merge: enable guided Robot onboarding by default

.project-docs/30-worklog/current-state.md

@@ -4,7 +4,8 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
-- `b7a1590` / `14afe4a`: implemented and accepted firmware-zero-change Guided Hotspot Binding V1 with a Main-owned default-off capability, fixed portal action, in-memory Renderer journey, and existing six-digit Binding contract.
+- `b78fc07`: Guided Hotspot Binding is enabled by default in Electron Main, with exact environment value `0` as rollback and direct six-digit fallback on capability-read failure; firmware and Host/cloud contracts are unchanged.
+- `b7a1590` / `14afe4a`: initial firmware-zero-change Guided Hotspot Binding V1 implementation and decision used a Main-owned default-off capability, fixed portal action, in-memory Renderer journey, and existing six-digit Binding contract; `b78fc07` above supersedes only that default.
 - `ea75b06`: Robot configuration reads accept canonical weak numeric response ETags introduced by public response compression only when the numeric revision exactly matches the strictly projected DTO; configuration and assignment writes continue to emit strong `If-Match`.
 - `fe55dee`: Robot configuration editing uses the safe Xiaozhi/Works catalog for model, language, and voice selections, with bounded sliders for TTS numeric controls and no-store catalog responses.
 - `fd9b5b46a913c515e94e4e26f185d43866c2581f` / `7a811590c4943b7b1b7ea5f3b4d3ce3ce05622a5`: Codex-style persistent AI Programming context-compaction timeline, run-lifecycle separation, polling-idle completion, and cold-hydration hardening.
@@ -32,9 +33,12 @@ AI 编程首次发送在新建 OpenCode session 已知为空时不再等待冗
 
 Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失败语义。正式稳定源缺少对应平台 manifest 时，设置页只显示一条简洁中文提示并允许重试，不把缺包误报为已是最新版，也不向普通界面暴露堆栈、URL、路径或错误码；签名产物发布和真实升级安装仍属于外部 Release Gate。
 
+Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选择。引导路径只编排现有固件 Hotspot、固定 `http://192.168.4.1/` 系统浏览器页面、恢复互联网和现有六位 Binding；精确环境值 `0` 可回滚为直接六位码。Makelore 不扫描附近设备、不接收 Wi-Fi 密码、不修改固件，也不把 Binding 成功等同于在线。指定固件/发行契约、原生 opener 和真机整链仍未完成验证。
+
 ## Recently Completed
 
-- 2026-08-16: Implemented ADR-002's Robot onboarding V1 in Makelore without changing firmware. Main owns a default-off capability and the fixed portal opener; Renderer guides manual hotspot/Wi-Fi handoff and reuses six-digit Binding, clears secrets/retry identity safely, and does not equate Binding with online readiness. Pilot enablement still requires the documented firmware, issuer/validator, gate-on Electron, and physical-device evidence.
+- 2026-08-16: Enabled the existing Guided Hotspot Binding journey by default after explicit product confirmation. Exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` remains the operational rollback; fixed portal ownership, direct-code fallback, security warnings, firmware-zero-change, and Binding-without-online semantics are preserved.
+- 2026-08-16: Initially implemented ADR-002's Robot onboarding V1 without changing firmware, behind a default-off Main capability and fixed portal opener. The later `b78fc07` decision above changes only the default; the same firmware/issuer/native-opener/physical evidence remains outstanding.
 - 2026-08-15: Corrected the deployed Robot configuration-read contract after the compressed public Works response was observed with `ETag: W/\"0\"` and matching numeric `config_revision: 0`. Electron Main now accepts only canonical strong or weak numeric response tags, still requires exact DTO revision equality, and always sends strong `If-Match` for mutations. No production client rollout is claimed.
 - 2026-08-16: Integrated selection-oriented Robot configuration editing. Enabled model and caller-safe voice metadata now flows from Xiaozhi through Works Square and Electron Main without exposing provider secrets; unavailable current values and `clear_fields` semantics remain intact. Production deployment of the matching service endpoints is still required.
 - 2026-08-15：AI 编程上下文压缩改为 Codex 风格的会话内时间线事件；手动与自动压缩原位展示并持久保留，历史回放去重且状态只允许从 running 单调进入 completed，压缩完成不再冒充整个 run idle。
@@ -57,7 +61,7 @@ Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失
 
