonic()
                 self._connection_supervisor.set_intent(
                     intent_id=reset_intent_id,
                     requested_mode=request.connection_mode,
@@ -9075,6 +9355,27 @@ class XgridsK1CompatibilityService:
                             physical_retirement=physical_retirement,
                         )
                     )
+                    completed_monotonic = time.monotonic()
+                    reset_timing["intent_commit_ms"] = int(
+                        round((completed_monotonic - intent_commit_started) * 1_000)
+                    )
+                    reset_timing["total_ms"] = int(
+                        round(
+                            (
+                                completed_monotonic
+                                - cast(float, reset_timing["started_monotonic"])
+                            )
+                            * 1_000
+                        )
+                    )
+                    public_reset_timing = {
+                        key: value
+                        for key, value in reset_timing.items()
+                        if key not in {"started_monotonic", "committed"}
+                    }
+                    public_reset_timing["completed_at_utc"] = (
+                        _utc_now_millisecond_iso()
+                    )
                     self._connection_scenario_reset = {
                         "reset_id": request.reset_id,
                         "request_revision": request.expected_revision,
@@ -9092,7 +9393,9 @@ class XgridsK1CompatibilityService:
                         "network_write_performed": False,
                         "automatic_scan": False,
                         "operation_sequence": reset_operation_sequence,
+                        "timing": public_reset_timing,
                     }
+                    reset_timing["committed"] = True
             elif changes_mode:
                 runtime = self.runtime.snapshot()
                 control = self._application_control_session.snapshot()
@@ -9825,7 +10128,14 @@ class XgridsK1CompatibilityService:
                 "succeeded",
                 stage_code="completed",
                 message_code="discovery.scan.completed",
-                result={"candidate_count": len(devices)},
+                result={
+                    "candidate_count": len(devices),
+                    "likely_k1_candidate_count": sum(
+                        item["likely_k1"] is True for item in devices
+                    ),
+                    "duration_seconds": duration_seconds,
+                    "discovery_generation": scan_generation,
+                },
             )
             with self._lock:
                 if (
@@ -11043,185 +11353,277 @@ class XgridsK1CompatibilityService:
             if quick_connect:
                 assert quick_connect_profile_id is not None
                 operation_stage = "device-ap-activation"
-                async with device_ap_activation_session(
-                    request.device_id,
-                    timeout_seconds=15.0,
-                    # The accepted macOS / K1 FW 3.0.2 transport is one
-                    # write-with-response frame. Do not reinterpret the live
-                    # characteristic metadata into another write mode here.
-                    write_mode="with_response",
-                    captured_device=captured_device,
-                    recovery_device_session_id=(
-                        current_device_session_id if recovery_handle_source == "retained" else None
-                    ),
-                    on_write_dispatch=persist_write_dispatch,
-                ) as activation:
-                    if recovery_handle_source == "retained":
-                        assert current_device_session_id is not None
-                        captured_device = connected_device_capture(
-                            request.device_id,
-                            device_session_id=current_device_session_id,
-                        )
-                        if captured_device is None:
-                            raise RuntimeError(
-                                "BLE recovery token was not GATT-validated before AP admission"
+                activation: Mapping[str, Any] | None = None
+                try:
+                    async with device_ap_activation_session(
+                        request.device_id,
+                        timeout_seconds=15.0,
+                        # The accepted macOS / K1 FW 3.0.2 transport is one
+                        # write-with-response frame. Do not reinterpret the live
+                        # characteristic metadata into another write mode here.
+                        write_mode="with_response",
+                        captured_device=captured_device,
+                        recovery_device_session_id=(
+                            current_device_session_id
+                            if recovery_handle_source == "retained"
+                            else None
+                        ),
+                        on_write_dispatch=persist_write_dispatch,
+                    ) as observed_activation:
+                        activation = observed_activation
+                        if recovery_handle_source == "retained":
+                            assert current_device_session_id is not None
+                            captured_device = connected_device_capture(
+                                request.device_id,
+                                device_session_id=current_device_session_id,
+                            )
+                            if captured_device is None:
+                                raise RuntimeError(
+                                    "BLE recovery token was not GATT-validated before AP admission"
+                                )
+                        device_write_attempted = bool(activation["write_performed"])
+                        device_write_confirmed = bool(
+                            activation["write_performed"]
+                            and (
+                                activation["write_mode"] == "with_response"
+                                or activation["ready_observed"]
                             )
-                    device_write_attempted = bool(activation["write_performed"])
-                    device_write_confirmed = bool(
-                        activation["write_performed"]
-                        and (
-                            activation["write_mode"] == "with_response"
-                            or activation["ready_observed"]
                         )
-                    )
-                    if device_write_attempted:
-                        self._operations.transition(
-                            operation.operation_id,
-                            "running",
-                            stage_code="ble-write-dispatched",
-                            message_code="network.provision.ble_write_dispatched",
-                            result={
-                                "side_effect_status": "unknown",
-                                "automatic_retry": False,
-                            },
+                        if device_write_attempted:
+                            self._operations.transition(
+                                operation.operation_id,
+                                "running",
+                                stage_code="ble-write-dispatched",
+                                message_code="network.provision.ble_write_dispatched",
+                                result={
+                                    "side_effect_status": "unknown",
+                                    "automatic_retry": False,
+                                },
+                            )
+                        # Only the reviewed AP-ready state proves that this exact
+                        # Quick Connect mutation applied. Any other observation is
+                        # diagnostic and keeps the durable ambiguity barrier.
+                        activation_observations = activation.get("observations") or []
+                        activation_final_status = (
+                            activation_observations[-1].get("status")
+                            if activation_observations
+                            and isinstance(activation_observations[-1], Mapping)
+                            else None
                         )
-                    # Only the reviewed AP-ready state proves that this exact
-                    # Quick Connect mutation applied. Any other observation is
-                    # diagnostic and keeps the durable ambiguity barrier.
-                    activation_observations = activation.get("observations") or []
-                    activation_final_status = (
-                        activation_observations[-1].get("status")
-                        if activation_observations
-                        and isinstance(activation_observations[-1], Mapping)
-                        else None
-                    )
-                    assert network_ledger_record is not None
-                    activation_baseline_evidence = network_ledger_record.baseline_status
-                    applied_target = _post_dispatch_network_target(
-                        request.connection_mode,
-                        activation_final_status,
-                        transport_ref=request.device_id,
-                        baseline_status=activation_baseline_evidence,
-                        previous_connection=previous_connection,
-                    )
-                    device_state_reconciled = applied_target is not None
-                    activation_evidence = _optional_network_status_evidence(activation_final_status)
-                    if ledger_dispatch_recorded:
                         assert network_ledger_record is not None
-                        network_ledger_record = self._network_mutation_ledger.mark_observing(
-                            operation.operation_id,
-                            expected_revision=network_ledger_record.revision,
-                            write_confirmed=device_write_confirmed,
-                            observation=activation_evidence,
-                        )
-                        self._operations.transition(
-                            operation.operation_id,
-                            "running",
-                            stage_code="status-observing",
-                            message_code="network.provision.status_observing",
-                            result={
-                                "side_effect_status": (
-                                    "confirmed" if device_write_confirmed else "unknown"
-                                ),
-                                "automatic_retry": False,
-                            },
-                        )
-                    if device_state_reconciled:
-                        assert applied_target is not None
-                        retired_ingress_session_id = self._commit_applied_device_topology(
-                            intent_id=operation.operation_id,
+                        activation_baseline_evidence = network_ledger_record.baseline_status
+                        applied_target = _post_dispatch_network_target(
+                            request.connection_mode,
+                            activation_final_status,
                             transport_ref=request.device_id,
-                            connection_mode=request.connection_mode,
-                            ipv4=applied_target,
-                            compatibility_attestation=(request.compatibility_attestation),
-                            captured_device=captured_device,
-                            source="ble-post-write-status",
-                            observed_at_utc=_status_observed_at_utc(
-                                activation,
-                                activation_observations[-1] if activation_observations else None,
-                            ),
+                            baseline_status=activation_baseline_evidence,
+                            previous_connection=previous_connection,
+                            write_confirmed=device_write_confirmed,
                         )
-                        applied_topology_committed = True
-                        if ledger_dispatch_recorded and activation_evidence is not None:
+                        device_state_reconciled = applied_target is not None
+                        activation_evidence = _optional_network_status_evidence(
+                            activation_final_status
+                        )
+                        if ledger_dispatch_recorded:
                             assert network_ledger_record is not None
-                            network_ledger_record = self._network_mutation_ledger.resolve(
+                            network_ledger_record = self._network_mutation_ledger.mark_observing(
                                 operation.operation_id,
                                 expected_revision=network_ledger_record.revision,
-                                resolution="target-observed",
+                                write_confirmed=device_write_confirmed,
                                 observation=activation_evidence,
                             )
-                            ledger_resolved = True
-                        with self._lock:
-                            self._network_write_reconciliation = None
+                            self._operations.transition(
+                                operation.operation_id,
+                                "running",
+                                stage_code="status-observing",
+                                message_code="network.provision.status_observing",
+                                result={
+                                    "side_effect_status": (
+                                        "confirmed" if device_write_confirmed else "unknown"
+                                    ),
+                                    "automatic_retry": False,
+                                },
+                            )
+                        if device_state_reconciled:
+                            assert applied_target is not None
+                            retired_ingress_session_id = self._commit_applied_device_topology(
+                                intent_id=operation.operation_id,
+                                transport_ref=request.device_id,
+                                connection_mode=request.connection_mode,
+                                ipv4=applied_target,
+                                compatibility_attestation=(request.compatibility_attestation),
+                                captured_device=captured_device,
+                                source="ble-post-write-status",
+                                observed_at_utc=_status_observed_at_utc(
+                                    activation,
+                                    (
+                                        activation_observations[-1]
+                                        if activation_observations
+                                        else None
+                                    ),
+                                ),
+                            )
+                            applied_topology_committed = True
+                            if ledger_dispatch_recorded and activation_evidence is not None:
+                                assert network_ledger_record is not None
+                                network_ledger_record = self._network_mutation_ledger.resolve(
+                                    operation.operation_id,
+                                    expected_revision=network_ledger_record.revision,
+                                    resolution="target-observed",
+                                    observation=activation_evidence,
+                                )
+                                ledger_resolved = True
+                            with self._lock:
+                                self._network_write_reconciliation = None
+                            self._operations.transition(
+                                operation.operation_id,
+                                "running",
+                                stage_code="device-topology-applied",
+                                message_code="network.provision.device_topology_applied",
+                                result={
+                                    "side_effect_status": "applied",
+                                    "automatic_retry": False,
+                                },
+                            )
+                            if retired_ingress_session_id is not None:
+                                self.live_perception_ingress.end_session(
+                                    retired_ingress_session_id
+                                )
+                        write_json_atomic(
+                            session_dir / "ap-activation.redacted.json",
+                            activation,
+                        )
+                        if not activation["ready_observed"]:
+                            raise RuntimeError(
+                                "K1 не подтвердил готовность точки доступа; "
+                                "системное подключение Wi-Fi не запускалось"
+                            )
+                        if applied_target is None:
+                            raise NetworkProvisioningConflict(
+                                "Текущий 7f02-статус точки K1 неотличим от baseline или "
+                                "предыдущей топологии; системное подключение Wi-Fi не запускалось",
+                                reason_code=(
+                                    "network-provision-target-not-distinguishable-from-baseline"
+                                ),
+                            )
+                        operation_stage = "host-wifi-association"
                         self._operations.transition(
                             operation.operation_id,
                             "running",
-                            stage_code="device-topology-applied",
-                            message_code="network.provision.device_topology_applied",
-                            result={
-                                "side_effect_status": "applied",
-                                "automatic_retry": False,
-                            },
+                            stage_code=operation_stage,
+                            message_code="network.provision.host_wifi_association",
                         )
-                        if retired_ingress_session_id is not None:
-                            self.live_perception_ingress.end_session(retired_ingress_session_id)
-                    write_json_atomic(
-                        session_dir / "ap-activation.redacted.json",
-                        activation,
-                    )
-                    if not activation["ready_observed"]:
-                        raise RuntimeError(
-                            "K1 не подтвердил готовность точки доступа; "
-                            "системное подключение Wi-Fi не запускалось"
-                        )
-                    if applied_target is None:
-                        raise NetworkProvisioningConflict(
-                            "Текущий 7f02-статус точки K1 неотличим от baseline или "
-                            "предыдущей топологии; системное подключение Wi-Fi не запускалось",
-                            reason_code=(
-                                "network-provision-target-not-distinguishable-from-baseline"
-                            ),
-                        )
-                    operation_stage = "host-wifi-association"
-                    self._operations.transition(
-                        operation.operation_id,
-                        "running",
-                        stage_code=operation_stage,
-                        message_code="network.provision.host_wifi_association",
-                    )
-                    # Keep the same BLE connection alive through the native
-                    # CoreWLAN discovery/association handoff, as the reviewed
-                    # LixelGO Quick Connect flow does.
-                    try:
-                        association = await _run_blocking_operation_without_abandonment(
-                            associate_with_wifi_profile_once,
-                            host_wifi_helper_path,
-                            quick_connect_profile_id,
-                            selected_device_name,
-                            # Historical physical associations took up to
-                            # 18.142 s after AP-ready. The K1 control flag does
-                            # not prove that the RF beacon is already visible.
-                            scan_timeout_seconds=30.0,
-                            timeout_seconds=180.0,
-                            process_fence_descriptor_factory=(
-                                self._duplicate_network_process_fence_descriptor
-                            ),
-                        )
-                        quick_host_association = association
-                    except HostWifiProfileError as exc:
+                        # Keep the same BLE connection alive through the native
+                        # CoreWLAN discovery/association handoff, as the reviewed
+                        # LixelGO Quick Connect flow does.
+                        try:
+                            association = await _run_blocking_operation_without_abandonment(
+                                associate_with_wifi_profile_once,
+                                host_wifi_helper_path,
+                                quick_connect_profile_id,
+                                selected_device_name,
+                                # Historical physical associations took up to
+                                # 18.142 s after AP-ready. The K1 control flag does
+                                # not prove that the RF beacon is already visible.
+                                scan_timeout_seconds=30.0,
+                                timeout_seconds=180.0,
+                                process_fence_descriptor_factory=(
+                                    self._duplicate_network_process_fence_descriptor
+                                ),
+                            )
+                        except HostWifiProfileError as exc:
+                            write_json_atomic(
+                                session_dir / "host-wifi-association.redacted.json",
+                                {
+                                    "schema_version": 1,
+                                    "completed_at_utc": _utc_now_iso(),
+                                    "adapter": "CoreWLAN",
+                                    "outcome": "failed",
+                                    "reason_code": exc.reason_code,
+                                    "scan_attempt_count": exc.scan_attempt_count,
+                                    "scan_elapsed_ms": exc.scan_elapsed_ms,
+                                },
+                            )
+                            raise
                         write_json_atomic(
                             session_dir / "host-wifi-association.redacted.json",
                             {
                                 "schema_version": 1,
                                 "completed_at_utc": _utc_now_iso(),
-                                "adapter": "CoreWLAN",
-                                "outcome": "failed",
-                                "reason_code": exc.reason_code,
-                                "scan_attempt_count": exc.scan_attempt_count,
-                                "scan_elapsed_ms": exc.scan_elapsed_ms,
+                                "adapter": association.get("adapter"),
+                                "outcome": association.get("outcome"),
+                                "already_associated": association.get(
+                                    "already_associated"
+                                ),
+                                "profile_enrolled": association.get("profile_enrolled"),
+                                "scan_attempt_count": association.get(
+                                    "scan_attempt_count"
+                                ),
+                                "scan_elapsed_ms": association.get("scan_elapsed_ms"),
+                                "credential_source": association.get("credential_source"),
+                                "device_write_performed": True,
+                                "automatic_retry": False,
                             },
                         )
+                        # This assignment is deliberately the final statement in
+                        # the held BLE block. Any later exception is therefore
+                        # exclusively the session-exit edge, not lost evidence or
+                        # an unclassified CoreWLAN result.
+                        quick_host_association = association
+                except Exception as exc:
+                    if quick_host_association is None or activation is None:
                         raise
+                    ble_became_idle = await wait_for_ble_runtime_idle(timeout_seconds=1.0)
+                    ble_after_handoff = ble_runtime_snapshot()
+                    if not (
+                        ble_became_idle
+                        and ble_after_handoff["active_operation_kind"] is None
+                        and ble_after_handoff["cleanup_pending"] is False
+                        and ble_after_handoff["poisoned"] is False
+                    ):
+                        raise
+                    operation_stage = "ble-handoff-cleanup-reconciled"
+                    cleanup_evidence = {
+                        "schema_version": 1,
+                        "completed_at_utc": _utc_now_iso(),
+                        "outcome": "clean-idle-after-session-exit-error",
+                        "exception_type": type(exc).__name__,
+                        "active_operation_kind": None,
+                        "cleanup_pending": False,
+                        "poisoned": False,
+                        "host_wifi_association_confirmed": True,
+                        "automatic_retry": False,
+                    }
+                    write_json_atomic(
+                        session_dir / "ble-handoff-cleanup.redacted.json",
+                        cleanup_evidence,
+                    )
+                    self._operations.transition(
+                        operation.operation_id,
+                        "running",
+                        stage_code=operation_stage,
+                        message_code="network.provision.ble_handoff_cleanup_reconciled",
+                        result={
+                            "side_effect_status": "applied",
+                            "automatic_retry": False,
+                        },
+                    )
+                    logger.warning(
+                        "Quick Connect BLE handoff exit reconciled after clean idle proof",
+                        extra={
+                            "event_code": "k1_quick_connect_ble_handoff_cleanup_reconciled",
+                            "operation_id": operation.operation_id,
+                            "exception_type": type(exc).__name__,
+                            "host_wifi_association_confirmed": True,
+                            "ble_runtime_idle": True,
+                            "ble_runtime_cleanup_pending": False,
+                            "ble_runtime_poisoned": False,
+                            "automatic_retry": False,
+                        },
+                    )
+                assert activation is not None
+                assert quick_host_association is not None
+                association = quick_host_association
                 completed_at = _utc_now_iso()
                 ipv4: str | None = applied_target
                 connection_manifest: dict[str, Any] = {
@@ -13490,13 +13892,15 @@ class XgridsK1CompatibilityService:
         self,
         token: _ActiveAcquisitionCheckpointTrustToken | None,
     ) -> bool:
-        """Finish an exact STOP-ledger/checkpoint fsync gap without device I/O."""
+        """Finish an exact durable standby/checkpoint fsync gap without device I/O."""
 
