merge: enable guided Robot onboarding by default

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -8,10 +8,11 @@
 - Worktree: D:\Datas\OthersProjects\makelore
 - Base commit: 4fbd1d3b24493532ce479729da2c5e5e1709c8a9
 - Owner: codex
-- Status: Blocked
+- Status: In Review
 
 ## Scope
 
+- On 2026-08-16, resume the existing Integration owner to merge reviewed default-on Guided Hotspot Binding source `b78fc07` into local `main`, accept the user's explicit reversal of the prior default-off policy, preserve exact environment value `0` as rollback, and keep firmware edits and remote push outside this resumption.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed Robot Guided Hotspot Binding implementation commit `b7a1590` into local `main`, reconcile canonical memory from planned to implemented/default-off, and keep firmware edits, capability enablement, and remote push outside this resumption.
 - On 2026-08-16, resume the existing Integration owner to accept reviewed Robot Guided Hotspot Binding V1 design commit `14afe4a`, promote only its confirmed minimal-firmware decision into canonical memory, and keep product implementation, firmware changes, and remote push outside this integration step.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed Robot configuration-catalog/editor source `fe55dee` into local `main`, promote the accepted dynamic catalog boundary, and keep remote push outside this resumption.
@@ -46,6 +47,7 @@
 - The 2026-08-15 context-compaction request likewise authorizes only a local `main` merge. It does not authorize a remote push or changing the existing OpenCode/model compaction threshold.
 - The 2026-08-16 Robot onboarding confirmation accepts the current-firmware Hotspot + six-digit Binding V1. It does not authorize firmware edits, claim automatic nearby discovery, enable the pilot capability by default, or revive the unready Security 2/automatic-claim proposal as a V1 contract.
 - The reviewed implementation may move canonical truth from planned to present, but release guidance must retain the exact shipped-firmware, issuer/validator, gate-on Electron, and physical-device smoke prerequisites. The source task record remains read-only and must stay on its feature history.
+- The user's latest instruction explicitly authorizes default-on and supersedes only the earlier default-off/capability-not-enabled constraint. It does not authorize firmware changes, automatic discovery/claim claims, arbitrary portal URLs, Wi-Fi credential handling, or remote push. Missing installed-Electron/physical-device evidence remains an explicit residual release risk, not completed evidence.
 
 ## Project Context Loaded
 
@@ -93,6 +95,14 @@ Relevant understanding:
 Gate result:
 - Passed.
 
+### 2026-08-16 Guided Hotspot Default-On Integration Resume
+
+- Reused the existing Integration owner because it still exclusively owns clean local `main` at `971865c256c2ddfe1f8ab4f8f4731a1f608599c0`; `task_context.py touch` refreshed the reservation and the registry reports this exact `main` worktree/branch owner.
+- Verified feature task `20260816-enable-guided-hotspot-4e91c2` is `ready_for_integration`, reviewed source commit `b78fc07` is based exactly on current `main`, and independent final Sol review returned PASS with no P0-P3 findings.
+- Read the source outcome, verification, follow-ups, and promotion candidate against ADR-002 and current canonical Robot memory. The source changes only the Main default and focused route tests; firmware, Renderer, Host wire shape, fixed portal, cloud Binding, and credential boundaries remain unchanged.
+- The current user decision resolves the sole semantic conflict: Guided Hotspot Binding is now default-on, with exact environment value `0` as rollback. The exact shipped firmware/issuer and real native-opener/physical-device evidence remain unverified and must not be claimed as passed.
+- Gate result: Passed for local merge and canonical policy reconciliation. Remote push remains outside this resumption.
+
 ### 2026-08-14 AI Canvas Integration Resume
 
 - Reused the same Integration owner because it still exclusively owns `main` and the repository integration lock; `task_context.py touch` refreshed the existing reservation.
@@ -137,6 +147,13 @@ Gate result:
 