 ## Next Recommended Steps
 
-1. 核对指定固件镜像与六位码发行/消费契约，补齐 capability-on 原生 opener Electron E2E 和真机 smoke 后，再决定是否只为内部试点开启 Guided Hotspot Binding。
+1. 对 default-on Guided Hotspot Binding 核对指定固件镜像与六位码发行/消费契约，补齐原生 opener Electron E2E 和真机 smoke；发布支持保留精确 `=0` 回滚，不把缺失证据表述为已验收。
 2. 成组核对客户端 source+built+contract 上传 → 服务端逐字节校验 → OSS immutable Release → CDN/Edge 的发布契约与客户端 `play_url` 消费契约。
 3. 配置真实生产环境，分别执行“小游戏/小程序创建 → 客户端本地构建与同字节预检 → 提交 → 服务端合同/摘要校验与不可变 Release 固化 → 运营批准 → App 播放”。
 
@@ -67,6 +71,7 @@ Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失
 
 ## Risky Areas
 
+- Guided Hotspot Binding 默认开启，但当前 Hotspot/portal 仍是开放 SoftAP + 明文 HTTP，且精确出货镜像、激活码发行契约、原生 opener 与真机整链尚未验证。界面必须保留环境警告，异常发布可用精确环境值 `0` 回滚；不得宣称自动发现、自动认领或在线证明。
 - 一键提交已成功但本机 submission binding 落盘失败时必须保持提交成功、显示固定 `binding_warning` 并继续轮询，避免用户误判上传失败。
 - 公共 `play_url` 必须满足 Works Square 同源 HTTPS、无 userinfo/loopback、精确 `/apps/{app_id}/` 路径、无 query/fragment、版本非空且上游标记可播放。
 - `/api/works/projects/publish-source` 必须在读取凭据和项目文件前校验 Renderer capability；Host token/base 不能替代该 UI 边界。

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -8,10 +8,11 @@
 - Worktree: D:\Datas\OthersProjects\makelore
 - Base commit: 4fbd1d3b24493532ce479729da2c5e5e1709c8a9
 - Owner: codex
-- Status: Blocked
+- Status: In Review
 
 ## Scope
 
+- On 2026-08-16, resume the existing Integration owner to merge reviewed default-on Guided Hotspot Binding source `b78fc07` into local `main`, accept the user's explicit reversal of the prior default-off policy, preserve exact environment value `0` as rollback, and keep firmware edits and remote push outside this resumption.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed Robot Guided Hotspot Binding implementation commit `b7a1590` into local `main`, reconcile canonical memory from planned to implemented/default-off, and keep firmware edits, capability enablement, and remote push outside this resumption.
 - On 2026-08-16, resume the existing Integration owner to accept reviewed Robot Guided Hotspot Binding V1 design commit `14afe4a`, promote only its confirmed minimal-firmware decision into canonical memory, and keep product implementation, firmware changes, and remote push outside this integration step.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed Robot configuration-catalog/editor source `fe55dee` into local `main`, promote the accepted dynamic catalog boundary, and keep remote push outside this resumption.
@@ -46,6 +47,7 @@
 - The 2026-08-15 context-compaction request likewise authorizes only a local `main` merge. It does not authorize a remote push or changing the existing OpenCode/model compaction threshold.
 - The 2026-08-16 Robot onboarding confirmation accepts the current-firmware Hotspot + six-digit Binding V1. It does not authorize firmware edits, claim automatic nearby discovery, enable the pilot capability by default, or revive the unready Security 2/automatic-claim proposal as a V1 contract.
 - The reviewed implementation may move canonical truth from planned to present, but release guidance must retain the exact shipped-firmware, issuer/validator, gate-on Electron, and physical-device smoke prerequisites. The source task record remains read-only and must stay on its feature history.
+- The user's latest instruction explicitly authorizes default-on and supersedes only the earlier default-off/capability-not-enabled constraint. It does not authorize firmware changes, automatic discovery/claim claims, arbitrary portal URLs, Wi-Fi credential handling, or remote push. Missing installed-Electron/physical-device evidence remains an explicit residual release risk, not completed evidence.
 
 ## Project Context Loaded
 
@@ -93,6 +95,14 @@ Relevant understanding:
 Gate result:
 - Passed.
 