-        if token is None or token.checkpoint_state != "active":
+        if token is None or token.checkpoint_state not in {"active", "prepared"}:
             return False
         ledger_snapshot = self._physical_command_ledger.snapshot()
         record = ledger_snapshot.record
         ordinary_terminal_stop = bool(
+            token.checkpoint_state == "active"
+            and
             ledger_snapshot.status == "resolved"
             and record is not None
             and record.action == "stop"
@@ -13581,6 +13985,8 @@ class XgridsK1CompatibilityService:
             and reconciliation.kind == "prepared-stop-classification"
         )
         ambiguous_stop_observed_standby = bool(
+            token.checkpoint_state == "active"
+            and
             record is not None
             and record.resolution == "physical-standby-observed"
             and reconciliation is not None
@@ -13591,13 +13997,37 @@ class XgridsK1CompatibilityService:
             and reconciliation.original_attempt.stage == "observing"
             and reconciliation.original_attempt.resolution is None
         )
+        prepared_resolved_start_observed_standby = bool(
+            token.checkpoint_state == "prepared"
+            and record is not None
+            and record.action == "start"
+            and record.stage == "resolved"
+            and record.resolution == "start-active-observed"
+            and reconciliation is not None
+            and self._physical_reconciliation_belongs_to_record(
+                reconciliation,
+                record,
+            )
+            and reconciliation.kind == "resolved-active-cessation"
+            and reconciliation.original_attempt.operation_id
+            == token.root_start_operation_id
+            and reconciliation.original_attempt.acquisition_id
+            == token.acquisition_id
+            and reconciliation.original_attempt.action == "start"
+            and reconciliation.original_attempt.stage == "resolved"
+            and reconciliation.original_attempt.resolution
+            == "start-active-observed"
+        )
         if not (
             ledger_snapshot.status == "resolved"
             and record is not None
-            and record.action == "stop"
             and record.stage == "resolved"
             and reconciliation is not None
-            and (definitely_undispatched or ambiguous_stop_observed_standby)
+            and (
+                definitely_undispatched
+                or ambiguous_stop_observed_standby
+                or prepared_resolved_start_observed_standby
+            )
             and reconciliation.resolution == "physical-standby-observed"
             and reconciliation.observation.source
             == "explicit-read-only-reconciliation"
@@ -15230,6 +15660,19 @@ class XgridsK1CompatibilityService:
         """Serialize every topology observation with network/control ownership."""
 
         request = self._resolve_legacy_connection_verify_request(request)
+        with self._lock:
+            checkpoint_reason = self._active_acquisition_checkpoint_reason
+        if (
+            checkpoint_reason
+            == ActiveAcquisitionRecoveryCheckpointTransitionError.reason_code
+        ):
+            raise ConnectionVerificationError(
+                "Локальный recovery-checkpoint требует перезапуска Mission Core; "
+                "повторная проверка этого же состояния запрещена",
+                reason_code=(
+                    ActiveAcquisitionRecoveryCheckpointTransitionError.reason_code
+                ),
+            )
         if request.device_id is None:
             raise ConnectionVerificationError(
                 "Read-only проверка K1 не получила точную серверную цель",
@@ -15470,6 +15913,10 @@ class XgridsK1CompatibilityService:
                         reason_code=str(getattr(exc, "reason_code", "control-bootstrap-failed")),
                     )
                 )
+                checkpoint_retry_blocked = bool(
+                    failure.reason_code
+                    == ActiveAcquisitionRecoveryCheckpointTransitionError.reason_code
+                )
                 self._operations.transition_if_pending(
                     verify_operation_id,
                     "failed",
@@ -15479,8 +15926,8 @@ class XgridsK1CompatibilityService:
                         failure,
                         category="connection",
                         side_effect_status="none",
-                        retryable=True,
-                        safe_to_retry=True,
+                        retryable=not checkpoint_retry_blocked,
+                        safe_to_retry=not checkpoint_retry_blocked,
                     ),
                 )
                 if failure is exc:
@@ -17887,6 +18334,176 @@ class XgridsK1CompatibilityService:
         )
         return operation.operation_id, True, provisional_topology
 
+    async def _associate_saved_quick_connect_host(
+        self,
+        *,
+        transport_ref: str,
+        target_ipv4: str,
+    ) -> _SavedQuickConnectHostAssociation:
+        """Restore the controller-side AP route without touching K1 over BLE."""
+
+        binding = _recover_durable_quick_connect_host_binding(
+            self.evidence_root,
+            transport_ref=transport_ref,
+            target_ipv4=target_ipv4,
+        )
+        if binding is None:
+            raise ConnectionVerificationError(
+                "Для сохранённого Quick Connect нет точной привязки профиля этого K1; "
+                "команда устройству и системное переключение Wi-Fi не выполнялись",
+                reason_code="connection-verify-quick-host-binding-unavailable",
+            )
+
+        session_dir = _new_operation_session_dir(
+            self.evidence_root,
+            "viewer_k1_quick_connect_host_reassociation",
+        )
+        session_dir.mkdir(parents=True, exist_ok=False)
+        write_json_atomic(
+            session_dir / "operation-reservation.redacted.json",
+            {
+                "schema": "missioncore.xgrids-k1-quick-host-reassociation/v1",
+                "action": ACTION_CONNECTION_VERIFY,
+                "connection_mode": "quick-connect",
+                "transport_ref_sha256": hashlib.sha256(
+                    transport_ref.encode("utf-8")
+                ).hexdigest(),
+                "target_ipv4": target_ipv4,
+                "expected_ssid": binding.expected_ssid,
+                "profile_id": binding.profile_id,
+                "binding_evidence_session": binding.activation_evidence_path.parent.name,
+                "device_write_performed": False,
+                "automatic_retry": False,
+                "reserved_at": _utc_now_iso(),
+            },
+        )
+        logger.info(
+            "Restoring saved Quick Connect host association before endpoint verification",
+            extra={
+                "event_code": "k1_quick_connect_host_reassociation_started",
+                "connection_mode": "quick-connect",
+                "device_write_performed": False,
+                "automatic_retry": False,
+            },
+        )
+        # CoreWLAN may hide the current SSID without Location authorization.
+        # In that case the native helper cannot recognize an already active K1
+        # association and would tear down/rejoin the same Wi-Fi network.  A
+        # current direct kernel route to the fixed K1 AP endpoint is enough to
+        # skip only that host mutation; the following single TCP probe and
+        # canonical DeviceInfo exchange still carry all admission authority.
+        route_preflight = await _run_blocking_operation_without_abandonment(
+            _inspect_host_path,
+            target_ipv4,
+        )
+        association_performed = not (
+            route_preflight.available and route_preflight.route_class == "direct"
+        )
+        try:
+            if association_performed:
+                association = await _run_blocking_operation_without_abandonment(
+                    associate_with_wifi_profile_once,
+                    self.repository_root
+                    / "plugins"
+                    / "xgrids-k1"
+                    / "macos"
+                    / "associate_wifi.swift",
+                    binding.profile_id,
+                    binding.expected_ssid,
+                    scan_timeout_seconds=(
+                        DURABLE_QUICK_CONNECT_ASSOCIATION_SCAN_TIMEOUT_SECONDS
+                    ),
+                    timeout_seconds=DURABLE_QUICK_CONNECT_ASSOCIATION_TIMEOUT_SECONDS,
+                    process_fence_descriptor_factory=(
+                        self._duplicate_network_process_fence_descriptor
+                    ),
+                )
+            else:
+                association = {
+                    "schema_version": 1,
+                    "adapter": "kernel-route-preflight",
+                    "outcome": "association-skipped-direct-route",
+                    "already_associated": None,
+                    "profile_enrolled": None,
+                    "scan_attempt_count": 0,
+                    "scan_elapsed_ms": 0,
+                    "credential_source": "not-required-direct-route",
+                }
+        except HostWifiProfileError as exc:
+            write_json_atomic(
+                session_dir / "host-wifi-reassociation.redacted.json",
+                {
+                    "schema_version": 1,
+                    "completed_at_utc": _utc_now_iso(),
+                    "adapter": "CoreWLAN",
+                    "outcome": "failed",
+                    "reason_code": exc.reason_code,
+                    "scan_attempt_count": exc.scan_attempt_count,
+                    "scan_elapsed_ms": exc.scan_elapsed_ms,
+                    "helper_stage": exc.helper_stage,
+                    "helper_elapsed_ms": exc.helper_elapsed_ms,
+                    "association_performed": True,
+                    "route_preflight": _redacted_host_path_evidence(route_preflight),
+                    "device_write_performed": False,
+                    "automatic_retry": False,
+                },
+            )
+            logger.info(
+                "Saved Quick Connect host association failed without K1 I/O",
+                extra={
+                    "event_code": "k1_quick_connect_host_reassociation_failed",
+                    "reason_code": exc.reason_code,
+                    "device_write_performed": False,
+                    "automatic_retry": False,
+                },
+            )
+            message = (
+                "macOS не увидела сохранённую Wi-Fi-сеть этого K1; "
+                "Bluetooth-команда и перезапуск устройства не выполнялись"
+                if exc.reason_code == "network-not-found"
+                else "macOS не смогла восстановить сохранённое Quick Connect "
+                "подключение к этому K1"
+            )
+            raise ConnectionVerificationError(
+                message,
+                reason_code="connection-verify-quick-host-association-failed",
+            ) from exc
+
+        write_json_atomic(
+            session_dir / "host-wifi-reassociation.redacted.json",
+            {
+                "schema_version": 1,
+                "completed_at_utc": _utc_now_iso(),
+                "adapter": association.get("adapter"),
+                "outcome": association.get("outcome"),
+                "already_associated": association.get("already_associated"),
+                "profile_enrolled": association.get("profile_enrolled"),
+                "scan_attempt_count": association.get("scan_attempt_count"),
+                "scan_elapsed_ms": association.get("scan_elapsed_ms"),
+                "credential_source": association.get("credential_source"),
+                "association_performed": association_performed,
+                "route_preflight": _redacted_host_path_evidence(route_preflight),
+                "device_write_performed": False,
+                "automatic_retry": False,
+            },
+        )
+        logger.info(
+            "Saved Quick Connect host association completed; route proof pending",
+            extra={
+                "event_code": "k1_quick_connect_host_reassociation_succeeded",
+                "already_associated": association.get("already_associated"),
+                "scan_attempt_count": association.get("scan_attempt_count"),
+                "scan_elapsed_ms": association.get("scan_elapsed_ms"),
+                "association_performed": association_performed,
+                "device_write_performed": False,
+                "automatic_retry": False,
+            },
+        )
+        return _SavedQuickConnectHostAssociation(
+            result=association,
+            evidence_session_dir=session_dir,
+        )
+
     async def _adopt_existing_lan_connection(
         self,
         device_id: str,
@@ -18272,20 +18889,149 @@ class XgridsK1CompatibilityService:
                 and not require_live_gatt_validation
             ):
                 assert semantic_record is not None
-                endpoint_observation = await _run_blocking_operation_without_abandonment(
-                    _probe_configured_endpoint_host_only,
-                    semantic_record.ipv4,
-                    path_probe=self._sample_host_path,
-                )
+                # A persisted Quick topology describes the K1 AP, not the
+                # controller's current Wi-Fi association.  Restore only the
+                # Mac-side route from the exact enrolled profile before
+                # probing 192.168.56.1.  Bridge deliberately bypasses this
+                # branch unchanged, and no BLE discovery/read/write occurs.
+                quick_host_association: _SavedQuickConnectHostAssociation | None = None
+                quick_supervisor_epoch_before: int | None = None
+                if requested_mode == "quick-connect":
+                    quick_host_association = await self._associate_saved_quick_connect_host(
+                        transport_ref=actual_transport_ref,
+                        target_ipv4=semantic_record.ipv4,
+                    )
+                    quick_supervisor_epoch_before = (
+                        self._connection_supervisor.snapshot().host_path.epoch
+                    )
+                try:
+                    if requested_mode == "quick-connect":
+                        endpoint_observation = (
+                            await _run_blocking_operation_without_abandonment(
+                                _probe_quick_connect_endpoint_after_route_settle,
+                                semantic_record.ipv4,
+                                path_probe=lambda target: self._sample_host_path(
+                                    target,
+                                    association_timeout_seconds=(
+                                        CONNECTION_MONITOR_ASSOCIATION_TIMEOUT_SECONDS
+                                    ),
+                                ),
+                                settle_timeout_seconds=(
+                                    DURABLE_QUICK_CONNECT_ROUTE_SETTLE_TIMEOUT_SECONDS
+                                ),
+                                settle_interval_seconds=(
+                                    DURABLE_QUICK_CONNECT_ROUTE_SETTLE_INTERVAL_SECONDS
+                                ),
+                            )
+                        )
+                    else:
+                        endpoint_observation = (
+                            await _run_blocking_operation_without_abandonment(
+                            _probe_configured_endpoint_host_only,
+                            semantic_record.ipv4,
+                            path_probe=self._sample_host_path,
+                            )
+                        )
+                except Exception as exc:
+                    if quick_host_association is not None:
+                        _write_quick_connect_host_network_proof(
+                            quick_host_association,
+                            target_ipv4=semantic_record.ipv4,
+                            observation=None,
+                            outcome="probe-failed",
+                            reason_code=(
+                                getattr(exc, "reason_code", None)
+                                or "host-network-proof-failed"
+                            ),
+                            supervisor_host_path_epoch_before_admission=(
+                                quick_supervisor_epoch_before
+                            ),
+                        )
+                    raise
                 current_semantic_snapshot = semantic_store.snapshot()
                 if (
                     current_semantic_snapshot.status != "available"
                     or current_semantic_snapshot.record != semantic_record
                 ):
+                    if quick_host_association is not None:
+                        _write_quick_connect_host_network_proof(
+                            quick_host_association,
+                            target_ipv4=semantic_record.ipv4,
+                            observation=endpoint_observation,
+                            outcome="topology-changed",
+                            reason_code="connection-verify-candidate-changed",
+                            supervisor_host_path_epoch_before_admission=(
+                                quick_supervisor_epoch_before
+                            ),
+                        )
                     raise ConnectionVerificationError(
                         "durable topology изменилась во время сетевой проверки",
                         reason_code="connection-verify-candidate-changed",
                     )
+                if requested_mode == "quick-connect":
+                    assert quick_host_association is not None
+                    if (
+                        endpoint_observation.reason_code
+                        == "host-route-changed-during-tcp-probe"
+                    ):
+                        _write_quick_connect_host_network_proof(
+                            quick_host_association,
+                            target_ipv4=semantic_record.ipv4,
+                            observation=endpoint_observation,
+                            outcome="route-changed",
+                            reason_code="connection-verify-lease-changed",
+                            supervisor_host_path_epoch_before_admission=(
+                                quick_supervisor_epoch_before
+                            ),
+                        )
+                        raise ConnectionVerificationError(
+                            "Маршрут к K1 изменился во время Quick Connect проверки",
+                            reason_code="connection-verify-lease-changed",
+                        )
+                    if (
+                        not endpoint_observation.path.available
+                        or endpoint_observation.path.route_class != "direct"
+                    ):
+                        _write_quick_connect_host_network_proof(
+                            quick_host_association,
+                            target_ipv4=semantic_record.ipv4,
+                            observation=endpoint_observation,
+                            outcome="route-rejected",
+                            reason_code="connection-verify-route-mismatch",
+                            supervisor_host_path_epoch_before_admission=(
+                                quick_supervisor_epoch_before
+                            ),
+                        )
+                        raise ConnectionVerificationError(
+                            "После подключения Quick Connect прямой маршрут к K1 не подтверждён",
+                            reason_code="connection-verify-route-mismatch",
+                        )
+                    if not endpoint_observation.reachable:
+                        _write_quick_connect_host_network_proof(
+                            quick_host_association,
+                            target_ipv4=semantic_record.ipv4,
+                            observation=endpoint_observation,
+                            outcome="endpoint-unreachable",
+                            reason_code="connection-verify-mqtt-unreachable",
+                            supervisor_host_path_epoch_before_admission=(
+                                quick_supervisor_epoch_before
+                            ),
+                        )
+                        raise ConnectionVerificationError(
+                            "Прямой маршрут Quick Connect подтверждён, "
+                            "но MQTT endpoint K1 недоступен",
+                            reason_code="connection-verify-mqtt-unreachable",
+                        )
+                    _write_quick_connect_host_network_proof(
+                        quick_host_association,
+                        target_ipv4=semantic_record.ipv4,
+                        observation=endpoint_observation,
+                        outcome="direct-endpoint-reachable",
+                        reason_code=None,
+                        supervisor_host_path_epoch_before_admission=(
+                            quick_supervisor_epoch_before
+                        ),
+                    )
                 if (
                     not endpoint_observation.path.available
                     or endpoint_observation.path.route_class != "direct"
@@ -18317,6 +19063,20 @@ class XgridsK1CompatibilityService:
                         path=endpoint_observation.path,
                         reachable=True,
                     )
+                    if quick_host_association is not None:
+                        _write_quick_connect_host_network_proof(
+                            quick_host_association,
+                            target_ipv4=semantic_record.ipv4,
+                            observation=endpoint_observation,
+                            outcome="direct-endpoint-reachable",
+                            reason_code=None,
+                            supervisor_host_path_epoch_before_admission=(
+                                quick_supervisor_epoch_before
+                            ),
+                            supervisor_host_path_epoch_after_admission=(
+                                self._connection_supervisor.snapshot().host_path.epoch
+                            ),
+                        )
                     self._update_applied_topology_reachability(
                         connection_mode=requested_mode,
                         ipv4=semantic_record.ipv4,
@@ -18515,6 +19275,7 @@ class XgridsK1CompatibilityService:
                     transport_ref=ledger_record.transport_ref,
                     baseline_status=ledger_record.baseline_status,
                     previous_connection=ledger_record.previous_connection,
+                    write_confirmed=ledger_record.write_confirmed is True,
                 )
                 if applied_status_target is not None and target is None:
                     raise ConnectionVerificationError(
@@ -21175,6 +21936,23 @@ class XgridsK1CompatibilityService:
                 if existing_operation.request_fingerprint != request_fingerprint:
                     raise ValueError("operation id is already bound to a different request")
                 return self.state()
+        with self._lock:
+            acquisition_state = acquisition.state
+        physical_command = (
+            self._physical_command_coordinator.snapshot() if plugin_commanded else {}
+        )
+        if (
+            plugin_commanded
+            and request.mode == "capture-only"
+            and acquisition_state in {"starting", "awaiting_external_start", "acquiring"}
+            and _physical_start_requires_canonical_stop_before_local_teardown(
+                physical_command
+            )
+        ):
+            raise LocalAcquisitionLifecycleError(
+                "Локальное завершение запрещено после физического START до канонического STOP",
+                reason_code="acquisition-local-stop-requires-canonical-stop",
+            )
         if self._prepared_stop_local_projection_is_pending(
             acquisition_id=acquisition.acquisition_id,
         ):
@@ -21650,9 +22428,25 @@ class XgridsK1CompatibilityService:
     @_serialized_acquisition_access
     def abort_acquisition(self, request: AbortAcquisitionRequest) -> dict[str, Any]:
         acquisition = self._require_acquisition(request.acquisition_id)
+        physical_command = (
+            self._physical_command_coordinator.snapshot()
+            if acquisition.control_mode == "plugin-commanded"
+            else {}
+        )
+        if (
+            acquisition.control_mode == "plugin-commanded"
+            and acquisition.state in {"starting", "awaiting_external_start", "acquiring"}
+            and _physical_start_requires_canonical_stop_before_local_teardown(
+                physical_command
+            )
+        ):
+            raise LocalAcquisitionLifecycleError(
+                "ABORT запрещён после физического START до канонического STOP",
+                reason_code="acquisition-abort-requires-canonical-stop",
+            )
         unresolved_stop = (
             self._matching_unresolved_stop_stage(
-                self._physical_command_coordinator.snapshot(),
+                physical_command,
                 acquisition_id=acquisition.acquisition_id,
             )
             if acquisition.control_mode == "plugin-commanded"
@@ -31317,6 +32111,141 @@ def _sensor_catalog(
     }
 
