docs(robot): accept guided hotspot binding v1

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -12,6 +12,7 @@
 
 ## Scope
 
+- On 2026-08-16, resume the existing Integration owner to accept reviewed Robot Guided Hotspot Binding V1 design commit `14afe4a`, promote only its confirmed minimal-firmware decision into canonical memory, and keep product implementation, firmware changes, and remote push outside this integration step.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed Robot configuration-catalog/editor source `fe55dee` into local `main`, promote the accepted dynamic catalog boundary, and keep remote push outside this resumption.
 - On 2026-08-15, resume the existing Integration owner to merge reviewed Robot configuration-schema fix `ea75b06` into local `main`, accepting canonical weak numeric response ETags produced by the deployed compression layer while keeping strong `If-Match` writes.
 - On 2026-08-15, resume the existing Integration owner to merge reviewed Robot configuration-loading fix `1bcd519` into local `main`, preserving the page error/retry state and Main response-body deadline.
@@ -42,6 +43,7 @@
   reviewed. Never use `--force`.
 - The 2026-08-14 user request authorizes the local `main` merge only. It does not expand this resumption into a remote push; the existing authentication blocker remains a separate follow-up.
 - The 2026-08-15 context-compaction request likewise authorizes only a local `main` merge. It does not authorize a remote push or changing the existing OpenCode/model compaction threshold.
+- The 2026-08-16 Robot onboarding confirmation accepts the current-firmware Hotspot + six-digit Binding V1. It does not authorize firmware edits, claim automatic nearby discovery, enable the pilot capability by default, or revive the unready Security 2/automatic-claim proposal as a V1 contract.
 
 ## Project Context Loaded
 
@@ -125,6 +127,13 @@ Gate result:
 
 ## Plan
 
+### 2026-08-16 Robot Guided Hotspot Binding V1 Decision Integration Plan
+
+1. Verify source commit `14afe4a`, its independent PASS reviews, the existing Robot implementation facts, and explicit human acceptance of the minimal-firmware V1.
+2. Create an accepted ADR and promote the planned default-off capability, fixed portal action, Binding retry/restart semantics, release gates, and terminology into canonical project memory without claiming implementation is present.
+3. Run project-document structure/drift and whitespace checks, then obtain an independent read-only Sol PASS/FAIL review.
+4. Commit the canonical decision locally; start product implementation only from the accepted main baseline and do not modify firmware.
+
 ### 2026-08-16 Robot Configuration Catalog Integration Plan
 
 1. Merge reviewed source commit `fe55dee` into local `main` with a normal no-ff merge while preserving source history.
@@ -162,6 +171,9 @@ Gate result:
 
 ## Outcome
 
+- Accepted source design commit `14afe4a` as ADR-002: V1 guides the user through the current firmware Hotspot portal and then reuses the existing six-digit Binding facade. The former Security 2/automatic-claim design remains deferred rather than silently mixed into V1.
+- Promoted a narrow planned interface: Main-owned `guidedHotspotBinding` default false, fixed system-browser portal action for `http://192.168.4.1/`, Renderer-only guidance state, no Wi-Fi credential handling, and no claim that `bound` means online/ready.
+- Kept implementation truth explicit: this integration step changes canonical documents only. Product behavior and firmware remain unchanged; pilot enablement is gated on exact shipped-image checks, activation-code contract checks, automated/Electron coverage, and physical-device smoke.
 - On 2026-08-16, started a normal `--no-ff --no-commit` merge of reviewed Robot catalog/editor source `fe55dee`; Git reported no textual conflicts. The source task record remains reachable on the source commit and feature branch and is excluded from the local `main` result.
 - Promoted the USER-scoped dynamic model/voice catalog boundary: Renderer receives only bounded display metadata through Electron Main and Works Square, all public catalog outcomes are no-store, and current unavailable values remain editable.
 - Replaced avoidable configuration text/number inputs with catalog selects and bounded TTS sliders while preserving `clear_fields`, revision conflict, operation identity, and Main-owned credential boundaries.
@@ -246,6 +258,9 @@ Gate result:
 
 ## Verification
 
+- 2026-08-16 ADR-002 integration `check_project_docs.py`, task-aware `check_doc_drift.py`, and `git diff --check` — passed in the Integration owner worktree.
+- Independent ADR-002 canonical integration review initially returned `FAIL` on two P2 documentation inaccuracies: a shortened Host wire envelope and an overclaim about deployed firmware. Both were corrected; final re-review returned `PASS` with no P0-P3 findings.
+- The final review confirmed only canonical documents and this integration task record changed; no product source, source-task record, or firmware file was modified in this acceptance step.
 - 2026-08-16 source and staged-merge Robot catalog regression selection — 5 files / 84 tests passed.
 - 2026-08-16 Works Square catalog adapter/API suite — 131 tests passed; one existing Starlette/httpx deprecation warning.
 - 2026-08-16 Makelore typecheck, focused ESLint, and production `build:vite` — passed; only existing chunk-size and mixed-import warnings remain.
@@ -313,6 +328,8 @@ Gate result:
 
 ## Follow-ups
 
+- Implement ADR-002 from a new feature worktree with the capability still false by default; do not touch `D:\Datas\HardwareProjects\xiaozhi-esp32-firmware`.
+- Before any pilot enablement, identify the exact shipped Robot component/firmware image, verify that the deployed issuer produces six ASCII digits with compatible freshness/consumption semantics, and pass a real device smoke through the Host API/Electron flow.
 - Deploy matching Xiaozhi and Works Square catalog endpoints before releasing this client; otherwise the editor preserves current values but cannot populate dynamic choices.
 - The Robot integration is complete on local `main`. Production still requires matching Works Square/Xiaozhi deployment, feature configuration, credentials, and a real one-time activation-code smoke.
 - Stable mutation operation IDs are retained across ambiguous retries in the running app but are not persisted across an application restart.
@@ -330,4 +347,5 @@ Gate result:
 
 ## Promotion Candidates
 
+- The Guided Hotspot Binding V1 candidate from `14afe4a` was promoted into ADR-002, success criteria, system/module/data-flow architecture, business rules, glossary, and current state. No unresolved candidate remains for this design acceptance.
 - The context-compaction source candidate was promoted into current state, module map, data flow, evidence, and upgrade commitments. No unresolved candidate remains for this local merge.