feat(k1): wire dormant control lease

docs/adr/0009-device-plugin-observation-runtime-and-k1-extraction.md

@@ -114,7 +114,8 @@ The operator project name is normalized and validated by the K1 contribution,
 stored as display/catalog metadata and never used as a path component. This ADR
 does not claim that it reaches the scanner: the inert application-control codec
 has no publisher, and automatic K1 writes remain disabled pending reviewed
-operator-owned Keychain execution-lease wiring and durable post-stop save evidence.
+operator-owned Keychain item provisioning, reviewed emission and durable
+post-stop save evidence.
 
 ADR 0011 subsequently places the action control plane behind a versioned
 descriptor/handshake/health transport seam. Observation discovery and export

docs/adr/0012-device-bound-k1-command-authority.md

@@ -94,13 +94,21 @@ its injected transport sink can be called. Both shadow paths remain blocked by
 `vendor-writes-disabled` and `publisher-not-installed`; no MQTT publisher or
 automatic retry path exists.
 
+`application_execution.py` adds the dormant facade boundary. An
+operator-confirmed arm may retain authority for 15–300 seconds in a
+non-exportable process-memory lease and construct the shadow orchestrator. The
+lease and orchestrator are dropped together on expiry/disarm and also before
+reprovision, acquisition preparation or shutdown. Plugin v0.4.0 exposes only
+shadow arm/disarm/state actions and redacted snapshots. The coordinator has no
+request-emission method and the installed sink is explicitly uninstalled; this
+runtime wiring does not widen write authority.
+
 ## Promotion gate
 
 A future publisher requires separate review and an operator-present physical
 acceptance:
 
-1. provision the reviewed private authority into the fixed local Keychain item
-   and load it for one operator-owned execution lease;
+1. provision the reviewed private authority into the fixed local Keychain item;
 2. confirm battery/storage and select one K1 over BLE;
 3. run the exact response-gated bootstrap and attest activated FW 3.0.2;
 4. confirm READY identity against DeviceInfo and review shadow metadata;