 
+def _read_bounded_regular_json_object(
+    path: Path,
+    *,
+    maximum_bytes: int,
+) -> Mapping[str, Any] | None:
+    """Read one local audit object without symlink or unbounded-file trust."""
+
+    try:
+        metadata = path.lstat()
+        if (
+            not stat.S_ISREG(metadata.st_mode)
+            or metadata.st_size <= 0
+            or metadata.st_size > maximum_bytes
+        ):
+            return None
+        descriptor = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+        try:
+            opened = os.fstat(descriptor)
+            if (opened.st_dev, opened.st_ino) != (metadata.st_dev, metadata.st_ino):
+                return None
+            chunks: list[bytes] = []
+            remaining = maximum_bytes + 1
+            while remaining > 0:
+                chunk = os.read(descriptor, remaining)
+                if not chunk:
+                    break
+                chunks.append(chunk)
+                remaining -= len(chunk)
+            payload = b"".join(chunks)
+            if len(payload) > maximum_bytes:
+                return None
+        finally:
+            os.close(descriptor)
+        current = path.lstat()
+        if (current.st_dev, current.st_ino) != (metadata.st_dev, metadata.st_ino):
+            return None
+        document = json.loads(payload.decode("utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError):
+        return None
+    return document if isinstance(document, Mapping) else None
+
+
+def _recover_durable_quick_connect_host_binding(
+    evidence_root: Path,
+    *,
+    transport_ref: str,
+    target_ipv4: str,
+) -> _DurableQuickConnectHostBinding | None:
+    """Recover an exact saved AP/profile binding without querying K1."""
+
+    if target_ipv4 != AP_FALLBACK_IPV4:
+        raise ConnectionVerificationError(
+            "Сохранённая Quick Connect topology содержит неожиданный адрес точки K1",
+            reason_code="connection-verify-quick-host-binding-invalid",
+        )
+    try:
+        session_entries = tuple(evidence_root.iterdir())
+    except OSError:
+        return None
+    candidates: list[tuple[int, Path]] = []
+    for session_dir in session_entries:
+        if "viewer_k1_ap_association" not in session_dir.name:
+            continue
+        try:
+            session_metadata = session_dir.lstat()
+        except OSError:
+            continue
+        if not stat.S_ISDIR(session_metadata.st_mode):
+            continue
+        artifact = session_dir / "ap-activation.redacted.json"
+        try:
+            artifact_metadata = artifact.lstat()
+        except OSError:
+            continue
+        if not stat.S_ISREG(artifact_metadata.st_mode):
+            continue
+        candidates.append((artifact_metadata.st_mtime_ns, artifact))
+
+    for _, artifact in sorted(candidates, key=lambda item: item[0], reverse=True):
+        activation = _read_bounded_regular_json_object(
+            artifact,
+            maximum_bytes=DURABLE_QUICK_CONNECT_BINDING_EVIDENCE_MAX_BYTES,
+        )
+        if activation is None:
+            continue
+        evidence_transport_ref = activation.get("device_macos_uuid")
+        if not (
+            isinstance(evidence_transport_ref, str)
+            and physical_transport_ref_comparison_key(evidence_transport_ref)
+            == physical_transport_ref_comparison_key(transport_ref)
+        ):
+            continue
+        device_name = activation.get("device_name")
+        observations = activation.get("observations")
+        exact_ap_observed = bool(
+            isinstance(observations, list)
+            and any(
+                isinstance(observation, Mapping)
+                and isinstance(observation.get("status"), Mapping)
+                and observation["status"].get("mode") == "WIFI_AP"
+                and observation["status"].get("ipv4") == target_ipv4
+                for observation in observations
+            )
+        )
+        if not (
+            activation.get("operation")
+            == "single_reviewed_quick_connect_ap_activation"
+            and activation.get("outcome") == "ap_ready_observed"
+            and activation.get("ready_observed") is True
+            and activation.get("write_performed") is True
+            and isinstance(device_name, str)
+            and exact_ap_observed
+        ):
+            raise ConnectionVerificationError(
+                "Сохранённая привязка Quick Connect этого K1 не прошла проверку",
+                reason_code="connection-verify-quick-host-binding-invalid",
+            )
+        normalized_ssid = unicodedata.normalize("NFC", device_name).strip()
+        try:
+            profile_id = quick_connect_host_profile_id(normalized_ssid)
+        except ValueError as exc:
+            raise ConnectionVerificationError(
+                "Сохранённое имя Wi-Fi этого K1 не прошло проверку",
+                reason_code="connection-verify-quick-host-binding-invalid",
+            ) from exc
+        return _DurableQuickConnectHostBinding(
+            transport_ref=evidence_transport_ref,
+            target_ipv4=target_ipv4,
+            expected_ssid=normalized_ssid,
+            profile_id=profile_id,
+            activation_evidence_path=artifact,
+        )
+    return None
+
+
 def _new_operation_session_dir(sessions_root: Path, suffix: str) -> Path:
     stamp = datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
     base = sessions_root / f"{stamp}_{suffix}"
@@ -31474,6 +32403,21 @@ def _physical_command_reports_active(
     )
 
 
+def _physical_start_requires_canonical_stop_before_local_teardown(
+    physical_command: Mapping[str, object],
+) -> bool:
+    """Fail closed once START is active or its durable outcome is unsettled."""
+
+    if _physical_command_reports_active(physical_command):
+        return True
+    record = physical_command.get("record")
+    if not isinstance(record, Mapping) or record.get("action") != "start":
+        return False
+    if record.get("resolution") == "not-dispatched":
+        return False
+    return physical_command.get("status") in {"unresolved", "corrupt"}
+
+
 def _physical_command_pending_reopened_reconciliation_mode(
     physical_command: Mapping[str, object],
 ) -> ConnectionMode | None:
@@ -32605,6 +33549,14 @@ def _connection_policy_projection(
     local_receiver_stop_reasons: list[str] = []
     if not (acquisition_active or acquisition_cleanup_pending or runtime_active):
         local_receiver_stop_reasons.append("local-acquisition-receiver-not-active")
+    if (
+        acquisition_active
+        and acquisition_state in {"starting", "awaiting_external_start", "acquiring"}
+        and _physical_start_requires_canonical_stop_before_local_teardown(
+            physical_command
+        )
+    ):
+        local_receiver_stop_reasons.append("physical-start-requires-canonical-stop")
     local_receiver_stop = decision(
         local_receiver_stop_reasons,
         target_source="local-runtime",
@@ -33784,6 +34736,7 @@ def _post_dispatch_network_target(
     baseline_status: NetworkStatusEvidence,
     previous_connection: PreviousConnectionEvidence | None = None,
     expected_network_name: str | None = None,
+    write_confirmed: bool = False,
 ) -> str | None:
     """Return a target only when post-write status distinguishes the intent.
 
@@ -33814,6 +34767,14 @@ def _post_dispatch_network_target(
     if exact_station_target:
         return target
     if observed == baseline_status:
+        # Quick Connect has one exact, identity-bound target: the selected
+        # K1's canonical AP-ready status at 192.168.56.1.  A confirmed
+        # write-with-response is an idempotent ensure-target operation even
+        # when that target was already active before the click.  Merely
+        # observing the same status, or an unconfirmed/unknown dispatch, keeps
+        # the durable ambiguity barrier closed.
+        if connection_mode == "quick-connect" and write_confirmed:
+            return target
         return None
     same_transport_previous = bool(
         previous_connection is not None and previous_connection.transport_ref == transport_ref
@@ -33826,13 +34787,13 @@ def _post_dispatch_network_target(
             )
             is not None
         ):
-            return None
+            return target if write_confirmed else None
         if (
             same_transport_previous
             and previous_connection is not None
             and previous_connection.mode == "quick-connect"
         ):
-            return None
+            return target if write_confirmed else None
         return target
     if baseline_status.mode == "WIFI_CLIENT":
         return None
@@ -34000,6 +34961,7 @@ def _probe_configured_endpoint_host_only(
     target: str,
     *,
     path_probe: Callable[[str], HostPathProbeResult] | None = None,
+    require_direct_route_before_tcp: bool = False,
 ) -> _ConfiguredEndpointHostObservation:
     """Probe only a bounded kernel route and TCP socket, with no supervisor effects."""
 