 ## Plan
 
+### 2026-08-16 Guided Hotspot Default-On Integration Plan
+
+1. Merge reviewed source `b78fc07` into local `main` with a normal no-ff merge, preserve feature history, and exclude the source-owned task record from the integrated tree.
+2. Reconcile ADR-002, decision index, success criteria, Robot architecture/domain/current-state memory, glossary, and support wording from default-off/planned enablement to default-on with exact `=0` rollback; preserve all non-default security and evidence caveats.
+3. Run Robot focused tests, typecheck, scoped lint, production build, bounded-concurrency full tests, task-aware document drift, whitespace/topology checks, and an independent final Sol integration review.
+4. Commit the verified local merge. Do not modify firmware or push remotely.
+
 ### 2026-08-16 Robot Guided Hotspot Binding Implementation Integration Plan
 
 1. Merge reviewed source commit `b7a1590` into local `main` with a normal no-ff merge, preserve the source parent, and exclude the source-owned task record from the final main tree.
@@ -188,6 +205,10 @@ Gate result:
 
 ## Outcome
 
+- On 2026-08-16, started a normal `--no-ff --no-commit` merge of reviewed default-on source `b78fc07`; Git reported no textual conflicts. The feature task record remains reachable on the source commit/branch and is excluded from the integrated `main` tree.
+- Integrated only the Main default change and focused route regressions: unset environment reports guided capability true; exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` and dependency-injected false report disabled. Renderer, Host wire shape, fixed portal, cloud Binding contract, credentials, and firmware are unchanged.
+- Reconciled ADR-002, decision index, success criteria, current state, Robot architecture/domain/glossary, README, and commitments to default-on with exact `=0` rollback. The documents explicitly preserve unverified shipped-firmware, activation-issuer, native-opener, and physical-device evidence instead of claiming those checks passed.
+- Prepared merge topology uses first parent `971865c256c2ddfe1f8ab4f8f4731a1f608599c0` and reviewed source second parent `b78fc07dba0d720e88c55667f8a36ebc50134f87`. Final independent integration re-review returned PASS; the merge is ready to commit.
 - On 2026-08-16, started a normal `--no-ff --no-commit` merge of reviewed Guided Hotspot Binding source `b7a1590`; Git reported no textual conflicts. The source task record remains reachable on the source commit/feature branch and is excluded from the local `main` result.
 - Integrated the default-off Main capability and strict local Host actions, fixed system-browser portal ownership, in-memory Renderer guided/direct Binding journey, safe conflict/retry/secret cleanup, and Bound-without-online semantics. No firmware file, BLE/Wi-Fi discovery, cloud claim route, or capability enablement was added.
 - Reconciled canonical current state, system overview, and decision index from planned/not implemented to implemented/default off. Release gates remain exact firmware and issuer/validator verification, gate-on native-opener Electron coverage, and physical-device smoke.
@@ -283,6 +304,15 @@ Gate result:
 
