Fix onboard BLE admission and stage wireless device enrollment

tests/test_node_k1_bridge.py

@@ -70,6 +70,53 @@ def bridge():
     return result
 
 
+def test_node_scan_reaches_service_through_real_facade_with_runtime_fence():
+    """Exercise the actual admission boundary, replacing only the BLE service."""
+    from k1link.device_plugins.xgrids_k1.facade import SnapshotRuntimeConflict
+
+    class Service:
+        def __init__(self):
+            self.scans = []
+            self.fences = []
+            self.current = state()
+
+        def bind_runtime_event_loop(self, _loop):
+            pass
+
+        def state(self):
+            return copy.deepcopy(self.current)
+
+        def require_snapshot_runtime_id(self, expected):
+            if expected != self.current["snapshot_runtime_id"]:
+                raise SnapshotRuntimeConflict()
+            self.fences.append(expected)
+
+        async def scan_ble(self, request):
+            self.scans.append(request.operation_id)
+            return self.state()
+
+    async def run():
+        service = Service()
+        device = NodeBridge(Path.cwd(), service=service)
+        command = {
+            "operation_id": "op_" + "b" * 32,
+            "runtime_id": "runtime-one",
+            "deadline_at": (datetime.now(UTC) + timedelta(seconds=60)).isoformat(),
+            "action": "scan",
+            "parameters": {},
+        }
+        output = await device.deliver(command)
+        assert service.fences == ["runtime-one"]
+        assert service.scans == [command["operation_id"]]
+        assert len(output["candidates"]) == 1
+        command["runtime_id"] = "retired-runtime"
+        rejected = await device.deliver(command)
+        assert rejected["command_result"]["status"] == "rejected"
+        assert service.scans == [command["operation_id"]]
+
+    asyncio.run(run())
+
+
 def test_node_bridge_forces_reviewed_bridge_and_clears_input_secret():
     async def run():
         device = bridge()