wip(k1): checkpoint connection recovery rewrite

Capture the current unreleased K1 connection, recovery, lifecycle, viewer, and test work as a single known-bad baseline for subsequent fixes.

plugins/xgrids-k1/README.md

@@ -95,6 +95,14 @@ Validate the current exact-match profile without device I/O with:
 uv run python plugins/xgrids-k1/profile_loader.py
 ```
 
+Plugin v0.7.0 adds the backend-owned supervised connection lifecycle. Operator
+mode choice is a CAS-fenced draft; an explicit Scan commits a safe pre-START
+mode switch, while Connect reaches Ready only after the exact current
+`DeviceInfo` authority is confirmed. Configured, active and desired modes are
+separate facts. Terminal pre-START failures and purely local prepared sessions
+self-retire without a device command, and an applied network configuration is
+recovered through a separate read-only Verify instead of replaying Wi-Fi.
+
 Plugin v0.6.0 retains the physically accepted v0.5.0 control transport and adds
 the connection matrix behind the existing explicit `network.provision` action.
 Bridge remains the default. Direct Connect sends the same single reviewed
@@ -102,13 +110,19 @@ Bridge remains the default. Direct Connect sends the same single reviewed
 Connect accepts no browser/API credential: it sends one reviewed fixed 100-byte
 AP-enable frame to the selected K1, waits up to 15 seconds for the canonical
 byte-51 AP-ready flag, and keeps that BLE session alive while the macOS adapter
-performs bounded exact-SSID CoreWLAN discovery and one association. Credentials
+performs up to 30 seconds of exact-SSID CoreWLAN discovery and one association.
+AP-ready does not imply that macOS has already observed the RF beacon. Credentials
 are resolved by a preinstalled exact `3.0.2` firmware provider. Its optional laboratory importer
 validates the reviewed official archive, extracts the single AP declaration and
 installs firmware-scoped material in the OS secure store. The macOS helper then
 materializes the selected device profile entirely inside Keychain before any
 BLE write. The secret never enters the browser, API, argv, logs or evidence;
 the importer's short-lived mutable buffer is zeroized after the stdin handoff.
+The prepared-host adapter uses the accepted Apple-signed
+`/usr/bin/xcrun swift` runner. It does not runtime-compile an ad-hoc executable,
+query the standard Wi-Fi Keychain or open a password dialog after the K1 write.
+Production portability still requires a packaged, properly signed helper with
+a stable designated identity and explicit CoreWLAN authorization.
 There is no automatic BLE-write or association retry. A clean host cannot
 obtain the provider from BLE and the product does not download firmware during
 connection. Windows/Linux Quick Connect adapters are not planned while that