+### 2026-08-16 Guided Hotspot Default-On Integration Resume
+
+- Reused the existing Integration owner because it still exclusively owns clean local `main` at `971865c256c2ddfe1f8ab4f8f4731a1f608599c0`; `task_context.py touch` refreshed the reservation and the registry reports this exact `main` worktree/branch owner.
+- Verified feature task `20260816-enable-guided-hotspot-4e91c2` is `ready_for_integration`, reviewed source commit `b78fc07` is based exactly on current `main`, and independent final Sol review returned PASS with no P0-P3 findings.
+- Read the source outcome, verification, follow-ups, and promotion candidate against ADR-002 and current canonical Robot memory. The source changes only the Main default and focused route tests; firmware, Renderer, Host wire shape, fixed portal, cloud Binding, and credential boundaries remain unchanged.
+- The current user decision resolves the sole semantic conflict: Guided Hotspot Binding is now default-on, with exact environment value `0` as rollback. The exact shipped firmware/issuer and real native-opener/physical-device evidence remain unverified and must not be claimed as passed.
+- Gate result: Passed for local merge and canonical policy reconciliation. Remote push remains outside this resumption.
+
 ### 2026-08-14 AI Canvas Integration Resume
 
 - Reused the same Integration owner because it still exclusively owns `main` and the repository integration lock; `task_context.py touch` refreshed the existing reservation.
@@ -137,6 +147,13 @@ Gate result:
 
 ## Plan
 
+### 2026-08-16 Guided Hotspot Default-On Integration Plan
+
+1. Merge reviewed source `b78fc07` into local `main` with a normal no-ff merge, preserve feature history, and exclude the source-owned task record from the integrated tree.
+2. Reconcile ADR-002, decision index, success criteria, Robot architecture/domain/current-state memory, glossary, and support wording from default-off/planned enablement to default-on with exact `=0` rollback; preserve all non-default security and evidence caveats.
+3. Run Robot focused tests, typecheck, scoped lint, production build, bounded-concurrency full tests, task-aware document drift, whitespace/topology checks, and an independent final Sol integration review.
+4. Commit the verified local merge. Do not modify firmware or push remotely.
+
 ### 2026-08-16 Robot Guided Hotspot Binding Implementation Integration Plan
 
 1. Merge reviewed source commit `b7a1590` into local `main` with a normal no-ff merge, preserve the source parent, and exclude the source-owned task record from the final main tree.
@@ -188,6 +205,10 @@ Gate result:
 
 ## Outcome
 
+- On 2026-08-16, started a normal `--no-ff --no-commit` merge of reviewed default-on source `b78fc07`; Git reported no textual conflicts. The feature task record remains reachable on the source commit/branch and is excluded from the integrated `main` tree.
+- Integrated only the Main default change and focused route regressions: unset environment reports guided capability true; exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` and dependency-injected false report disabled. Renderer, Host wire shape, fixed portal, cloud Binding contract, credentials, and firmware are unchanged.
+- Reconciled ADR-002, decision index, success criteria, current state, Robot architecture/domain/glossary, README, and commitments to default-on with exact `=0` rollback. The documents explicitly preserve unverified shipped-firmware, activation-issuer, native-opener, and physical-device evidence instead of claiming those checks passed.
+- Prepared merge topology uses first parent `971865c256c2ddfe1f8ab4f8f4731a1f608599c0` and reviewed source second parent `b78fc07dba0d720e88c55667f8a36ebc50134f87`. Final independent integration re-review returned PASS; the merge is ready to commit.
 - On 2026-08-16, started a normal `--no-ff --no-commit` merge of reviewed Guided Hotspot Binding source `b7a1590`; Git reported no textual conflicts. The source task record remains reachable on the source commit/feature branch and is excluded from the local `main` result.
 - Integrated the default-off Main capability and strict local Host actions, fixed system-browser portal ownership, in-memory Renderer guided/direct Binding journey, safe conflict/retry/secret cleanup, and Bound-without-online semantics. No firmware file, BLE/Wi-Fi discovery, cloud claim route, or capability enablement was added.
 - Reconciled canonical current state, system overview, and decision index from planned/not implemented to implemented/default off. Release gates remain exact firmware and issuer/validator verification, gate-on native-opener Electron coverage, and physical-device smoke.
@@ -283,6 +304,15 @@ Gate result:
 