@@ -34010,6 +34972,18 @@ def _probe_configured_endpoint_host_only(
             path=first_path,
             reachable=False,
             reason_code=first_path.reason_code or "host-route-unavailable",
+            initial_path=first_path,
+            tcp_probe_performed=False,
+            fingerprint_unchanged=None,
+        )
+    if require_direct_route_before_tcp and first_path.route_class != "direct":
+        return _ConfiguredEndpointHostObservation(
+            path=first_path,
+            reachable=False,
+            reason_code=first_path.reason_code or "host-route-not-direct",
+            initial_path=first_path,
+            tcp_probe_performed=False,
+            fingerprint_unchanged=None,
         )
     tcp = _probe_control_endpoint_socket(target)
     final_path = sample_path(target)
@@ -34032,6 +35006,165 @@ def _probe_configured_endpoint_host_only(
         path=final_path,
         reachable=reachable,
         reason_code=reason_code,
+        initial_path=first_path,
+        tcp_probe_performed=True,
+        tcp_reachable=tcp.reachable,
+        tcp_reason_code=tcp.reason_code,
+        fingerprint_unchanged=fingerprint_unchanged,
+    )
+
+
+def _probe_quick_connect_endpoint_after_route_settle(
+    target: str,
+    *,
+    path_probe: Callable[[str], HostPathProbeResult],
+    route_probe: Callable[[str], HostPathProbeResult] | None = None,
+    settle_timeout_seconds: float = DURABLE_QUICK_CONNECT_ROUTE_SETTLE_TIMEOUT_SECONDS,
+    settle_interval_seconds: float = DURABLE_QUICK_CONNECT_ROUTE_SETTLE_INTERVAL_SECONDS,
+    monotonic: Callable[[], float] = time.monotonic,
+    sleeper: Callable[[float], None] = time.sleep,
+) -> _ConfiguredEndpointHostObservation:
+    """Wait only for the post-association kernel route, then perform one TCP probe."""
+
+    if settle_timeout_seconds <= 0:
+        raise ValueError("Quick Connect route-settle timeout must be positive")
+    if settle_interval_seconds <= 0:
+        raise ValueError("Quick Connect route-settle interval must be positive")
+    target = validate_private_ipv4(target)
+    inspect_route = route_probe or _inspect_host_path
+    started = monotonic()
+    first_settle_path: HostPathProbeResult | None = None
+    latest_settle_path: HostPathProbeResult | None = None
+    sample_count = 0
+
+    while True:
+        latest_settle_path = inspect_route(target)
+        sample_count += 1
+        if first_settle_path is None:
+            first_settle_path = latest_settle_path
+        elapsed_seconds = max(0.0, monotonic() - started)
+        if latest_settle_path.available and latest_settle_path.route_class == "direct":
+            observation = _probe_configured_endpoint_host_only(
+                target,
+                path_probe=path_probe,
+                require_direct_route_before_tcp=True,
+            )
+            return dataclass_replace(
+                observation,
+                route_settle_initial_path=first_settle_path,
+                route_settle_final_path=latest_settle_path,
+                route_settle_sample_count=sample_count,
+                route_settle_elapsed_ms=int(round(elapsed_seconds * 1_000)),
+            )
+        remaining_seconds = settle_timeout_seconds - elapsed_seconds
+        if remaining_seconds <= 0:
+            return _ConfiguredEndpointHostObservation(
+                path=latest_settle_path,
+                reachable=False,
+                reason_code=(
+                    latest_settle_path.reason_code or "host-route-not-direct"
+                ),
+                initial_path=latest_settle_path,
+                tcp_probe_performed=False,
+                route_settle_initial_path=first_settle_path,
+                route_settle_final_path=latest_settle_path,
+                route_settle_sample_count=sample_count,
+                route_settle_elapsed_ms=int(round(elapsed_seconds * 1_000)),
+            )
+        sleeper(min(settle_interval_seconds, remaining_seconds))
+
+
+def _redacted_host_path_evidence(path: HostPathProbeResult) -> dict[str, Any]:
+    """Serialize only route identity facts safe for a Quick diagnostic artifact."""
+
+    return {
+        "available": path.available,
+        "interface": path.interface,
+        "source_ipv4": path.source_ipv4,
+        "route_class": path.route_class,
+        "reason_code": path.reason_code,
+        "fingerprint": path.fingerprint,
+        "kernel_route_fingerprint": path.kernel_route_fingerprint,
+        "observation_failure_class": path.observation_failure_class,
+    }
+
+
+def _write_quick_connect_host_network_proof(
+    association: _SavedQuickConnectHostAssociation,
+    *,
+    target_ipv4: str,
+    observation: _ConfiguredEndpointHostObservation | None,
+    outcome: str,
+    reason_code: str | None,
+    supervisor_host_path_epoch_before_admission: int | None,
+    supervisor_host_path_epoch_after_admission: int | None = None,
+) -> None:
+    """Persist one redacted CoreWLAN -> route -> TCP proof without K1 mutation."""
+
+    initial_path = (
+        observation.initial_path or observation.path if observation is not None else None
+    )
+    final_path = observation.path if observation is not None else None
+    write_json_atomic(
+        association.evidence_session_dir / "host-network-proof.redacted.json",
+        {
+            "schema": "missioncore.xgrids-k1-quick-host-network-proof/v1",
+            "completed_at_utc": _utc_now_iso(),
+            "target_ipv4": target_ipv4,
+            "association_outcome": association.result.get("outcome"),
+            "already_associated": association.result.get("already_associated"),
+            "route_before": (
+                _redacted_host_path_evidence(initial_path)
+                if initial_path is not None
+                else None
+            ),
+            "route_after": (
+                _redacted_host_path_evidence(final_path) if final_path is not None else None
+            ),
+            "route_settle": (
+                {
+                    "initial_route": _redacted_host_path_evidence(
+                        observation.route_settle_initial_path
+                    ),
+                    "final_route": _redacted_host_path_evidence(
+                        observation.route_settle_final_path
+                    ),
+                    "sample_count": observation.route_settle_sample_count,
+                    "elapsed_ms": observation.route_settle_elapsed_ms,
+                    "direct_route_observed": bool(
+                        observation.route_settle_final_path.available
+                        and observation.route_settle_final_path.route_class == "direct"
+                    ),
+                }
+                if observation is not None
+                and observation.route_settle_initial_path is not None
+                and observation.route_settle_final_path is not None
+                else None
+            ),
+            "tcp_probe_performed": (
+                observation.tcp_probe_performed if observation is not None else None
+            ),
+            "tcp_reachable": (
+                observation.tcp_reachable if observation is not None else None
+            ),
+            "tcp_reason_code": (
+                observation.tcp_reason_code if observation is not None else None
+            ),
+            "path_fingerprint_unchanged": (
+                observation.fingerprint_unchanged if observation is not None else None
+            ),
+            "outcome": outcome,
+            "reason_code": reason_code,
+            "supervisor_host_path_epoch_before_admission": (
+                supervisor_host_path_epoch_before_admission
+            ),
+            "supervisor_host_path_epoch_after_admission": (
+                supervisor_host_path_epoch_after_admission
+            ),
+            "ble_operation_performed": False,
+            "device_write_performed": False,
+            "automatic_retry": False,
+        },
     )
 
 
diff --git a/tests/test_xgrids_acquisition_lifecycle.py b/tests/test_xgrids_acquisition_lifecycle.py
index 644fb9b..3a1e558 100644
--- a/tests/test_xgrids_acquisition_lifecycle.py
+++ b/tests/test_xgrids_acquisition_lifecycle.py
@@ -365,6 +365,187 @@ def test_host_route_classifier_is_fail_closed_for_virtual_and_unknown_interfaces
     )
 
 
+@pytest.mark.parametrize(
+    "path",
+    [
+        HostPathProbeResult(
+            available=False,
+            fingerprint=None,
+            interface=None,
+            source_ipv4=None,
+            route_class="unavailable",
+            reason_code="host-route-unavailable",
+        ),
+        HostPathProbeResult(
+            available=True,
+            fingerprint="test-tunnel-route",
+            interface="utun-test",
+            source_ipv4="100.64.0.2",
+            route_class="tunnel",
+            reason_code="host-route-tunnel",
+        ),
+        HostPathProbeResult(
+            available=True,
+            fingerprint="test-default-route",
+            interface="test0",
+            source_ipv4="192.168.1.2",
+            route_class="default",
+            reason_code="host-route-default",
+        ),
+    ],
+)
+def test_quick_host_probe_rejects_unproven_direct_route_before_tcp(
+    monkeypatch: pytest.MonkeyPatch,
+    path: HostPathProbeResult,
+) -> None:
+    tcp_calls: list[str] = []
+
+    def forbidden_tcp(target: str) -> facade_module.TcpReachabilityProbeResult:
+        tcp_calls.append(target)
+        raise AssertionError("Quick probe must not open TCP before a direct route")
+
+    monkeypatch.setattr(
+        facade_module,
+        "_probe_control_endpoint_socket",
+        forbidden_tcp,
+    )
+
+    observation = facade_module._probe_configured_endpoint_host_only(  # noqa: SLF001
+        "192.168.56.1",
+        path_probe=lambda _target: path,
+        require_direct_route_before_tcp=True,
+    )
+
+    assert tcp_calls == []
+    assert observation.path == path
+    assert observation.initial_path == path
+    assert observation.reachable is False
+    assert observation.tcp_probe_performed is False
+    assert observation.tcp_reachable is None
+    assert observation.tcp_reason_code is None
+    assert observation.fingerprint_unchanged is None
+
+
+@pytest.mark.parametrize("route_changes", [False, True])
+def test_quick_host_probe_uses_one_tcp_between_two_direct_route_samples(
+    monkeypatch: pytest.MonkeyPatch,
+    route_changes: bool,
+) -> None:
+    first_path = _direct_host_path("192.168.56.1")
+    final_path = (
+        replace(first_path, fingerprint="test-route:changed")
+        if route_changes
+        else first_path
+    )
+    path_samples = iter((first_path, final_path))
+    tcp_calls: list[str] = []
+
+    def reachable_tcp(target: str) -> facade_module.TcpReachabilityProbeResult:
+        tcp_calls.append(target)
+        return facade_module.TcpReachabilityProbeResult(reachable=True)
+
+    monkeypatch.setattr(
+        facade_module,
+        "_probe_control_endpoint_socket",
+        reachable_tcp,
+    )
+
+    observation = facade_module._probe_configured_endpoint_host_only(  # noqa: SLF001
+        "192.168.56.1",
+        path_probe=lambda _target: next(path_samples),
+        require_direct_route_before_tcp=True,
+    )
+
+    assert tcp_calls == ["192.168.56.1"]
+    assert observation.initial_path == first_path
+    assert observation.path == final_path
+    assert observation.tcp_probe_performed is True
+    assert observation.tcp_reachable is True
+    assert observation.tcp_reason_code is None
+    assert observation.fingerprint_unchanged is (not route_changes)
+    assert observation.reachable is (not route_changes)
+    assert observation.reason_code == (
+        "host-route-changed-during-tcp-probe" if route_changes else None
+    )
+
+
+def test_quick_route_settle_waits_for_direct_route_then_uses_one_tcp(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    tunnel_path = _tunnel_host_path("192.168.56.1")
+    direct_path = _direct_host_path("192.168.56.1")
+    settle_paths = iter((tunnel_path, tunnel_path, direct_path))
+    clock = [0.0]
+    tcp_calls: list[str] = []
+
+    def reachable_tcp(target: str) -> facade_module.TcpReachabilityProbeResult:
+        tcp_calls.append(target)
+        return facade_module.TcpReachabilityProbeResult(reachable=True)
+
+    monkeypatch.setattr(
+        facade_module,
+        "_probe_control_endpoint_socket",
+        reachable_tcp,
+    )
+
+    observation = facade_module._probe_quick_connect_endpoint_after_route_settle(  # noqa: SLF001
+        "192.168.56.1",
+        path_probe=_direct_host_path,
+        route_probe=lambda _target: next(settle_paths),
+        settle_timeout_seconds=2.0,
+        settle_interval_seconds=0.5,
+        monotonic=lambda: clock[0],
+        sleeper=lambda delay: clock.__setitem__(0, clock[0] + delay),
+    )
+
+    assert tcp_calls == ["192.168.56.1"]
+    assert observation.reachable is True
+    assert observation.tcp_probe_performed is True
+    assert observation.route_settle_initial_path == tunnel_path
+    assert observation.route_settle_final_path == direct_path
+    assert observation.route_settle_sample_count == 3
+    assert observation.route_settle_elapsed_ms == 1_000
+
+
+def test_quick_route_settle_timeout_never_opens_tcp(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    tunnel_path = _tunnel_host_path("192.168.56.1")
+    clock = [0.0]
+    tcp_calls: list[str] = []
+
+    def forbidden_tcp(target: str) -> facade_module.TcpReachabilityProbeResult:
+        tcp_calls.append(target)
+        raise AssertionError("route-settle timeout must fail before TCP")
+
+    monkeypatch.setattr(
+        facade_module,
+        "_probe_control_endpoint_socket",
+        forbidden_tcp,
+    )
+
+    observation = facade_module._probe_quick_connect_endpoint_after_route_settle(  # noqa: SLF001
+        "192.168.56.1",
+        path_probe=lambda _target: (_ for _ in ()).throw(
+            AssertionError("full path proof must wait for a direct route")
+        ),
+        route_probe=lambda _target: tunnel_path,
+        settle_timeout_seconds=1.0,
+        settle_interval_seconds=0.5,
+        monotonic=lambda: clock[0],
+        sleeper=lambda delay: clock.__setitem__(0, clock[0] + delay),
+    )
+
+    assert tcp_calls == []
+    assert observation.path == tunnel_path
+    assert observation.reachable is False
+    assert observation.tcp_probe_performed is False
+    assert observation.route_settle_initial_path == tunnel_path
+    assert observation.route_settle_final_path == tunnel_path
+    assert observation.route_settle_sample_count == 3
+    assert observation.route_settle_elapsed_ms == 1_000
+
+
 class FakeHostWifiAssociationProbe:
     def __init__(self, *continuity_tokens: str) -> None:
         self._continuity_tokens = continuity_tokens or ("a" * 64,)
@@ -3927,6 +4108,40 @@ def test_post_dispatch_bridge_rejects_another_fw302_network_name() -> None:
     )
 
 
+def test_post_dispatch_quick_connect_accepts_confirmed_idempotent_ap_ready() -> None:
+    status = _ap_ready_wifi_status()
+    baseline = NetworkStatusEvidence("WIFI_AP", "192.168.56.1", 1, 1)
+    previous = PreviousConnectionEvidence(
+        "same-k1",
+        "quick-connect",
+        "192.168.56.1",
+        "old-session",
+    )
+
+    assert (
+        facade_module._post_dispatch_network_target(  # noqa: SLF001
+            "quick-connect",
+            status,
+            transport_ref="same-k1",
+            baseline_status=baseline,
+            previous_connection=previous,
+            write_confirmed=True,
+        )
+        == "192.168.56.1"
+    )
+    assert (
+        facade_module._post_dispatch_network_target(  # noqa: SLF001
+            "quick-connect",
+            status,
+            transport_ref="same-k1",
+            baseline_status=baseline,
+            previous_connection=previous,
+            write_confirmed=False,
+        )
+        is None
+    )
+
+
 def _seed_unresolved_network_mutation(
     service: XgridsK1CompatibilityService,
     *,
@@ -5053,6 +5268,12 @@ def test_ble_scan_operation_id_is_exactly_once_and_request_bound(
     assert transport_calls == 1
     assert first["devices"][0]["connectable"] is None
     assert first["last_operation"]["operation_id"] == operation_id
+    assert first["last_operation"]["result"] == {
+        "candidate_count": 1,
+        "likely_k1_candidate_count": 1,
+        "duration_seconds": 6.0,
+        "discovery_generation": 1,
+    }
     assert repeated["last_operation"]["operation_id"] == operation_id
     with pytest.raises(ValueError, match="different request"):
         asyncio.run(
@@ -7424,6 +7645,76 @@ def test_operator_manual_start_is_confirmed_only_by_real_point_data(tmp_path: Pa
     assert acquiring["last_operation"]["result"]["confirmation"] == "point-frame"
 
