fix(k1): expose exact supervisor recovery verify

plugins/xgrids-k1/frontend/src/lifecycle.ts

@@ -1096,7 +1096,7 @@ export function readOnlyPhysicalRecoveryBinding(
   state: XgridsK1State | null | undefined,
 ): ReadOnlyPhysicalRecoveryBinding | null {
   if (!requiresReadOnlyPhysicalRecovery(state)) return null;
-  const actions: ReadOnlyConnectionObservationAction[] = [
+  const actions: ReadOnlyNetworkObservationAction[] = [
     "observe-fresh-device-network",
     "observe-current-device-network",
     "observe-configured-device-network",
@@ -1124,13 +1124,17 @@ export function canSelectConnectionMode(
   );
 }
 
-export type ReadOnlyConnectionObservationAction = Extract<
+type ReadOnlyNetworkObservationAction = Extract<
   XgridsConnectionPolicyAction,
   | "observe-fresh-device-network"
   | "observe-current-device-network"
   | "observe-configured-device-network"
 >;
 
+export type ReadOnlyConnectionObservationAction =
+  | ReadOnlyNetworkObservationAction
+  | Extract<XgridsConnectionPolicyAction, "verify-control-device-info">;
+
 export type ReadOnlyConnectionObservationSource =
   | "fresh-scan"
   | "retained-current-process"
@@ -1153,7 +1157,7 @@ function isConnectionMode(value: unknown): value is XgridsConnectionMode {
 
 function exactPolicyObservationTarget(
   state: XgridsK1State | null | undefined,
-  action: ReadOnlyConnectionObservationAction,
+  action: ReadOnlyNetworkObservationAction,
   source: ReadOnlyConnectionObservationSource,
 ): ReadOnlyConnectionObservationTarget | null {
   if (!connectionPolicyAllows(state, action)) return null;
@@ -1189,7 +1193,7 @@ function exactPolicyObservationTarget(
 }
 
 const SERVER_BOUND_RECOVERY_OBSERVATION_PRIORITY:
-ReadonlyArray<ReadOnlyConnectionObservationAction> = [
+ReadonlyArray<ReadOnlyNetworkObservationAction> = [
   "observe-current-device-network",
   "observe-configured-device-network",
   "observe-fresh-device-network",
@@ -1206,17 +1210,17 @@ export function recommendedConnectionRecoveryObservationTarget(
 ): ReadOnlyConnectionObservationTarget | null {
   const recommended = state?.connection_policy?.recommended_action;
   const orderedActions = SERVER_BOUND_RECOVERY_OBSERVATION_PRIORITY.includes(
-    recommended as ReadOnlyConnectionObservationAction,
+    recommended as ReadOnlyNetworkObservationAction,
   )
     ? [
-        recommended as ReadOnlyConnectionObservationAction,
+        recommended as ReadOnlyNetworkObservationAction,
         ...SERVER_BOUND_RECOVERY_OBSERVATION_PRIORITY.filter(
           (action) => action !== recommended,
         ),
       ]
     : SERVER_BOUND_RECOVERY_OBSERVATION_PRIORITY;
   const sources: Record<
-    ReadOnlyConnectionObservationAction,
+    ReadOnlyNetworkObservationAction,
     ReadOnlyConnectionObservationSource
   > = {
     "observe-current-device-network": "retained-current-process",
@@ -1230,6 +1234,44 @@ export function recommendedConnectionRecoveryObservationTarget(
   return null;
 }
 
+/**
+ * A terminal control session may block the network-observation actions while
+ * the supervisor still explicitly allows its narrower DeviceInfo Verify.
+ * Reuse that permission only when the physical ledger and durable topology
+ * independently pin the same K1 and mode; browser selection is never used.
+ */
+function exactControlVerificationTarget(
+  state: XgridsK1State | null | undefined,
+): ReadOnlyConnectionObservationTarget | null {
+  if (
+    !requiresReadOnlyPhysicalRecovery(state)
+    || !connectionPolicyAllows(state, "verify-control-device-info")
+  ) return null;
+
+  const binding = readOnlyPhysicalRecoveryBinding(state);
+  const semanticStore = state?.semantic_topology_store;
+  const durable = semanticStore?.record;
+  if (
+    !binding
+    || semanticStore?.status !== "available"
+    || semanticStore.configured_offline_evidence !== true
+    || semanticStore.live_connection_authority !== false
+    || durable?.schema_version !== "missioncore.xgrids-k1-semantic-topology/v1"
+    || transportRefEquivalenceKey(durable.transport_ref)
+      !== transportRefEquivalenceKey(binding.deviceId)
+    || durable.connection_mode !== binding.connectionMode
+  ) return null;
+
+  return {
+    action: "verify-control-device-info",
+    deviceId: binding.deviceId,
+    connectionMode: binding.connectionMode,
+    source: "durable-configured-state",
+    serverBound: true,
+    expectedDiscoveryGeneration: null,
+  };
+}
+
 /**
  * Resolve the one read-only BLE target authorized by the server policy.
  * Unresolved writes never fall back to a browser selection or dropdown mode:
@@ -1285,7 +1327,7 @@ export function readOnlyConnectionObservationTarget(
     state,
     "observe-configured-device-network",
     "durable-configured-state",
-  );
+  ) ?? exactControlVerificationTarget(state);
 }
 
 /**