docs(k1): record connection mode acceptance

docs/01_IMPLEMENTATION_PLAN.md

@@ -3,7 +3,7 @@
 This plan supersedes the app-dependent experiment order in the reference Bible.
 Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 
-## Current checkpoint — 2026-07-18
+## Current checkpoint — 2026-07-19
 
 | Stage | Result |
 | --- | --- |
@@ -11,6 +11,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Gate 1 physical operation | GO — autonomous double-click start/stop verified |
 | Stage 1 BLE discovery | GO — repeatable advertisement and GATT profile |
 | Stage 2 BLE provisioning | GO — reviewed 99-byte profile, LAN association confirmed |
+| Stage 2 local connection matrix | GO (implementation) — Bridge remains physically accepted; Direct Connect reuses the reviewed one-shot BLE frame; Quick Connect uses one CoreWLAN host association and no GATT write. Direct Connect and Mission Core Quick Connect still require separate physical acceptance |
 | Stage 3 application session | GO — MQTT 3.1.1 on confirmed K1 TCP 1883 |
 | Stage 4 artifacts/flows | GO — bounded capture, hashes and negative control |
 | Stage 5 point cloud | GO — raw-LZ4 protobuf, 1,140 live frames decoded |

docs/adr/0012-device-bound-k1-command-authority.md

@@ -13,6 +13,11 @@ that Mission Core reproduces all ten requests before START, plus START and STOP,
 byte-for-byte. This describes the current device dialogue but does not authorize
 writes to any K1.
 
+The profile identifier above records the accepted v0.5.0 boundary. ADR 0013
+supersedes the active runtime selection with
+`xgrids.lixelkity-k1.fw-3.0.2.local-network.v2`; it does not change the command
+dialogue or retroactively broaden this acceptance evidence.
+
 The protocol exposes identities with different ownership. Mission Core's
 inventory UUID and the macOS CoreBluetooth UUID are local transport identities.
 The vendor device ID and serial identify the live scanner. The OpenAPI value is

docs/adr/0013-k1-local-connection-matrix.md

@@ -0,0 +1,71 @@
+# ADR 0013: explicit K1 local connection matrix
+
+- Status: accepted for implementation; physical acceptance is mode-specific
+- Date: 2026-07-19
+- Extends: ADR 0004, ADR 0005 and ADR 0012
+
+## Context
+
+Mission Core v0.5.0 exposed only the already accepted shared-LAN path even
+though the product UI named the other XGRIDS connection directions. Retained
+owner-operated evidence establishes two different network ownership models:
+
+- the K1 joins a network whose credentials are sent in the reviewed 99-byte BLE
+  provisioning frame; and
+- the controller joins the K1 access point and then reaches the same local
+  MQTT/RTSP data plane at the observed AP address.
+
+Official workflow notes separately name Bridge, Direct Connect and Quick
+Connect. The names alone do not authorize another BLE command or an inferred
+credential decoder.
+
+## Decision
+
+Plugin v0.6.0 exposes three explicit, fail-closed choices under one exact
+firmware `3.0.2` compatibility profile:
+
+| UI mode | Topology | Device action | Host action | Acceptance |
+| --- | --- | --- | --- | --- |
+| Bridge | `direct-lan` | one reviewed BLE provisioning write | none | physically accepted in Mission Core |
+| Direct Connect | `controller-hotspot` | the same reviewed BLE provisioning write | operator prepares the hotspot and route | implementation complete; physical run pending |
+| Quick Connect | `device-ap` | none | one CoreWLAN scan and association | LixelGO data plane observed; Mission Core host run pending |
+
+Bridge remains the default. Every API request carries both `connection_mode`
+and its exact topology attestation; mismatched pairs are rejected before any
+network action. Acquisition and camera admission must match the active mode.
+The fixed K1 AP address is admitted only after a successful Quick Connect host
+association.
+
+Direct Connect does not introduce a new vendor payload. The operator first
+starts a hotspot on the controlling device and enters that hotspot's SSID and
+password. Mission Core performs the same single, physically reviewed BLE write
+used by Bridge and accepts only the non-AP private IPv4 returned by K1 status.
+
+Quick Connect does not write GATT. A short-lived macOS Swift/CoreWLAN helper
+receives the operator-entered AP SSID and password as bounded JSON on stdin.
+The credential never appears in argv, environment, stdout, stderr, manifests or
+browser persistence. The helper performs at most one scan and one association;
+Mission Core does not retry. The implementation intentionally does not infer or
+read the K1 AP password from an undocumented BLE structure. Until that read has
+its own captured characteristic, bounded decoder and review, the operator must
+enter the AP credentials shown for the owner-controlled scanner.
+
+No connection-verification button emits a probe. It validates only the admitted
+private address; the later canonical MQTT session supplies the real data-plane
+connection attempt. A failed or ambiguous network action remains terminal until
+the operator checks physical state and explicitly starts a new operation.
+
+## Consequences
+
+- The UI now represents all three intended directions instead of disabled
+  placeholders.
+- Quick Connect can temporarily remove the Mac from its previous Wi-Fi network.
+  macOS may require Wi-Fi/location permission for the process running Mission
+  Core.
+- Direct Connect requires an already-running hotspot and a controller route;
+  Mission Core does not create or manage that hotspot.
+- The application-control, START/STOP and raw-first acquisition protocol is
+  unchanged after a target address is admitted.
+- Direct Connect and Mission Core Quick Connect remain explicitly pending one
+  owner-operated physical acceptance cycle each. Offline tests cannot promote
+  those claims.

docs/lab/004_K1_CANONICAL_CONTROL_ARCHIVE_20260719.redacted.md

@@ -84,8 +84,10 @@ to captured evidence.
 
 ## Current supported choices
 
-- Connection: direct LAN is active; alternative connection modes remain disabled
-  UI anchors until independently accepted.
+- Connection at the time of this acceptance: direct LAN only. ADR 0013 later
+  enabled Bridge, Quick Connect and Direct Connect as distinct v0.6.0 paths;
+  that later implementation does not retroactively add physical acceptance to
+  this archived run.
 - Mount/scan carrier: handheld is active. Ground UGV and aerial UAV choices are
   visible but disabled anchors.
 - GNSS: no RTK is the active default. RTK is visible but disabled and optional;