 
+@pytest.mark.parametrize("physical_resolved", [False, True])
+def test_plugin_commanded_calibration_rejects_local_stop_and_abort_after_physical_start(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    physical_resolved: bool,
+) -> None:
+    service, runtime = service_with_fake_runtime(tmp_path)
+    control = FakeInteractiveControlSession()
+    service._application_control_session = control  # type: ignore[assignment]  # noqa: SLF001
+    binding = _seed_supervised_connection(service)
+    service._compatibility_attestation = ATTESTATION.model_dump(mode="json")  # noqa: SLF001
+    prepared = service.prepare_acquisition(
+        _prepare_request(
+            project_name="CALIBRATION_GUARD",
+            host=binding.target_ipv4,
+            compatibility_attestation=ATTESTATION,
+        )
+    )
+    acquisition_id = str(prepared["acquisition"]["acquisition_id"])
+    service.start_acquisition(
+        _start_request(
+            acquisition_id=acquisition_id,
+            physical_acceptance=PHYSICAL_ACCEPTANCE,
+        )
+    )
+    start_operation_id = service._acquisition_start_operation_id  # noqa: SLF001
+    assert isinstance(start_operation_id, str)
+    physical_proof = _exact_start_physical_proof(
+        operation_id=start_operation_id,
+        acquisition_id=acquisition_id,
+        binding=binding,
+        resolved=physical_resolved,
+    )
+    monkeypatch.setattr(
+        service._physical_command_coordinator,  # noqa: SLF001
+        "snapshot",
+        lambda: physical_proof,
+    )
+
+    guarded = service.state()
+    guarded_state = str(guarded["acquisition"]["state"])
+    assert guarded_state in {"starting", "awaiting_external_start", "acquiring"}
+    local_stop_policy = guarded["connection_policy"]["actions"]["stop-local-receiver"]
+    assert local_stop_policy["allowed"] is False
+    assert "physical-start-requires-canonical-stop" in local_stop_policy["reason_codes"]
+    before_operations = tuple(service._operations.snapshot())  # noqa: SLF001
+
+    with pytest.raises(
+        facade_module.LocalAcquisitionLifecycleError,
+        match="физического START до канонического STOP",
+    ) as local_stop_error:
+        service.stop_acquisition(
+            _stop_request(acquisition_id=acquisition_id, mode="capture-only")
+        )
+    assert local_stop_error.value.reason_code == (
+        "acquisition-local-stop-requires-canonical-stop"
+    )
+
+    with pytest.raises(
+        facade_module.LocalAcquisitionLifecycleError,
+        match="физического START до канонического STOP",
+    ) as abort_error:
+        service.abort_acquisition(_abort_request(acquisition_id=acquisition_id))
+    assert abort_error.value.reason_code == "acquisition-abort-requires-canonical-stop"
+    assert tuple(service._operations.snapshot()) == before_operations  # noqa: SLF001
+    assert service._acquisition is not None  # noqa: SLF001
+    assert service._acquisition.state == guarded_state  # noqa: SLF001
+    assert runtime.stop_calls == 0
+
+
 @pytest.mark.parametrize("proof_first", [False, True])
 def test_plugin_commanded_acquisition_keeps_start_and_stop_as_explicit_actions(
     tmp_path: Path,
@@ -8849,20 +9140,22 @@ def test_local_force_finish_defers_without_mutation_while_dispatch_gate_is_owned
 def test_scenario_reset_fences_prepared_stop_before_local_cleanup_and_durable_retirement(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
 ) -> None:
     service, runtime = service_with_fake_runtime(tmp_path)
     fixture = _install_real_prepared_stop_dispatch_fixture(service, runtime)
     service.stop_acquisition(fixture.request)
     monkeypatch.setattr(service, "_seal_acquisition_capture_clock", lambda: None)
 
-    reset = service.select_connection_mode(
-        DesiredConnectionModeRequest(
-            connection_mode="quick-connect",
-            expected_revision=service.state()["desired_connection_mode_revision"],
-            reset_scenario=True,
-            reset_id="prepared-stop-reset-0001",
+    with caplog.at_level(logging.INFO, logger=facade_module.__name__):
+        reset = service.select_connection_mode(
+            DesiredConnectionModeRequest(
+                connection_mode="quick-connect",
+                expected_revision=service.state()["desired_connection_mode_revision"],
+                reset_scenario=True,
+                reset_id="prepared-stop-reset-0001",
+            )
         )
-    )
 
     operation = service._operations.get(fixture.stop_operation_id)  # noqa: SLF001
     assert operation.status == "failed"
@@ -8876,6 +9169,34 @@ def test_scenario_reset_fences_prepared_stop_before_local_cleanup_and_durable_re
     assert record.resolution == "not-dispatched"
     assert reset["connection_scenario_reset"]["physical_disposition"] == "not-dispatched"
     assert reset["connection_scenario_reset"]["device_command_performed"] is False
+    timing = reset["connection_scenario_reset"]["timing"]
+    assert timing["schema_version"] == (
+        "missioncore.xgrids-k1-connection-scenario-reset-timing/v1"
+    )
+    assert timing["started_at_utc"].endswith("Z")
+    assert timing["completed_at_utc"].endswith("Z")
+    stage_names = (
+        "lifecycle_boundary_wait_ms",
+        "monitor_quiescence_wait_ms",
+        "local_retirement_ms",
+        "intent_commit_ms",
+    )
+    assert isinstance(timing["total_ms"], int)
+    assert timing["total_ms"] >= 0
+    for stage_name in stage_names:
+        assert isinstance(timing[stage_name], int)
+        assert timing[stage_name] >= 0
+        assert timing["total_ms"] >= timing[stage_name]
+    timing_records = [
+        record
+        for record in caplog.records
+        if getattr(record, "event_code", None)
+        == "k1_connection_scenario_reset_timing"
+    ]
+    assert len(timing_records) == 1
+    assert timing_records[0].total_ms == timing["total_ms"]
+    assert timing_records[0].device_command_performed is False
+    assert timing_records[0].network_write_performed is False
     assert reset["acquisition"]["state"] == "interrupted"
     assert service._acquisition_stop_operation_id is None  # noqa: SLF001
     assert runtime.stop_calls == 1
@@ -19912,6 +20233,13 @@ def test_quick_connect_activates_the_device_ap_then_associates_the_host(
     assert '"host_wifi_association_performed": true' in redacted_manifest
     assert '"host_wifi_association_outcome": "associated"' in redacted_manifest
     assert (quick_sessions[0] / "ap-activation.redacted.json").exists()
+    host_association_evidence = json.loads(
+        (quick_sessions[0] / "host-wifi-association.redacted.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    assert host_association_evidence["outcome"] == "associated"
+    assert host_association_evidence["device_write_performed"] is True
     assert (
         service._camera_target_for_session(  # noqa: SLF001
             state["device_session"]["device_session_id"]
@@ -19940,6 +20268,149 @@ def test_quick_connect_activates_the_device_ap_then_associates_the_host(
     assert prepared["acquisition"]["target_host"] == "192.168.56.1"
 
 
+@pytest.mark.parametrize(
+    ("ble_runtime_after_handoff", "expected_success"),
+    (
+        (
+            {
+                "owner_epoch": 1,
+                "owner_loop_bound": True,
+                "active_operation_kind": None,
+                "cleanup_pending": False,
+                "poisoned": False,
+            },
+            True,
+        ),
+        (
+            {
+                "owner_epoch": 1,
+                "owner_loop_bound": True,
+                "active_operation_kind": "ap-enable",
+                "cleanup_pending": True,
+                "poisoned": True,
+            },
+            False,
+        ),
+    ),
+    ids=("clean-idle", "poisoned"),
+)
+def test_quick_connect_reconciles_post_association_session_exit_only_after_clean_idle(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    ble_runtime_after_handoff: dict[str, Any],
+    expected_success: bool,
+) -> None:
+    service, _ = service_with_fake_runtime(tmp_path)
+    mode_revision = _select_connection_mode(service, "quick-connect")
+    _set_scanned_devices(service, [{"device_id": "k1-a", "name": "XGR-TEST-A"}])
+    monkeypatch.setattr(
+        facade_module,
+        "ensure_wifi_profile_from_credential_source",
+        lambda *_args, **_kwargs: {
+            "schema_version": 1,
+            "adapter": "macOS Keychain",
+            "available": True,
+            "profile_enrolled": True,
+            "credential_source": "exact-firmware-profile",
+        },
+    )
+
+    @asynccontextmanager
+    async def activation_with_session_exit_error(
+        *_: object,
+        on_write_dispatch: Callable[[dict[str, Any], str], None] | None = None,
+        **__: object,
+    ) -> AsyncIterator[dict[str, Any]]:
+        _dispatch_test_network_write(on_write_dispatch)
+        yield {
+            "profile_id": "xgrids-k1-fw3-quick-connect-ap-v1",
+            "started_at_utc": "2026-08-22T16:30:06Z",
+            "completed_at_utc": "2026-08-22T16:30:12Z",
+            "outcome": "ap_ready_observed",
+            "ready_observed": True,
+            "write_performed": True,
+            "write_mode": "with_response",
+            "observations": [{"status": _ap_ready_wifi_status()}],
+        }
+        raise RuntimeError("synthetic BLE session-exit edge")
+
+    def associated_host(*_: object, **__: object) -> dict[str, Any]:
+        return {
+            "schema_version": 1,
+            "adapter": "CoreWLAN",
+            "outcome": "associated",
+            "already_associated": False,
+            "profile_enrolled": True,
+            "scan_attempt_count": 2,
+            "scan_elapsed_ms": 7420,
+            "credential_source": "exact-firmware-profile",
+        }
+
+    async def wait_for_observed_ble_idle(*, timeout_seconds: float) -> bool:
+        assert timeout_seconds == 1.0
+        return True
+
+    monkeypatch.setattr(
+        facade_module,
+        "device_ap_activation_session",
+        activation_with_session_exit_error,
+    )
+    monkeypatch.setattr(
+        facade_module,
+        "associate_with_wifi_profile_once",
+        associated_host,
+    )
+    monkeypatch.setattr(
+        facade_module,
+        "wait_for_ble_runtime_idle",
+        wait_for_observed_ble_idle,
+    )
+    monkeypatch.setattr(
+        facade_module,
+        "ble_runtime_snapshot",
+        lambda: ble_runtime_after_handoff,
+    )
+    monkeypatch.setattr(facade_module, "_target_is_local_ipv4", lambda _target: False)
+    monkeypatch.setattr(facade_module, "_inspect_host_path", _direct_host_path)
+    monkeypatch.setattr(facade_module, "_control_endpoint_reachable", lambda _target: True)
+
+    request = _connect_request(
+        device_id="k1-a",
+        connection_mode="quick-connect",
+        compatibility_attestation=QUICK_CONNECT_ATTESTATION,
+        expected_mode_revision=mode_revision,
+    )
+    if expected_success:
+        state = asyncio.run(service.connect(request))
+        assert state["connection_mode"] == "quick-connect"
+        assert state["last_operation"]["status"] == "succeeded"
+        event_stages = {
+            event["stage_code"] for event in state["last_operation"]["events"]
+        }
+        assert "ble-handoff-cleanup-reconciled" in event_stages
+    else:
+        with pytest.raises(RuntimeError, match="synthetic BLE session-exit edge"):
+            asyncio.run(service.connect(request))
+        state = service.state()
+        assert state["last_operation"]["status"] == "failed"
+        assert state["last_operation"]["error"]["safe_to_retry"] is False
+
+    quick_sessions = sorted(service.evidence_root.glob("*viewer_k1_ap_association*"))
+    assert len(quick_sessions) == 1
+    host_association = json.loads(
+        (quick_sessions[0] / "host-wifi-association.redacted.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    assert host_association["outcome"] == "associated"
+    cleanup_evidence_path = quick_sessions[0] / "ble-handoff-cleanup.redacted.json"
+    assert cleanup_evidence_path.exists() is expected_success
+    if expected_success:
+        cleanup_evidence = json.loads(cleanup_evidence_path.read_text(encoding="utf-8"))
+        assert cleanup_evidence["outcome"] == "clean-idle-after-session-exit-error"
+        assert cleanup_evidence["exception_type"] == "RuntimeError"
+
+
 def test_quick_connect_read_only_verify_requires_fresh_ble_status_without_write(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
@@ -20232,13 +20703,25 @@ def test_quick_connect_does_not_start_host_wifi_without_ap_ready_flag(
     assert reconciliation["ledger_revision"] == 3
 
 
-def test_quick_connect_unchanged_ready_baseline_does_not_associate_host_wifi(
+def test_quick_connect_unchanged_ready_baseline_accepts_confirmed_idempotent_target(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
 ) -> None:
     service, _ = service_with_fake_runtime(tmp_path)
     mode_revision = _select_connection_mode(service, "quick-connect")
     _set_scanned_devices(service, [{"device_id": "k1-a", "name": "XGR-TEST-A"}])
+    monkeypatch.setattr(
+        facade_module,
+        "_await_control_endpoint_reachable",
+        _reachable_control_endpoint,
+    )
+    monkeypatch.setattr(
+        facade_module,
+        "_control_endpoint_reachable",
+        lambda _target: True,
+    )
+    monkeypatch.setattr(facade_module, "_target_is_local_ipv4", lambda _target: False)
+    monkeypatch.setattr(facade_module, "_inspect_host_path", _direct_host_path)
     monkeypatch.setattr(
         facade_module,
         "ensure_wifi_profile_from_credential_source",
@@ -20272,8 +20755,25 @@ def test_quick_connect_unchanged_ready_baseline_does_not_associate_host_wifi(
             "observations": [{"status": ready_status}],
         }
 
-    def forbidden_association(*_: object, **__: object) -> dict[str, Any]:
-        raise AssertionError("baseline/previous AP-ready is not authority to mutate host Wi-Fi")
+    association_calls: list[str] = []
+
+    def already_associated(
+        _helper_path: Path,
+        _profile_id: str,
+        expected_ssid: str,
+        **__: object,
+    ) -> dict[str, Any]:
+        association_calls.append(expected_ssid)
+        return {
+            "schema_version": 1,
+            "adapter": "CoreWLAN",
+            "outcome": "already-associated",
+            "already_associated": True,
+            "profile_enrolled": False,
+            "scan_attempt_count": 1,
+            "scan_elapsed_ms": 10,
+            "credential_source": "exact-firmware-profile",
+        }
 
     monkeypatch.setattr(
         facade_module,
@@ -20283,35 +20783,29 @@ def test_quick_connect_unchanged_ready_baseline_does_not_associate_host_wifi(
     monkeypatch.setattr(
         facade_module,
         "associate_with_wifi_profile_once",
-        forbidden_association,
+        already_associated,
     )
 
-    with pytest.raises(facade_module.NetworkProvisioningConflict) as raised:
-        asyncio.run(
-            service.connect(
-                _connect_request(
-                    device_id="k1-a",
-                    connection_mode="quick-connect",
-                    compatibility_attestation=QUICK_CONNECT_ATTESTATION,
-                    expected_mode_revision=mode_revision,
-                )
+    state = asyncio.run(
+        service.connect(
+            _connect_request(
+                device_id="k1-a",
+                connection_mode="quick-connect",
+                compatibility_attestation=QUICK_CONNECT_ATTESTATION,
+                expected_mode_revision=mode_revision,
             )
         )
+    )
 