 ## Verification
 
+- 2026-08-16 default-on feature final Sol review — `PASS`, no P0-P3 findings; independently confirmed default-on, exact environment opt-out, dependency-injection opt-out, fixed portal ownership, local-before-Works-token behavior, error redaction, unchanged Binding contract, and zero firmware changes.
+- Merged-main Robot selection — 3 files / 94 tests passed, including fresh-module exact `=0` rollback coverage.
+- Merged-main `pnpm run typecheck` and scoped ESLint on the two source files — passed.
+- Merged-main `pnpm run build:vite` — Renderer, Electron Main, and Preload passed; only existing mixed-import/chunk-size warnings remain.
+- Merged-main bounded full suite `pnpm vitest run --maxWorkers=4` — 156 files / 1758 tests passed. The source task separately records why bounded concurrency was used after the unrelated OpenCode port-release test hit its 10-second limit under default all-suite parallelism but passed 40/40 in isolation.
+- Merged-main Electron module-navigation smoke — 1/1 passed through the existing packaged Main/Renderer fixture and entered `/ai-hardware`. The fixture still cannot authenticate a Robot overview or observe the native external opener, so that deeper E2E remains a tracked release-validation gap.
+- `check_project_docs.py` — passed; all required planning/canonical files exist.
+- Integration task-aware document drift, task registry doctor, staged/unstaged whitespace checks, unmerged-entry check, and exact merge-base/parent checks — passed.
+- Independent final default-on integration review initially returned `FAIL`: default-on was incorrectly expanded into explicit SoftAP/plain-HTTP risk acceptance, one obsolete follow-up still said “before pilot enablement,” and the default-on test depended on ambient environment state. Canonical wording now records only the explicit default-on/current-firmware decision while retaining the security risk; the follow-up targets the next default-on release/compatibility claim; the test deletes the environment variable and reloads the route module before asserting true. Final re-review returned `PASS` with no P0-P3 findings and independently passed route tests both normally and with ambient `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0`.
 - 2026-08-16 Robot device-selection merged-tree regression selection — 3 files / 92 tests passed.
 - Robot device-selection merged-tree `pnpm run typecheck` and scoped ESLint — passed.
 - Staged/unstaged whitespace checks and unmerged-entry checks — passed before independent review.
@@ -365,8 +395,9 @@ Gate result:
 
 ## Follow-ups
 
-- Keep `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING` unset/default false in production; do not touch `D:\Datas\HardwareProjects\xiaozhi-esp32-firmware` for this V1.
-- Before any pilot enablement, identify the exact shipped Robot component/firmware image, verify that the deployed issuer produces six ASCII digits with compatible freshness/consumption semantics, and pass a real device smoke through the Host API/Electron flow.
+- Before claiming complete compatibility for the default-on Robot journey, verify the exact shipped firmware/fixed portal, six-digit issuer/validator freshness and consumption semantics, real Host API/native opener behavior, and a physical-device provisioning + Binding smoke. Keep exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` in support rollback instructions.
+- The earlier default-false production instruction is superseded by the user's explicit default-on decision. Keep exact value `0` only as rollback, and do not touch `D:\Datas\HardwareProjects\xiaozhi-esp32-firmware` for this V1.
+- Before the next default-on release or any complete-compatibility claim, identify the exact shipped Robot component/firmware image, verify that the deployed issuer produces six ASCII digits with compatible freshness/consumption semantics, and pass a real device smoke through the Host API/Electron flow.
 - Deploy matching Xiaozhi and Works Square catalog endpoints before releasing this client; otherwise the editor preserves current values but cannot populate dynamic choices.
 - The Robot integration is complete on local `main`. Production still requires matching Works Square/Xiaozhi deployment, feature configuration, credentials, and a real one-time activation-code smoke.
 - Stable mutation operation IDs are retained across ambiguous retries in the running app but are not persisted across an application restart.
@@ -384,6 +415,7 @@ Gate result:
 
 ## Promotion Candidates
 
-- The implementation truth from `b7a1590` was promoted from planned to implemented/default-off in canonical current state, system overview, and ADR index. Its release-enablement procedure/support matrix candidate remains deferred because the mandatory gate-on Electron and physical/firmware evidence does not yet exist.
+- The default-on candidate from `b78fc07` was promoted into ADR-002, current state, decision/success criteria, Robot architecture/domain/glossary, README, and a concrete release-validation commitment. No unresolved canonical candidate remains; the missing native/physical evidence is tracked as a pending commitment rather than overclaimed.
+- The implementation truth from `b7a1590` was originally promoted as implemented/default-off. `b78fc07` now supersedes only that default; its former enablement evidence requirements remain tracked as default-on release validation and rollback commitments.
 - The Guided Hotspot Binding V1 candidate from `14afe4a` was promoted into ADR-002, success criteria, system/module/data-flow architecture, business rules, glossary, and current state. No unresolved candidate remains for this design acceptance.
 - The context-compaction source candidate was promoted into current state, module map, data flow, evidence, and upgrade commitments. No unresolved candidate remains for this local merge.