fix(k1): gate control dialogue on live state

README.md

@@ -155,13 +155,26 @@ it together with the orchestrator. A separate, uninstalled physical-acceptance
 transport now reproduces MQTT 3.1.1 `clean_session=false`, keepalive 60, exact
 response subscriptions, QoS2 completion and the five response-gated batches.
 It consumes operation keys before publish and poisons unknown outcomes without
-retry. An interactive Keychain administration command provisions through
-Apple's hidden prompt without putting the authority in argv. Neither component
-is wired to facade/UI; `vendor_writes_enabled` remains false. The first
-operator-present physical attempt on 2026-07-18 emitted only the first six
-bootstrap requests, then failed closed while correlating the third response
-batch. The K1 remained `READY`; the `ModelingRequest` START was never emitted.
-The temporary laboratory Keychain item was deleted after the attempt.
+retry. Neither component is wired to facade/UI; `vendor_writes_enabled` remains
+false. The first operator-present physical attempt on 2026-07-18 emitted only
+the first six bootstrap requests, then failed closed while correlating the third
+response batch; START was not emitted. A second one-shot attempt correlated all
+ten pre-START requests and the START acknowledgement, but incorrectly collapsed
+the whole exchange into 365 ms and ended the control lifecycle before the
+retained post-START reads. K1 stayed in `SCAN_STARTING` for about 24 seconds,
+reported `ALGORITHM_ERROR` twice, emitted no point/pose data and showed steady
+red until an operator power cycle restored steady green. The collapsed executor
+is now disabled. The offline acceptance executor maps connection requests 1–6,
+workspace-entry request 7, project-prompt reads 8–10, user-confirmed START 11,
+immediate status read 12 and state-gated reads 13–14 onto one continuously owned
+MQTT session. No captured operator delay is a protocol timer: the final reads
+wait for live `SCANNING`, project binding and `init_ready`, while STOP/save waits
+for live `READY` plus physical standby confirmation. Standalone START and STOP
+are both rejected. The same socket is serviced during every operator/UI wait,
+and the short START/STOP permits are created only at their respective button
+confirmations rather than at connection time. This executor remains uninstalled and is not wired to the
+facade/UI; physical command acceptance is still paused. The temporary laboratory
+Keychain item was deleted.
 
 This locked bootstrap is repeatable in the current workspace, not yet a
 standalone release install. The frontend consumes sibling `file:` packages from
@@ -287,6 +300,7 @@ present.
 - [Live console and embedded Rerun runbook](docs/06_K1_LIVE_VIEWER.md)
 - [Mission Core monorepo and plugin boundary](docs/07_MISSION_CORE_MONOREPO.md)
 - [Owner-controlled LixelGO/iPhone observation](docs/08_LIXELGO_IPHONE_OBSERVATION.md)
+- [K1 application-control physical acceptance](docs/lab/003_K1_CONTROL_ACCEPTANCE_20260718.redacted.md)
 - [Observation sessions, playback and workspace layout](docs/09_OBSERVATION_SESSIONS.md)
 - [Monorepo architecture decision](docs/adr/0002-mission-core-monorepo.md)
 - [Device plugin UI and runtime boundary](docs/adr/0003-device-plugin-ui-and-runtime-boundary.md)