-    assert raised.value.reason_code == (
-        "network-provision-target-not-distinguishable-from-baseline"
-    )
-    state = service.state()
-    assert state["network_mutation_ledger"]["status"] == "unresolved"
-    assert state["network_mutation_ledger"]["stage"] == "observing"
-    assert state["semantic_topology_store"]["status"] == "empty"
-    assert state["selected_device_id"] is None
+    assert association_calls == ["XGR-TEST-A"]
+    assert state["connection_mode"] == "quick-connect"
+    assert state["k1_ip"] == "192.168.56.1"
+    assert state["network_mutation_ledger"]["status"] == "resolved"
+    assert state["network_mutation_ledger"]["resolution"] == "target-observed"
+    assert state["semantic_topology_store"]["status"] == "available"
     operation = next(item for item in state["operations"] if item["action"] == "network.provision")
-    assert operation["error"]["code"] == (
-        "network-provision-target-not-distinguishable-from-baseline"
-    )
-    assert operation["error"]["side_effect_status"] == "unknown"
-    assert operation["error"]["safe_to_retry"] is False
+    assert operation["status"] == "succeeded"
+    assert operation["result"]["host_wifi_association_outcome"] == "already-associated"
 
 
 def test_failed_connection_change_revokes_the_previous_route(
@@ -20914,6 +21408,67 @@ def test_read_only_reconciliation_terminalizes_the_matching_idempotency_edge(
     assert idempotency_record.terminal.side_effect_status == "reconciled"
 
 
+def test_quick_connect_read_only_reconciliation_accepts_confirmed_unchanged_ap_ready(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    service, _ = service_with_fake_runtime(tmp_path)
+    _select_connection_mode(service, "quick-connect")
+    _set_scanned_k1(service)
+    _seed_unresolved_network_mutation(
+        service,
+        operation_id="confirmed-idempotent-quick-connect",
+        intended_mode="quick-connect",
+        baseline_status=NetworkStatusEvidence(
+            mode="WIFI_AP",
+            ipv4="192.168.56.1",
+            status_code=1,
+            reserved=1,
+        ),
+    )
+    ledger_snapshot = service._network_mutation_ledger.snapshot()  # noqa: SLF001
+    assert ledger_snapshot.record is not None
+    service._network_mutation_ledger.mark_observing(  # noqa: SLF001
+        ledger_snapshot.record.operation_id,
+        expected_revision=ledger_snapshot.record.revision,
+        write_confirmed=True,
+        observation=NetworkStatusEvidence(
+            mode="WIFI_AP",
+            ipv4="192.168.56.1",
+            status_code=1,
+            reserved=1,
+        ),
+    )
+
+    async def read_current_status(*_: object, **__: object) -> dict[str, Any]:
+        status = _wifi_status_read("192.168.56.1")
+        status["status"] = _ap_ready_wifi_status()
+        return status
+
+    monkeypatch.setattr(facade_module, "read_wifi_status_once", read_current_status)
+    monkeypatch.setattr(facade_module, "_target_is_local_ipv4", lambda _target: False)
+    monkeypatch.setattr(facade_module, "_host_route_class", lambda _target: "device-ap")
+    monkeypatch.setattr(facade_module, "_inspect_host_path", _direct_host_path)
+    monkeypatch.setattr(facade_module, "_control_endpoint_reachable", lambda _target: True)
+
+    state = asyncio.run(
+        service.verify_connection(
+            ConnectionVerifyRequest(
+                device_id="test-ble-transport",
+                compatibility_attestation=QUICK_CONNECT_ATTESTATION,
+                expected_discovery_generation=0,
+            )
+        )
+    )
+
+    assert state["connection_mode"] == "quick-connect"
+    assert state["k1_ip"] == "192.168.56.1"
+    assert state["network_write_reconciliation"] is None
+    assert state["network_mutation_ledger"]["status"] == "resolved"
+    assert state["network_mutation_ledger"]["resolution"] == "target-observed"
+    assert state["network_provisioning_idempotency"]["status"] == "ready"
+
+
 def test_restart_interrupts_legacy_edge_before_optional_read_only_verify(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
@@ -21566,6 +22121,570 @@ def test_durable_restart_failed_status_keeps_ambiguity_and_does_not_pin(
     assert state["device_session"] is None
 
 
+def _seed_durable_quick_reconnect_evidence(
+    service: XgridsK1CompatibilityService,
+) -> None:
+    """Persist the exact secret-free Quick topology and AP activation proof."""
+
+    topology_store = service._semantic_topology_store  # noqa: SLF001
+    assert topology_store is not None
+    topology_store.commit(
+        transport_ref=DURABLE_K1_UUID,
+        connection_mode="quick-connect",
+        ipv4="192.168.56.1",
+        compatibility_profile_id=XGRIDS_K1_COMPATIBILITY_PROFILE_ID,
+        firmware_version="3.0.2",
+        source="ble-post-write-status",
+        observed_at_utc="2026-08-22T16:30:12.980Z",
+    )
+    activation_session = (
+        service.evidence_root / "20260822T163001Z_viewer_k1_ap_association"
+    )
+    activation_session.mkdir(parents=True)
+    (activation_session / "ap-activation.redacted.json").write_text(
+        json.dumps(
+            {
+                "operation": "single_reviewed_quick_connect_ap_activation",
+                "device_macos_uuid": DURABLE_K1_UUID,
+                "device_name": "XGR-A46BE7",
+                "outcome": "ap_ready_observed",
+                "ready_observed": True,
+                "write_performed": True,
+                "observations": [
+                    {
+                        "status": {
+                            "mode": "WIFI_AP",
+                            "ipv4": "192.168.56.1",
+                        }
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+
+
+def _successful_saved_quick_profile_association(*_: object, **__: object) -> dict[str, Any]:
+    return {
+        "schema_version": 1,
+        "adapter": "CoreWLAN",
+        "outcome": "associated",
+        "already_associated": False,
+        "profile_enrolled": True,
+        "scan_attempt_count": 2,
+        "scan_elapsed_ms": 850,
+        "credential_source": "exact-firmware-profile",
+    }
+
+
+def test_semantic_quick_restart_restores_saved_host_profile_before_endpoint_probe(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    first, _ = service_with_fake_runtime(tmp_path)
+    topology_store = first._semantic_topology_store  # noqa: SLF001
+    assert topology_store is not None
+    topology_store.commit(
+        transport_ref=DURABLE_K1_UUID,
+        connection_mode="quick-connect",
+        ipv4="192.168.56.1",
+        compatibility_profile_id=XGRIDS_K1_COMPATIBILITY_PROFILE_ID,
+        firmware_version="3.0.2",
+        source="ble-post-write-status",
+        observed_at_utc="2026-08-22T16:30:12.980Z",
+    )
+    activation_session = (
+        first.evidence_root / "20260822T163001Z_viewer_k1_ap_association"
+    )
+    activation_session.mkdir(parents=True)
+    (activation_session / "ap-activation.redacted.json").write_text(
+        json.dumps(
+            {
+                "operation": "single_reviewed_quick_connect_ap_activation",
+                "device_macos_uuid": DURABLE_K1_UUID,
+                "device_name": "XGR-A46BE7",
+                "outcome": "ap_ready_observed",
+                "ready_observed": True,
+                "write_performed": True,
+                "observations": [
+                    {
+                        "status": {
+                            "mode": "WIFI_AP",
+                            "ipv4": "192.168.56.1",
+                        }
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    restarted, _ = service_with_fake_runtime(tmp_path)
+    calls: list[str] = []
+    association_calls: list[tuple[Path, str, str, float, float]] = []
+    route_samples: list[HostPathProbeResult] = []
+
+    def associate_saved_profile(
+        helper_path: Path,
+        profile_id: str,
+        expected_ssid: str,
+        *,
+        scan_timeout_seconds: float,
+        timeout_seconds: float,
+        **_: object,
+    ) -> dict[str, Any]:
+        calls.append("host-association")
+        association_calls.append(
+            (
+                helper_path,
+                profile_id,
+                expected_ssid,
+                scan_timeout_seconds,
+                timeout_seconds,
+            )
+        )
+        return {
+            "schema_version": 1,
+            "adapter": "CoreWLAN",
+            "outcome": "associated",
+            "already_associated": False,
+            "profile_enrolled": True,
+            "scan_attempt_count": 2,
+            "scan_elapsed_ms": 850,
+            "credential_source": "exact-firmware-profile",
+        }
+
+    async def forbidden_status_read(*_: object, **__: object) -> dict[str, Any]:
+        raise AssertionError("saved Quick reconnect must not require BLE")
+
+    async def forbidden_network_write(*_: object, **__: object) -> dict[str, Any]:
+        raise AssertionError("saved Quick reconnect must not write to K1")
+
+    def endpoint_reachable(_target: str) -> facade_module.TcpReachabilityProbeResult:
+        calls.append("endpoint-probe")
+        return facade_module.TcpReachabilityProbeResult(reachable=True)
+
+    def settling_quick_route(target: str) -> HostPathProbeResult:
+        # The first raw sample is the no-mutation preflight that decides
+        # whether CoreWLAN needs to be invoked.  Keep the route non-direct for
+        # that sample, then reproduce one post-association settle interval.
+        path = (
+            _tunnel_host_path(target)
+            if len(route_samples) < 2
+            else _direct_host_path(target)
+        )
+        route_samples.append(path)
+        return path
+
+    monkeypatch.setattr(
+        facade_module,
+        "associate_with_wifi_profile_once",
+        associate_saved_profile,
+    )
+    monkeypatch.setattr(facade_module, "read_wifi_status_once", forbidden_status_read)
+    monkeypatch.setattr(facade_module, "provision_wifi_once", forbidden_network_write)
+    monkeypatch.setattr(
+        facade_module,
+        "device_ap_activation_session",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            AssertionError("saved Quick reconnect must not activate the K1 AP over BLE")
+        ),
+    )
+    monkeypatch.setattr(facade_module, "_target_is_local_ipv4", lambda _target: False)
+    monkeypatch.setattr(facade_module, "_inspect_host_path", settling_quick_route)
+    monkeypatch.setattr(facade_module, "_probe_control_endpoint_socket", endpoint_reachable)
+    monkeypatch.setattr(
+        facade_module,
+        "DURABLE_QUICK_CONNECT_ROUTE_SETTLE_INTERVAL_SECONDS",
+        0.001,
+    )
+
+    state = asyncio.run(
+        restarted.verify_connection(
+            ConnectionVerifyRequest(
+                device_id=DURABLE_K1_UUID,
+                source="durable-configured-state",
+                compatibility_attestation=QUICK_CONNECT_ATTESTATION,
+            )
+        )
+    )
+
+    assert calls.index("host-association") < calls.index("endpoint-probe")
+    assert len(association_calls) == 1
+    helper_path, profile_id, ssid, scan_timeout, timeout = association_calls[0]
+    assert helper_path.name == "associate_wifi.swift"
+    assert profile_id == facade_module.quick_connect_host_profile_id("XGR-A46BE7")
+    assert ssid == "XGR-A46BE7"
+    assert scan_timeout == (
+        facade_module.DURABLE_QUICK_CONNECT_ASSOCIATION_SCAN_TIMEOUT_SECONDS
+    )
+    assert timeout == facade_module.DURABLE_QUICK_CONNECT_ASSOCIATION_TIMEOUT_SECONDS
+    assert state["connection_mode"] == "quick-connect"
+    assert state["k1_ip"] == "192.168.56.1"
+    assert state["connection_supervisor"]["authority"]["control_allowed"] is True
+    assert state["connection_supervisor"]["authority"]["acquisition_start_allowed"] is True
+    reassociation_sessions = sorted(
+        restarted.evidence_root.glob("*viewer_k1_quick_connect_host_reassociation*")
+    )
+    assert len(reassociation_sessions) == 1
+    reassociation = json.loads(
+        (reassociation_sessions[0] / "host-wifi-reassociation.redacted.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    assert reassociation["outcome"] == "associated"
+    assert reassociation["association_performed"] is True
+    assert reassociation["route_preflight"]["route_class"] == "tunnel"
+    assert reassociation["device_write_performed"] is False
+    assert reassociation["automatic_retry"] is False
+    network_proof_path = reassociation_sessions[0] / "host-network-proof.redacted.json"
+    network_proof_text = network_proof_path.read_text(encoding="utf-8")
+    network_proof = json.loads(network_proof_text)
+    assert network_proof["outcome"] == "direct-endpoint-reachable"
+    assert network_proof["reason_code"] is None
+    assert network_proof["route_before"]["route_class"] == "direct"
+    assert network_proof["route_after"]["route_class"] == "direct"
+    assert network_proof["tcp_probe_performed"] is True
+    assert network_proof["tcp_reachable"] is True
+    assert network_proof["path_fingerprint_unchanged"] is True
+    assert network_proof["route_settle"]["direct_route_observed"] is True
+    assert network_proof["route_settle"]["sample_count"] == 2
+    assert network_proof["route_settle"]["initial_route"]["route_class"] == "tunnel"
+    assert network_proof["route_settle"]["final_route"]["route_class"] == "direct"
+    assert network_proof["supervisor_host_path_epoch_after_admission"] >= (
+        network_proof["supervisor_host_path_epoch_before_admission"]
+    )
+    assert network_proof["ble_operation_performed"] is False
+    assert network_proof["device_write_performed"] is False
+    assert network_proof["automatic_retry"] is False
+    assert "XGR-A46BE7" not in network_proof_text
+
+
+def test_semantic_quick_restart_skips_wifi_mutation_when_direct_route_already_exists(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    first, _ = service_with_fake_runtime(tmp_path)
+    _seed_durable_quick_reconnect_evidence(first)
+    restarted, _ = service_with_fake_runtime(tmp_path)
+    wifi_mutations: list[str] = []
+    tcp_calls: list[str] = []
+
+    def forbidden_wifi_mutation(*_: object, **__: object) -> dict[str, Any]:
+        wifi_mutations.append("associate")
+        raise AssertionError("an existing direct K1 route must not be torn down and rejoined")
+
+    async def forbidden_device_edge(*_: object, **__: object) -> dict[str, Any]:
+        raise AssertionError("saved Quick reconnect must not reach BLE or write K1")
+
+    def reachable_tcp(target: str) -> facade_module.TcpReachabilityProbeResult:
+        tcp_calls.append(target)
+        return facade_module.TcpReachabilityProbeResult(reachable=True)
+
+    monkeypatch.setattr(
+        facade_module,
+        "associate_with_wifi_profile_once",
+        forbidden_wifi_mutation,
+    )
+    monkeypatch.setattr(facade_module, "read_wifi_status_once", forbidden_device_edge)
+    monkeypatch.setattr(facade_module, "provision_wifi_once", forbidden_device_edge)
+    monkeypatch.setattr(
+        facade_module,
+        "device_ap_activation_session",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            AssertionError("saved Quick reconnect must not activate the K1 AP over BLE")
+        ),
+    )
+    monkeypatch.setattr(facade_module, "_target_is_local_ipv4", lambda _target: False)
+    monkeypatch.setattr(facade_module, "_inspect_host_path", _direct_host_path)
+    monkeypatch.setattr(facade_module, "_probe_control_endpoint_socket", reachable_tcp)
+
+    state = asyncio.run(
+        restarted.verify_connection(
+            ConnectionVerifyRequest(
+                device_id=DURABLE_K1_UUID,
+                source="durable-configured-state",
+                compatibility_attestation=QUICK_CONNECT_ATTESTATION,
+            )
+        )
+    )
+
+    assert wifi_mutations == []
+    assert tcp_calls == ["192.168.56.1"]
+    assert state["connection_supervisor"]["authority"]["control_allowed"] is True
+    reassociation_sessions = sorted(
+        restarted.evidence_root.glob("*viewer_k1_quick_connect_host_reassociation*")
+    )
+    assert len(reassociation_sessions) == 1
+    reassociation = json.loads(
+        (reassociation_sessions[0] / "host-wifi-reassociation.redacted.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    assert reassociation["outcome"] == "association-skipped-direct-route"
+    assert reassociation["association_performed"] is False
+    assert reassociation["route_preflight"]["route_class"] == "direct"
+    assert reassociation["device_write_performed"] is False
+    proof = json.loads(
+        (reassociation_sessions[0] / "host-network-proof.redacted.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    assert proof["outcome"] == "direct-endpoint-reachable"
+    assert proof["tcp_probe_performed"] is True
+    assert proof["tcp_reachable"] is True
+    assert proof["ble_operation_performed"] is False
+    assert proof["device_write_performed"] is False
+
+
+def test_semantic_quick_restart_rejects_non_direct_route_without_tcp_or_ble(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    first, _ = service_with_fake_runtime(tmp_path)
+    _seed_durable_quick_reconnect_evidence(first)
+    restarted, _ = service_with_fake_runtime(tmp_path)
+    device_edges: list[str] = []
+    tcp_calls: list[str] = []
+
+    async def forbidden_device_edge(*_: object, **__: object) -> dict[str, Any]:
+        device_edges.append("device")
+        raise AssertionError("failed Quick host proof must not reach BLE or a K1 write")
+
+    def forbidden_tcp(target: str) -> facade_module.TcpReachabilityProbeResult:
+        tcp_calls.append(target)
+        raise AssertionError("non-direct Quick route must be rejected before TCP")
+
+    monkeypatch.setattr(
+        facade_module,
+        "associate_with_wifi_profile_once",
+        _successful_saved_quick_profile_association,
+    )
+    monkeypatch.setattr(facade_module, "read_wifi_status_once", forbidden_device_edge)
+    monkeypatch.setattr(facade_module, "provision_wifi_once", forbidden_device_edge)
+    monkeypatch.setattr(
+        facade_module,
+        "device_ap_activation_session",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            AssertionError("durable Quick reconnect must not activate the AP over BLE")
+        ),
+    )
+    monkeypatch.setattr(facade_module, "_inspect_host_path", _tunnel_host_path)
+    monkeypatch.setattr(facade_module, "_probe_control_endpoint_socket", forbidden_tcp)
+    monkeypatch.setattr(
+        facade_module,
+        "DURABLE_QUICK_CONNECT_ROUTE_SETTLE_TIMEOUT_SECONDS",
+        0.001,
+    )
+    monkeypatch.setattr(
+        facade_module,
+        "DURABLE_QUICK_CONNECT_ROUTE_SETTLE_INTERVAL_SECONDS",
+        0.001,
+    )
+
+    with pytest.raises(facade_module.ConnectionVerificationError) as raised:
+        asyncio.run(
+            restarted.verify_connection(
+                ConnectionVerifyRequest(
+                    device_id=DURABLE_K1_UUID,
+                    source="durable-configured-state",
+                    compatibility_attestation=QUICK_CONNECT_ATTESTATION,
+                )
+            )
+        )
+
+    assert raised.value.reason_code == "connection-verify-route-mismatch"
+    assert device_edges == []
+    assert tcp_calls == []
+    state = restarted.state()
+    assert state["last_operation"]["error"]["code"] == (
+        "connection-verify-route-mismatch"
+    )
+    reassociation_sessions = sorted(
+        restarted.evidence_root.glob("*viewer_k1_quick_connect_host_reassociation*")
+    )
+    assert len(reassociation_sessions) == 1
+    proof_path = reassociation_sessions[0] / "host-network-proof.redacted.json"
+    proof_text = proof_path.read_text(encoding="utf-8")
+    proof = json.loads(proof_text)
+    assert proof["outcome"] == "route-rejected"
+    assert proof["reason_code"] == "connection-verify-route-mismatch"
+    assert proof["route_before"]["route_class"] == "tunnel"
+    assert proof["route_after"]["route_class"] == "tunnel"
+    assert proof["tcp_probe_performed"] is False
+    assert proof["tcp_reachable"] is None
+    assert proof["path_fingerprint_unchanged"] is None
+    assert proof["route_settle"]["direct_route_observed"] is False
+    assert proof["route_settle"]["sample_count"] >= 2
+    assert proof["ble_operation_performed"] is False
+    assert proof["device_write_performed"] is False
+    assert "XGR-A46BE7" not in proof_text
+
+
+def test_semantic_quick_restart_tcp_timeout_fails_without_ble_fallback(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    first, _ = service_with_fake_runtime(tmp_path)
+    _seed_durable_quick_reconnect_evidence(first)
+    restarted, _ = service_with_fake_runtime(tmp_path)
+    device_edges: list[str] = []
+    tcp_calls: list[str] = []
+
+    async def forbidden_device_edge(*_: object, **__: object) -> dict[str, Any]:
+        device_edges.append("device")
+        raise AssertionError("failed Quick TCP proof must not fall back to BLE or write K1")
+
+    def timed_out_tcp(target: str) -> facade_module.TcpReachabilityProbeResult:
+        tcp_calls.append(target)
+        return facade_module.TcpReachabilityProbeResult(
+            reachable=False,
+            reason_code="tcp-connection-timeout",
+        )
+
+    monkeypatch.setattr(
+        facade_module,
+        "associate_with_wifi_profile_once",
+        _successful_saved_quick_profile_association,
+    )
+    monkeypatch.setattr(facade_module, "read_wifi_status_once", forbidden_device_edge)
+    monkeypatch.setattr(facade_module, "provision_wifi_once", forbidden_device_edge)
+    monkeypatch.setattr(
+        facade_module,
+        "device_ap_activation_session",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            AssertionError("durable Quick reconnect must not activate the AP over BLE")
+        ),
+    )
+    monkeypatch.setattr(facade_module, "_inspect_host_path", _direct_host_path)
+    monkeypatch.setattr(facade_module, "_probe_control_endpoint_socket", timed_out_tcp)
+
+    with pytest.raises(facade_module.ConnectionVerificationError) as raised:
+        asyncio.run(
+            restarted.verify_connection(
+                ConnectionVerifyRequest(
+                    device_id=DURABLE_K1_UUID,
+                    source="durable-configured-state",
+                    compatibility_attestation=QUICK_CONNECT_ATTESTATION,
+                )
+            )
+        )
+
+    assert raised.value.reason_code == "connection-verify-mqtt-unreachable"
+    assert device_edges == []
+    assert tcp_calls == ["192.168.56.1"]
+    state = restarted.state()
+    assert state["last_operation"]["error"]["code"] == (
+        "connection-verify-mqtt-unreachable"
+    )
+    reassociation_sessions = sorted(
+        restarted.evidence_root.glob("*viewer_k1_quick_connect_host_reassociation*")
+    )
+    assert len(reassociation_sessions) == 1
+    proof_path = reassociation_sessions[0] / "host-network-proof.redacted.json"
+    proof_text = proof_path.read_text(encoding="utf-8")
+    proof = json.loads(proof_text)
+    assert proof["outcome"] == "endpoint-unreachable"
+    assert proof["reason_code"] == "connection-verify-mqtt-unreachable"
+    assert proof["route_before"]["route_class"] == "direct"
+    assert proof["route_after"]["route_class"] == "direct"
+    assert proof["tcp_probe_performed"] is True
+    assert proof["tcp_reachable"] is False
+    assert proof["tcp_reason_code"] == "tcp-connection-timeout"
+    assert proof["path_fingerprint_unchanged"] is True
+    assert proof["route_settle"]["direct_route_observed"] is True
+    assert proof["route_settle"]["sample_count"] == 1
+    assert proof["ble_operation_performed"] is False
+    assert proof["device_write_performed"] is False
+    assert "XGR-A46BE7" not in proof_text
+
+
+def test_semantic_quick_restart_rejects_route_change_during_single_tcp_probe(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    first, _ = service_with_fake_runtime(tmp_path)
+    _seed_durable_quick_reconnect_evidence(first)
+    restarted, _ = service_with_fake_runtime(tmp_path)
+    device_edges: list[str] = []
+    tcp_calls: list[str] = []
+    initial_path = _direct_host_path("192.168.56.1")
+    changed_path = replace(
+        initial_path,
+        fingerprint="test-route:192.168.56.1:changed",
+        kernel_route_fingerprint="test-route:192.168.56.1:changed",
+    )
+    # Direct-route no-mutation preflight, route-settle sample, then the two
+    # exact samples bracketing the sole TCP probe.
+    path_samples = iter((initial_path, initial_path, initial_path, changed_path))
+
+    async def forbidden_device_edge(*_: object, **__: object) -> dict[str, Any]:
+        device_edges.append("device")
+        raise AssertionError("Quick route race must fail before BLE or a K1 write")
+
+    def reachable_tcp(target: str) -> facade_module.TcpReachabilityProbeResult:
+        tcp_calls.append(target)
+        return facade_module.TcpReachabilityProbeResult(reachable=True)
+
+    monkeypatch.setattr(
+        facade_module,
+        "associate_with_wifi_profile_once",
+        _successful_saved_quick_profile_association,
+    )
+    monkeypatch.setattr(facade_module, "read_wifi_status_once", forbidden_device_edge)
+    monkeypatch.setattr(facade_module, "provision_wifi_once", forbidden_device_edge)
+    monkeypatch.setattr(
+        facade_module,
+        "device_ap_activation_session",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            AssertionError("durable Quick reconnect must not activate the AP over BLE")
+        ),
+    )
+    monkeypatch.setattr(
+        facade_module,
+        "_inspect_host_path",
+        lambda _target: next(path_samples),
+    )
+    monkeypatch.setattr(facade_module, "_probe_control_endpoint_socket", reachable_tcp)
+
+    with pytest.raises(facade_module.ConnectionVerificationError) as raised:
+        asyncio.run(
+            restarted.verify_connection(
+                ConnectionVerifyRequest(
+                    device_id=DURABLE_K1_UUID,
+                    source="durable-configured-state",
+                    compatibility_attestation=QUICK_CONNECT_ATTESTATION,
+                )
+            )
+        )
+
+    assert raised.value.reason_code == "connection-verify-lease-changed"
+    assert device_edges == []
+    assert tcp_calls == ["192.168.56.1"]
+    state = restarted.state()
+    assert state["last_operation"]["error"]["code"] == (
+        "connection-verify-lease-changed"
+    )
+    reassociation_sessions = sorted(
+        restarted.evidence_root.glob("*viewer_k1_quick_connect_host_reassociation*")
+    )
+    assert len(reassociation_sessions) == 1
+    proof = json.loads(
+        (reassociation_sessions[0] / "host-network-proof.redacted.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    assert proof["outcome"] == "route-changed"
+    assert proof["reason_code"] == "connection-verify-lease-changed"
+    assert proof["tcp_probe_performed"] is True
+    assert proof["tcp_reachable"] is True
+    assert proof["path_fingerprint_unchanged"] is False
+    assert proof["route_settle"]["direct_route_observed"] is True
+    assert proof["route_settle"]["sample_count"] == 1
+    assert proof["ble_operation_performed"] is False
+    assert proof["device_write_performed"] is False
+
+
 def test_semantic_only_durable_restart_uses_lan_and_mqtt_identity_not_ble(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
@@ -21609,6 +22728,13 @@ def test_semantic_only_durable_restart_uses_lan_and_mqtt_identity_not_ble(
         raise AssertionError("semantic observation must not write")
 
