docs(milestone): record K1 control and archive acceptance

README.md

@@ -27,8 +27,9 @@ The K1 acquisition now also requires an operator project name. Frontend and
 backend normalize it with NFKC plus surrounding-whitespace trimming, reject
 control/surrogate characters and values above 96 Unicode characters, and
 preserve it as local session/catalog display metadata. It is never used as a
-filesystem path. Because K1 command publishing is disabled, the current runtime
-does not claim that this value has been transmitted to the scanner.
+filesystem path. The physically accepted interactive control path carries the
+same validated value in its single canonical START; there is no separate
+project-name write.
 
 Plugin SDK v0alpha2 now provides executable, vendor-neutral identity, session,
 operation, runtime-action, stream, evidence and compatibility contracts. Every
@@ -42,10 +43,10 @@ normalizer to produce transport-neutral local consumer views; portable SDK
 stream envelopes, process isolation, durable operations, multi-device routing
 and the remote Edge split remain later gates.
 
-The current runtime cannot read K1 firmware automatically. It keeps the exact
-profile inactive until the operator explicitly attests firmware `3.0.2` and
-direct-LAN topology; state records that basis as `operator-attested`, not as
-device-derived evidence.
+The application-control bootstrap reads and correlates live `DeviceInfo` before
+START. The exact profile requires model `LixelKity K1`, observed platform type
+`A4`, activated state, firmware `3.0.2`, and direct-LAN topology. The UI selects
+that profile but does not ask the operator to attest firmware manually.
 
 The repository now contains one narrowly gated state-changing command:
 `ble wifi-configure`. It accepts only the reviewed firmware-3 provisioning
@@ -138,7 +139,8 @@ local reception; plugin-commanded v0.5.0 acquisition uses the separately gated
 canonical K1 START/STOP dialogue.
 
 The exact recovered `ModelingRequest` start/stop encoder, response correlator
-and device-status state machine are implemented as inert protocol components.
+and device-status state machine are installed in the operator-gated interactive
+control path.
 The plugin also contains the exact ten-request pre-START bootstrap recovered
 from retained LixelGO traffic. Its first `DeviceInfoRequest` has no device ID;
 the response supplies live vendor identity, serial, model, activation and
@@ -157,7 +159,7 @@ keepalive 60, exact
 response subscriptions, QoS2 completion and the five response-gated batches.
 It consumes operation keys before publish and poisons unknown outcomes without
 retry. One background owner services that socket through response-gated
-connection, workspace, project, START, STOP and steady-green stages. The normal
+connection, workspace, project, START, STOP and device-standby stages. The normal
 UI collapses only the pre-START controls into one explicit operator intent;
 navigation cannot emit a command. The first operator-present physical attempt on 2026-07-18 emitted only
 the first six bootstrap requests, then failed closed while correlating the third
@@ -172,11 +174,13 @@ workspace-entry request 7, project-prompt reads 8–10, user-confirmed START 11,
 immediate status read 12 and state-gated reads 13–14 onto one continuously owned
 MQTT session. No captured operator delay is a protocol timer: the final reads
 wait for live `SCANNING`, project binding and `init_ready`, while STOP/save waits
-for live `READY` plus physical standby confirmation. Standalone START and STOP
+for live unbound `READY`. Standalone START and STOP
 are both rejected. The same socket is serviced throughout launch and STOP
 confirmation, and no captured human delay is replayed as a protocol timer.
-Plugin v0.5.0 wires this executor to the facade and plugin UI; physical command
-acceptance remains an operator-run gate.
+Plugin v0.5.0 wires this executor to the facade and plugin UI. The full staged
+START/live/STOP/save cycle is physically accepted on the reviewed unit. START
+and STOP each retain an explicit operator action; final local sealing now follows
+the scanner's protocol-reported unbound READY without a redundant second click.
 
 This locked bootstrap is repeatable in the current workspace, not yet a
 standalone release install. The frontend consumes sibling `file:` packages from
@@ -314,7 +318,9 @@ present.
 - [Device-plugin observation runtime and K1 extraction](docs/adr/0009-device-plugin-observation-runtime-and-k1-extraction.md)
 - [Plugin-owned frontend device workflows](docs/adr/0010-plugin-owned-frontend-device-workflows.md)
 - [Laboratory plugin runtime handshake and transport seam](docs/adr/0011-laboratory-plugin-runtime-handshake-and-transport-seam.md)
+- [Device-bound K1 command authority](docs/adr/0012-device-bound-k1-command-authority.md)
 - [Redacted live lab report](docs/lab/001_K1_LIVE_MQTT_20260715.redacted.md)
+- [Canonical control and durable archive milestone](docs/lab/004_K1_CANONICAL_CONTROL_ARCHIVE_20260719.redacted.md)
 - [Session manifest schema](schemas/session-manifest.schema.json)
 - [Reference input provenance](docs/reference/README.md)
 
@@ -330,9 +336,11 @@ capture of traffic to or from the confirmed K1 address, and offline analysis of
 owned artifacts.
 
 The reviewed provisioning write requires its named profile and explicit operator
-confirmation. Application command publishing remains disabled: physical
-double-click is the verified start/stop mechanism. Any future MQTT publisher,
-router configuration change or new BLE write requires its own evidence and
+confirmation. The interactive application-control publisher is enabled only for
+the exact K1/A4/FW 3.0.2 direct-LAN profile and only inside one operator-opened,
+response-gated session; physical double-click remains the independent fallback.
+The legacy shadow publisher remains structurally disabled. Any broader firmware,
+topology, scanner-family or command surface requires its own evidence and
 reviewed step. Random writes, fuzzing, brute force, firmware operations,
 destructive file access and credential guessing remain out of scope.