feat(k1): add physical acceptance transport

plugins/xgrids-k1/README.md

@@ -83,9 +83,12 @@ uv run python plugins/xgrids-k1/profile_loader.py
 
 Plugin v0.4.0 does not widen device authority. Its application-control
 coordinator has no request-emission method, no live MQTT sink and no UI control;
-`vendor_writes_enabled` remains false. Keychain item provisioning and a separate
-review of any future write-capable transport are still required before a
-physical command can be considered.
+`vendor_writes_enabled` remains false. A separate uninstalled acceptance-only
+transport now implements exact subscriptions, QoS2 completion, response
+barriers and no-retry poisoning. The admin CLI can provision the fixed Keychain
+item through Apple's hidden prompt without accepting the value as an argument.
+Neither path is imported by the facade; Keychain provisioning and a controlled
+physical START/STOP acceptance are still required.
 
 The optional owner-controlled iPhone/LixelGO observation tool lives under
 [`lab/iphone-capture/`](lab/iphone-capture/). It pins `pymobiledevice3` in a

plugins/xgrids-k1/profiles/README.md

@@ -40,10 +40,13 @@ literal `{device_id}:ModelingRequest` session relation, retained start settings
 and numeric success code. Retained client/wire evidence identifies OpenAPI as
 one private application-level value rather than a per-scanner profile. A fixed
 read-only macOS Keychain loader, bounded in-memory lease and dormant facade
-orchestrator now exist. No request-emission method or live MQTT sink exists;
-operator-owned Keychain item provisioning, reviewed emission, durable save
-completion, timeout and rollback behavior remain unresolved. Acquisition
-therefore stays `operator-manual` through the verified physical double-click.
+orchestrator now exist. The installed runtime has no request-emission method or
+live MQTT sink. A separate uninstalled acceptance transport implements the
+retained MQTT session, exact response subscriptions and poison-on-unknown
+one-shot behavior. Operator-owned Keychain item provisioning, physical
+acceptance, durable save completion and rollback evidence remain unresolved.
+Acquisition therefore stays `operator-manual` through the verified physical
+double-click.
 The standalone encoder models the recovered wire schema, including enum values
 outside the retained request. It is not an authorization policy: any future
 publisher must enforce the exact profile mapping (`2/1/0`, omitted

plugins/xgrids-k1/profiles/fw-3.0.2/direct-lan.v1.json

@@ -359,7 +359,7 @@
           },
           "success_result_code": 302252033,
           "required_unresolved_context": [
-            "operator-owned Keychain item provisioning and reviewed request emission",
+            "operator-owned Keychain item provisioning and physical acceptance of the uninstalled reviewed transport",
             "authorization policy for any setting outside the retained request",
             "timeout, rejection and rollback contract"
           ],
@@ -406,7 +406,7 @@
           "request_fields": {},
           "success_result_code": 302252033,
           "required_unresolved_context": [
-            "operator-owned Keychain item provisioning and reviewed request emission",
+            "operator-owned Keychain item provisioning and physical acceptance of the uninstalled reviewed transport",
             "save-completion and final-standby state mapping",
             "timeout and rollback contract"
           ],