     monkeypatch.setattr(facade_module, "provision_wifi_once", forbidden_network_write)
+    monkeypatch.setattr(
+        facade_module,
+        "associate_with_wifi_profile_once",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            AssertionError("Bridge durable Verify must not change host Wi-Fi association")
+        ),
+    )
     monkeypatch.setattr(
         facade_module,
         "pin_connected_device_handle",
@@ -25341,6 +26467,84 @@ def test_configured_unverified_monitor_keeps_same_route_without_promoting_author
         assert "verify-control-device-info" in retained.allowed_actions
 
 
+def test_quick_bootstrap_retains_timeout_route_across_privacy_limited_observer(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    service, _ = service_with_fake_runtime(tmp_path)
+    raw_path = _direct_host_path("192.168.56.1")
+    timeout_bound_path = replace(
+        raw_path,
+        fingerprint="quick-timeout-bound-route",
+        reason_code="host-wifi-operation-timeout",
+        observation_failure_class="association-observer",
+        kernel_route_fingerprint=raw_path.fingerprint,
+    )
+    binding = _seed_supervised_connection(
+        service,
+        target_ipv4="192.168.56.1",
+        connection_mode="quick-connect",
+        host_path=timeout_bound_path,
+        with_control=False,
+    )
+    baseline = service._connection_supervisor.snapshot()  # noqa: SLF001
+
+    monkeypatch.setattr(facade_module, "_inspect_host_path", lambda _target: raw_path)
+    monkeypatch.setattr(
+        service._host_wifi_association_probe,  # noqa: SLF001
+        "observe",
+        lambda *_args, **_kwargs: {
+            "schema_version": 1,
+            "adapter": "CoreWLAN",
+            "wifi_interface": True,
+            "association_state": "unavailable",
+            "evidence_quality": "unavailable",
+            "continuity_proven": False,
+            "continuity_token": "d" * 64,
+            "reason_code": "association-identity-unavailable",
+        },
+    )
+
+    sampled_paths: list[HostPathProbeResult] = []
+    observed_epochs: list[int | None] = []
+    # The real worker validates the path once before opening MQTT and once
+    # more under the exact DeviceInfo publish fence. Both observations must
+    # retain the same admitted route while DeviceInfo authority is absent.
+    for _stage in ("control-open-preflight", "control-publish-dispatch"):
+        sampled = service._sample_host_path(binding.target_ipv4)  # noqa: SLF001
+        sampled_paths.append(sampled)
+        observed_epochs.append(
+            service._connection_supervisor.observe_host_path_if_current(  # noqa: SLF001
+                expected_intent_id=binding.intent_id,
+                expected_target=EndpointTarget(binding.target_ipv4, binding.target_port),
+                expected_host_path_epoch=binding.host_path_epoch,
+                result=sampled,
+            )
+        )
+    retained = service._connection_supervisor.snapshot()  # noqa: SLF001
+
+    assert all(sampled.available for sampled in sampled_paths)
+    assert all(
+        sampled.reason_code == "host-wifi-operation-timeout"
+        for sampled in sampled_paths
+    )
+    assert all(
+        sampled.observation_failure_class == "association-observer"
+        for sampled in sampled_paths
+    )
+    assert all(
+        sampled.fingerprint == timeout_bound_path.fingerprint
+        for sampled in sampled_paths
+    )
+    assert observed_epochs == [binding.host_path_epoch, binding.host_path_epoch]
+    assert retained.host_path.epoch == baseline.host_path.epoch
+    assert retained.endpoint.tcp_state == "reachable"
+    assert retained.device_identity.state == "unverified"
+    assert retained.lease.state == "configured-unverified"
+    assert retained.authority.control_allowed is False
+    assert retained.authority.acquisition_start_allowed is False
+
+
 def test_monitor_layer_retains_exact_configured_route_across_association_lock_timeout(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
@@ -29754,6 +30958,65 @@ def _persist_resolved_active_start_for_restart(
     )
 
