feat(k1): add physical acceptance transport

docs/adr/0009-device-plugin-observation-runtime-and-k1-extraction.md

@@ -114,8 +114,8 @@ The operator project name is normalized and validated by the K1 contribution,
 stored as display/catalog metadata and never used as a path component. This ADR
 does not claim that it reaches the scanner: the inert application-control codec
 has no publisher, and automatic K1 writes remain disabled pending reviewed
-operator-owned Keychain item provisioning, reviewed emission and durable
-post-stop save evidence.
+operator-owned Keychain item provisioning, physical acceptance of the
+uninstalled transport and durable post-stop save evidence.
 
 ADR 0011 subsequently places the action control plane behind a versioned
 descriptor/handshake/health transport seam. Observation discovery and export

docs/adr/0012-device-bound-k1-command-authority.md

@@ -103,10 +103,33 @@ shadow arm/disarm/state actions and redacted snapshots. The coordinator has no
 request-emission method and the installed sink is explicitly uninstalled; this
 runtime wiring does not widen write authority.
 
+`application_mqtt.py` and `application_acceptance.py` provide the next, still
+uninstalled physical-acceptance boundary. The MQTT type repeats the retained
+3.1.1 session (`clean_session=false`, keepalive 60), subscribes only to exact
+known response topics, admits only reviewed request topics and QoS2/retain-false
+envelopes, and consumes explicit bootstrap ordinals/modeling actions before the
+first publish call. It performs one connect attempt with no reconnect. PUBCOMP
+and every required application response are separate barriers; stale,
+duplicate, unexpected, oversized or timed-out responses poison the transport.
+An unknown post-publish outcome can only be reconciled physically/status-wise;
+the same operation key can never be attempted again by that transport.
+
+The acceptance executor requires a 15–120 second single-action permit backed by
+five explicit operator confirmations. START cannot skip the five recovered
+bootstrap batches; STOP uses a separate permit. These types are not imported by
+the facade, declared as plugin actions or represented by UI controls.
+
+`MacOSKeychainApplicationAuthorityProvisioner` invokes Apple's interactive
+`security add-generic-password ... -w` prompt with `-w` last. The private value
+therefore never enters Mission Core argv, environment, files, logs or browser
+state, and the resulting item is immediately validated by the fixed loader.
+The repository CLI exposes this as an explicit one-time admin command, but the
+command has not been executed in this milestone.
+
 ## Promotion gate
 
-A future publisher requires separate review and an operator-present physical
-acceptance:
+Promotion now requires operator-present physical acceptance of the uninstalled
+transport:
 
 1. provision the reviewed private authority into the fixed local Keychain item;
 2. confirm battery/storage and select one K1 over BLE;