feat(k1): recover exact application bootstrap

README.md

@@ -139,11 +139,14 @@ stopped by the verified double-click.
 
 The exact recovered `ModelingRequest` start/stop encoder, response correlator
 and device-status state machine are implemented as inert protocol components.
-The command header derives `${device_id}:ModelingRequest` from an explicit ASCII
-device ID and requires an explicit ASCII OpenAPI key, but the key's legitimate
-provenance/provisioning and durable post-stop save evidence remain unresolved.
-There is no MQTT publisher in this path, `vendor_writes_enabled` remains false,
-and no modeling command is sent.
+The plugin also contains the exact ten-request pre-START bootstrap recovered
+from retained LixelGO traffic. Its first `DeviceInfoRequest` has no device ID;
+the response supplies live vendor identity, serial, model, activation and
+version facts for the BLE-selected K1. Static and wire evidence identify OpenAPI
+as one private application-level value in the observed client, not a manual
+per-scanner profile. The whole pre-START order and START/STOP payloads are
+byte-matched offline, but there is no MQTT publisher, `vendor_writes_enabled`
+remains false, and no application command is sent.
 
 This locked bootstrap is repeatable in the current workspace, not yet a
 standalone release install. The frontend consumes sibling `file:` packages from