 
+def _persist_same_runtime_prepared_checkpoint_for_resolved_start(
+    service: XgridsK1CompatibilityService,
+) -> None:
+    """Persist the production failure shape: PREPARED + resolved START in one process."""
+
+    _persist_resolved_active_start_for_restart(service)
+    ledger_snapshot = service._physical_command_ledger.snapshot()  # noqa: SLF001
+    record = ledger_snapshot.record
+    assert ledger_snapshot.status == "resolved"
+    assert record is not None and record.last_status is not None
+    store = service._active_acquisition_checkpoint  # noqa: SLF001
+    assert store is not None
+    connection = record.connection
+    store.prepare(
+        transition_id="prepare-same-runtime-resolved-start",
+        predecessor_revision=0,
+        acquisition_id=record.acquisition_id,
+        original_start_operation_id=record.operation_id,
+        start_payload_sha256=record.payload_sha256,
+        identity=ActiveAcquisitionRecoveryIdentity(
+            logical_device_id="known-k1",
+            vendor_device_id_sha256=_RECOVERY_VENDOR_HASH,
+            device_serial_sha256=_RECOVERY_SERIAL_HASH,
+        ),
+        connection=ActiveAcquisitionRecoveryConnection(
+            transport_ref=connection.transport_ref,
+            connection_mode=connection.connection_mode,
+            target_ipv4=connection.target_ipv4,
+            target_port=connection.target_port,
+        ),
+        compatibility_profile_id=XGRIDS_K1_COMPATIBILITY_PROFILE_ID,
+        project_name="SAME_RUNTIME_RECOVERY",
+        project_name_wire_sha256=active_acquisition_project_name_sha256(
+            "SAME_RUNTIME_RECOVERY"
+        ),
+        original_evidence_session_id="evidence-same-runtime-start",
+        duration_seconds=None,
+        requested_streams=("spatial.point-cloud.live", "camera.rgb.live"),
+        evidence_policy="required",
+        mount_type="handheld",
+        gnss_mode="none",
+        prepared_binding=ActiveAcquisitionRecoveryTransportBinding(
+            runtime_instance_id=service._snapshot_runtime_id,  # noqa: SLF001
+            intent_id=connection.intent_id,
+            transport_ref=connection.transport_ref,
+            connection_mode=connection.connection_mode,
+            target_ipv4=connection.target_ipv4,
+            target_port=connection.target_port,
+            host_path_epoch=connection.host_path_epoch,
+            control_session_id=connection.control_session_id,
+            producer_generation=connection.producer_generation,
+            logical_device_id="known-k1",
+            compatibility_profile_id=XGRIDS_K1_COMPATIBILITY_PROFILE_ID,
+            vendor_device_id_sha256=_RECOVERY_VENDOR_HASH,
+            device_serial_sha256=_RECOVERY_SERIAL_HASH,
+        ),
+    )
+
+
 def _persist_resolved_unclassified_stop_for_restart(
     service: XgridsK1CompatibilityService,
 ) -> tuple[str, int]:
@@ -31265,6 +32528,291 @@ def test_prepared_ambiguous_start_active_then_ready_settles_checkpoint_without_c
     assert runtime.stop_calls == 0
 
 
+def test_prepared_resolved_start_ready_settles_on_new_same_runtime_control_generation(
+    tmp_path: Path,
+) -> None:
+    """Fresh READY can close a PREPARED resolved START without restarting or writing K1."""
+
+    service, runtime = service_with_fake_runtime(tmp_path)
+    _persist_same_runtime_prepared_checkpoint_for_resolved_start(service)
+    token = service._validate_active_acquisition_checkpoint_lineage()  # noqa: SLF001
+    assert token is not None and token.checkpoint_state == "prepared"
+    coordinator = service._physical_command_coordinator  # noqa: SLF001
+    observed_at_utc = datetime.now(UTC).isoformat(timespec="milliseconds").replace(
+        "+00:00",
+        "Z",
+    )
+    coordinator.application_response(
+        ApplicationMqttResponseEvidence(
+            operation_key="bootstrap:same-runtime-ready:DeviceInfoRequest",
+            response_topic="lixel/application/response/device_info",
+            payload_sha256="f" * 64,
+            modeling_action=None,
+            result_code=None,
+            success=None,
+            observed_at_utc=observed_at_utc,
+        )
+    )
+    coordinator.bind_control_session(
+        PhysicalCommandRuntimeBinding(
+            vendor_device_id_sha256=_RECOVERY_VENDOR_HASH,
+            device_serial_sha256=_RECOVERY_SERIAL_HASH,
+            compatibility_profile_id=XGRIDS_K1_COMPATIBILITY_PROFILE_ID,
+            intent_id="same-runtime-ready-intent",
+            transport_ref="test-ble-transport",
+            connection_mode="bridge",
+            target_ipv4="192.168.68.52",
+            target_port=facade_module.CONTROL_MQTT_PORT,
+            host_path_epoch=2,
+            control_session_id="same-runtime-ready-control",
+            producer_generation=2,
+        )
+    )
+    coordinator.device_status(
+        ApplicationMqttDeviceStatusEvidence(
+            vendor_device_id_sha256=_RECOVERY_VENDOR_HASH,
+            device_serial_sha256=_RECOVERY_SERIAL_HASH,
+            session_state="ready",
+            session_state_code=MODELING_STATE_BASE + 300,
+            project_bound=False,
+            project_id_sha256=None,
+            init_ready=False,
+            status_message_sha256="9" * 64,
+            mqtt_retained=False,
+            observed_at_utc=observed_at_utc,
+        )
+    )
+    reconciliation_id = "reconcile-same-runtime-resolved-ready"
+    standby_record = coordinator.reconcile_resolved_active(
+        reconciliation_id=reconciliation_id,
+    )
+
+    settled = service._settle_restart_checkpoint_after_verified_standby(  # noqa: SLF001
+        token=token,
+        reconciliation_id=reconciliation_id,
+        reconciled_record=standby_record,
+    )
+
+    assert settled is True
+    store = service._active_acquisition_checkpoint  # noqa: SLF001
+    assert store is not None
+    checkpoint = store.snapshot().checkpoint
+    assert checkpoint is not None and checkpoint.state == "ceased"
+    assert checkpoint.current_binding.runtime_instance_id == service._snapshot_runtime_id  # noqa: SLF001
+    assert checkpoint.current_binding.control_session_id == (
+        "same-runtime-ready-control"
+    )
+    assert checkpoint.current_binding.producer_generation == 2
+    assert checkpoint.activated_at_utc is None
+    assert checkpoint.first_published_pcl_proof is None
+    assert runtime.start_calls == []
+    assert runtime.stop_calls == 0
+
+
+def test_restart_auto_settles_durable_prepared_resolved_start_standby(
+    tmp_path: Path,
+) -> None:
+    """A process boundary consumes prior durable READY without another live Verify."""
+
+    service, runtime = service_with_fake_runtime(tmp_path)
+    _persist_same_runtime_prepared_checkpoint_for_resolved_start(service)
+    coordinator = service._physical_command_coordinator  # noqa: SLF001
+    observed_at_utc = datetime.now(UTC).isoformat(timespec="milliseconds").replace(
+        "+00:00",
+        "Z",
+    )
+    coordinator.application_response(
+        ApplicationMqttResponseEvidence(
+            operation_key="bootstrap:durable-ready:DeviceInfoRequest",
+            response_topic="lixel/application/response/device_info",
+            payload_sha256="7" * 64,
+            modeling_action=None,
+            result_code=None,
+            success=None,
+            observed_at_utc=observed_at_utc,
+        )
+    )
+    coordinator.bind_control_session(
+        PhysicalCommandRuntimeBinding(
+            vendor_device_id_sha256=_RECOVERY_VENDOR_HASH,
+            device_serial_sha256=_RECOVERY_SERIAL_HASH,
+            compatibility_profile_id=XGRIDS_K1_COMPATIBILITY_PROFILE_ID,
+            intent_id="durable-ready-intent",
+            transport_ref="test-ble-transport",
+            connection_mode="bridge",
+            target_ipv4="192.168.68.52",
+            target_port=facade_module.CONTROL_MQTT_PORT,
+            host_path_epoch=2,
+            control_session_id="durable-ready-control",
+            producer_generation=2,
+        )
+    )
+    coordinator.device_status(
+        ApplicationMqttDeviceStatusEvidence(
+            vendor_device_id_sha256=_RECOVERY_VENDOR_HASH,
+            device_serial_sha256=_RECOVERY_SERIAL_HASH,
+            session_state="ready",
+            session_state_code=MODELING_STATE_BASE + 300,
+            project_bound=False,
+            project_id_sha256=None,
+            init_ready=False,
+            status_message_sha256="8" * 64,
+            mqtt_retained=False,
+            observed_at_utc=observed_at_utc,
+        )
+    )
+    coordinator.reconcile_resolved_active(
+        reconciliation_id="reconcile-durable-resolved-ready",
+    )
+    before_restart = service._active_acquisition_checkpoint  # noqa: SLF001
+    assert before_restart is not None
+    assert before_restart.snapshot().checkpoint is not None
+    assert before_restart.snapshot().checkpoint.state == "prepared"
+
+    restarted, restarted_runtime = service_with_fake_runtime(tmp_path)
+
+    store = restarted._active_acquisition_checkpoint  # noqa: SLF001
+    assert store is not None
+    checkpoint = store.snapshot().checkpoint
+    assert checkpoint is not None and checkpoint.state == "ceased"
+    assert restarted._active_acquisition_checkpoint_reason is None  # noqa: SLF001
+    assert checkpoint.activated_at_utc is None
+    assert checkpoint.first_published_pcl_proof is None
+    assert runtime.start_calls == []
+    assert runtime.stop_calls == 0
+    assert restarted_runtime.start_calls == []
+    assert restarted_runtime.stop_calls == 0
+
+
+def test_transition_invalid_fences_repeated_verify_until_service_restart(
+    tmp_path: Path,
+) -> None:
+    """A deterministic local reducer failure must never churn Bridge on each click."""
+
+    service, runtime = service_with_fake_runtime(tmp_path)
+    coordinator = _VerifyPhysicalRecoveryCoordinator(
+        observed_session_state="ready",
+        reconciliation_ready=True,
+    )
+    _install_synthetic_verify_recovery(service, coordinator)
+    reason_code = (
+        facade_module.ActiveAcquisitionRecoveryCheckpointTransitionError.reason_code
+    )
+    service._set_active_acquisition_checkpoint_reason(reason_code)  # noqa: SLF001
+
+    state = service.state()
+
+    verify_action = state["connection_policy"]["actions"][
+        "verify-control-device-info"
+    ]
+    assert verify_action["allowed"] is False
+    assert reason_code in verify_action["reason_codes"]
+    assert state["connection_policy"]["recommended_action"] == (
+        "restart-mission-core"
+    )
+    assert state["connection_policy"]["facts"][
+        "checkpoint_verify_retry_blocked"
+    ] is True
+    operation_id = "op-00000000-0000-4000-8000-000000001299"
+    with pytest.raises(facade_module.ConnectionVerificationError) as raised:
+        asyncio.run(
+            service.verify_connection(
+                _retained_physical_recovery_verify_request(
+                    operation_id=operation_id
+                )
+            )
+        )
+
+    assert raised.value.reason_code == reason_code
+    assert coordinator.reconciliation_ids == []
+    assert all(
+        operation["operation_id"] != operation_id
+        for operation in service.state()["operations"]
+    )
+    assert service._application_control_process_lease_holders == set()  # noqa: SLF001
+    assert runtime.start_calls == []
+    assert runtime.stop_calls == 0
+
+
+def test_first_transition_invalid_verify_is_terminal_and_fences_next_attempt(
+    tmp_path: Path,
+) -> None:
+    """The first deterministic rejection is non-retryable; the next never reaches control."""
+
+    service, runtime = service_with_fake_runtime(tmp_path)
+    coordinator = _VerifyPhysicalRecoveryCoordinator(
+        observed_session_state="ready",
+        reconciliation_ready=True,
+    )
+    _install_synthetic_verify_recovery(service, coordinator)
+    reason_code = (
+        facade_module.ActiveAcquisitionRecoveryCheckpointTransitionError.reason_code
+    )
+    reconciliation_attempts: list[str] = []
+
+    async def reject_local_checkpoint_reduction(
+        bound_service: XgridsK1CompatibilityService,
+        *,
+        verify_operation_id: str,
+        allow_receiver_rehydrate: bool = True,
+    ) -> dict[str, object]:
+        del allow_receiver_rehydrate
+        reconciliation_attempts.append(verify_operation_id)
+        bound_service._set_active_acquisition_checkpoint_reason(reason_code)  # noqa: SLF001
+        raise facade_module.ConnectionVerificationError(
+            "synthetic deterministic checkpoint rejection",
+            reason_code=reason_code,
+        )
+
+    service._reconcile_physical_command_after_verify_owned = MethodType(  # type: ignore[method-assign]  # noqa: SLF001
+        reject_local_checkpoint_reduction,
+        service,
+    )
+    first_operation_id = "op-00000000-0000-4000-8000-000000001297"
+    with pytest.raises(facade_module.ConnectionVerificationError):
+        asyncio.run(
+            service.verify_connection(
+                _retained_physical_recovery_verify_request(
+                    operation_id=first_operation_id
+                )
+            )
+        )
+
+    after_first = service.state()
+    first_operation = next(
+        operation
+        for operation in after_first["operations"]
+        if operation["operation_id"] == first_operation_id
+    )
+    assert first_operation["status"] == "failed"
+    assert first_operation["error"]["code"] == reason_code
+    assert first_operation["error"]["retryable"] is False
+    assert first_operation["error"]["safe_to_retry"] is False
+    assert after_first["connection_policy"]["actions"][
+        "verify-control-device-info"
+    ]["allowed"] is False
+
+    second_operation_id = "op-00000000-0000-4000-8000-000000001298"
+    with pytest.raises(facade_module.ConnectionVerificationError) as second:
+        asyncio.run(
+            service.verify_connection(
+                _retained_physical_recovery_verify_request(
+                    operation_id=second_operation_id
+                )
+            )
+        )
+
+    assert second.value.reason_code == reason_code
+    assert reconciliation_attempts == [first_operation_id]
+    assert coordinator.reconciliation_ids == []
+    assert all(
+        operation["operation_id"] != second_operation_id
+        for operation in service.state()["operations"]
+    )
+    assert runtime.start_calls == []
+    assert runtime.stop_calls == 0
+
+
 @pytest.mark.parametrize(
     ("proof_kind", "observed_session_state"),
     [
diff --git a/tests/test_xgrids_active_acquisition_recovery_checkpoint.py b/tests/test_xgrids_active_acquisition_recovery_checkpoint.py
index 2eb7e4a..4322415 100644
--- a/tests/test_xgrids_active_acquisition_recovery_checkpoint.py
+++ b/tests/test_xgrids_active_acquisition_recovery_checkpoint.py
@@ -1134,6 +1134,44 @@ def test_cease_prepared_resolved_start_standby_rejects_inexact_restart_proofs(
         replace(status, mqtt_retained=True)
 
 
+def test_cease_prepared_resolved_start_standby_accepts_fresh_same_runtime_boundary(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A new verified control generation is sufficient without a process restart."""
+
+    prepared_binding = _binding()
+    store = _store(tmp_path, monkeypatch)
+    _prepare(store, prepared_binding)
+    kwargs = _cease_prepared_resolved_start_standby_kwargs(
+        prepared_binding,
+        terminal_state="ready",
+    )
+    status = kwargs["cessation_status_proof"]
+    physical = kwargs["cessation_physical_proof"]
+    same_runtime_binding = replace(
+        status.binding,
+        runtime_instance_id=prepared_binding.runtime_instance_id,
+        producer_generation=prepared_binding.producer_generation + 1,
+    )
+    kwargs["cessation_status_proof"] = replace(
+        status,
+        binding=same_runtime_binding,
+    )
+    kwargs["cessation_physical_proof"] = replace(
+        physical,
+        binding=same_runtime_binding,
+    )
+
+    ceased = store.cease_prepared_resolved_start_standby(**kwargs)
+
+    assert ceased.state == "ceased"
+    assert ceased.current_binding == same_runtime_binding
+    assert ceased.current_evidence_session_id == "evidence-restarted"
+    assert ceased.activated_at_utc is None
+    assert ceased.first_published_pcl_proof is None
+
+
 @pytest.mark.parametrize("terminal_state", ("ready", "scan_over"))
 def test_cease_active_reconciled_standby_atomically_opens_and_closes_gap(
     tmp_path: Path,