 ## Verification
 
+- 2026-08-16 default-on feature final Sol review — `PASS`, no P0-P3 findings; independently confirmed default-on, exact environment opt-out, dependency-injection opt-out, fixed portal ownership, local-before-Works-token behavior, error redaction, unchanged Binding contract, and zero firmware changes.
+- Merged-main Robot selection — 3 files / 94 tests passed, including fresh-module exact `=0` rollback coverage.
+- Merged-main `pnpm run typecheck` and scoped ESLint on the two source files — passed.
+- Merged-main `pnpm run build:vite` — Renderer, Electron Main, and Preload passed; only existing mixed-import/chunk-size warnings remain.
+- Merged-main bounded full suite `pnpm vitest run --maxWorkers=4` — 156 files / 1758 tests passed. The source task separately records why bounded concurrency was used after the unrelated OpenCode port-release test hit its 10-second limit under default all-suite parallelism but passed 40/40 in isolation.
+- Merged-main Electron module-navigation smoke — 1/1 passed through the existing packaged Main/Renderer fixture and entered `/ai-hardware`. The fixture still cannot authenticate a Robot overview or observe the native external opener, so that deeper E2E remains a tracked release-validation gap.
+- `check_project_docs.py` — passed; all required planning/canonical files exist.
+- Integration task-aware document drift, task registry doctor, staged/unstaged whitespace checks, unmerged-entry check, and exact merge-base/parent checks — passed.
+- Independent final default-on integration review initially returned `FAIL`: default-on was incorrectly expanded into explicit SoftAP/plain-HTTP risk acceptance, one obsolete follow-up still said “before pilot enablement,” and the default-on test depended on ambient environment state. Canonical wording now records only the explicit default-on/current-firmware decision while retaining the security risk; the follow-up targets the next default-on release/compatibility claim; the test deletes the environment variable and reloads the route module before asserting true. Final re-review returned `PASS` with no P0-P3 findings and independently passed route tests both normally and with ambient `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0`.
 - 2026-08-16 Robot device-selection merged-tree regression selection — 3 files / 92 tests passed.
 - Robot device-selection merged-tree `pnpm run typecheck` and scoped ESLint — passed.
 - Staged/unstaged whitespace checks and unmerged-entry checks — passed before independent review.
@@ -365,8 +395,9 @@ Gate result:
 
 ## Follow-ups
 
-- Keep `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING` unset/default false in production; do not touch `D:\Datas\HardwareProjects\xiaozhi-esp32-firmware` for this V1.
-- Before any pilot enablement, identify the exact shipped Robot component/firmware image, verify that the deployed issuer produces six ASCII digits with compatible freshness/consumption semantics, and pass a real device smoke through the Host API/Electron flow.
+- Before claiming complete compatibility for the default-on Robot journey, verify the exact shipped firmware/fixed portal, six-digit issuer/validator freshness and consumption semantics, real Host API/native opener behavior, and a physical-device provisioning + Binding smoke. Keep exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` in support rollback instructions.
+- The earlier default-false production instruction is superseded by the user's explicit default-on decision. Keep exact value `0` only as rollback, and do not touch `D:\Datas\HardwareProjects\xiaozhi-esp32-firmware` for this V1.
+- Before the next default-on release or any complete-compatibility claim, identify the exact shipped Robot component/firmware image, verify that the deployed issuer produces six ASCII digits with compatible freshness/consumption semantics, and pass a real device smoke through the Host API/Electron flow.
 - Deploy matching Xiaozhi and Works Square catalog endpoints before releasing this client; otherwise the editor preserves current values but cannot populate dynamic choices.
 - The Robot integration is complete on local `main`. Production still requires matching Works Square/Xiaozhi deployment, feature configuration, credentials, and a real one-time activation-code smoke.
 - Stable mutation operation IDs are retained across ambiguous retries in the running app but are not persisted across an application restart.
@@ -384,6 +415,7 @@ Gate result:
 
 ## Promotion Candidates
 
-- The implementation truth from `b7a1590` was promoted from planned to implemented/default-off in canonical current state, system overview, and ADR index. Its release-enablement procedure/support matrix candidate remains deferred because the mandatory gate-on Electron and physical/firmware evidence does not yet exist.
+- The default-on candidate from `b78fc07` was promoted into ADR-002, current state, decision/success criteria, Robot architecture/domain/glossary, README, and a concrete release-validation commitment. No unresolved canonical candidate remains; the missing native/physical evidence is tracked as a pending commitment rather than overclaimed.
+- The implementation truth from `b7a1590` was originally promoted as implemented/default-off. `b78fc07` now supersedes only that default; its former enablement evidence requirements remain tracked as default-on release validation and rollback commitments.
 - The Guided Hotspot Binding V1 candidate from `14afe4a` was promoted into ADR-002, success criteria, system/module/data-flow architecture, business rules, glossary, and current state. No unresolved candidate remains for this design acceptance.
 - The context-compaction source candidate was promoted into current state, module map, data flow, evidence, and upgrade commitments. No unresolved candidate remains for this local merge.