feat(k1): wire canonical control session to UI

docs/adr/0010-plugin-owned-frontend-device-workflows.md

@@ -66,13 +66,16 @@ performs no implicit stop.
 
 K1 project names are required, NFKC-normalized and trimmed, rejected for control
 or surrogate characters or more than 96 Unicode characters, and sent to the
-backend as local display metadata. The active profile has
-`vendor_writes_enabled=false`, so its
+backend as local display metadata. At the time of this ADR the active profile
+had `vendor_writes_enabled=false`, so its
 buttons and scene control say that they prepare/stop local reception. Before an
 acquisition exists, device-start wording is gated by active-control capability;
 after start, calibration/device-stop wording additionally requires a
 plugin-commanded acquisition mode.
 
+The application-control portion is superseded by ADR 0012 and plugin v0.5.0;
+the plugin ownership and host-boundary decisions remain unchanged.
+
 Plugin CSS is imported with the contribution and scoped below
 `.xgrids-k1-plugin`. A plugin cannot add global navigation, route ownership or
 unscoped global selectors.

docs/adr/0012-device-bound-k1-command-authority.md

@@ -110,8 +110,8 @@ shadow arm/disarm/state actions and redacted snapshots. The coordinator has no
 request-emission method and the installed sink is explicitly uninstalled; this
 runtime wiring does not widen write authority.
 
-`application_mqtt.py` and `application_acceptance.py` provide the next, still
-uninstalled physical-acceptance boundary. The MQTT type repeats the retained
+`application_mqtt.py` and `application_acceptance.py` provide the reviewed
+physical-acceptance boundary. The MQTT type repeats the retained
 3.1.1 session (`clean_session=false`, keepalive 60), subscribes only to exact
 known response topics, admits only reviewed request topics and QoS2/retain-false
 envelopes, and consumes explicit bootstrap ordinals/modeling actions before the
@@ -134,8 +134,18 @@ MQTT through explicit STOP and waits for live READY plus operator-confirmed
 standby. Fault/status observations are redacted and any fault forbids automatic
 continuation. The socket remains serviced during operator/UI waits, and each
 short action permit is created at its button confirmation rather than at
-connection time. These types are synthetic-test-only, not imported by the facade,
-declared as plugin actions or represented by UI controls.
+connection time.
+
+Plugin v0.5.0 installs this boundary through
+`application_session.py`. One background owner is the only thread allowed to
+touch the control MQTT client. REST/UI actions release exactly one checkpoint:
+session open (1–6), workspace entry (7), project preparation (8–10), START, STOP
+and steady-green confirmation. Preparing local reception happens before the
+START event is released. After STOP, local capture remains owned until live
+unbound READY and explicit visual confirmation. Page close, model switching,
+polling and service state reads cannot emit START/STOP; model switching is
+blocked while the socket is open. Repository tests replace the transport with
+in-memory fakes and perform no equipment I/O.
 
 `MacOSKeychainApplicationAuthorityProvisioner` invokes Apple's interactive
 `security add-generic-password ... -w` prompt with `-w` last. The private value