merge: add in-app robot hotspot connection

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- `c1326a2`: Guided Hotspot Binding now scans bounded open `Xiaozhi-*` candidates and connects the user-selected hotspot inside the page through Main-owned Windows WLAN and macOS CoreWLAN/CoreLocation adapters; system Wi-Fi remains fallback, exact `=0` rollback and firmware/cloud contracts are unchanged.
 - `b78fc07`: Guided Hotspot Binding is enabled by default in Electron Main, with exact environment value `0` as rollback and direct six-digit fallback on capability-read failure; firmware and Host/cloud contracts are unchanged.
 - `b7a1590` / `14afe4a`: initial firmware-zero-change Guided Hotspot Binding V1 implementation and decision used a Main-owned default-off capability, fixed portal action, in-memory Renderer journey, and existing six-digit Binding contract; `b78fc07` above supersedes only that default.
 - `ea75b06`: Robot configuration reads accept canonical weak numeric response ETags introduced by public response compression only when the numeric revision exactly matches the strictly projected DTO; configuration and assignment writes continue to emit strong `If-Match`.
@@ -33,10 +34,11 @@ AI 编程首次发送在新建 OpenCode session 已知为空时不再等待冗
 
 Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失败语义。正式稳定源缺少对应平台 manifest 时，设置页只显示一条简洁中文提示并允许重试，不把缺包误报为已是最新版，也不向普通界面暴露堆栈、URL、路径或错误码；签名产物发布和真实升级安装仍属于外部 Release Gate。
 
-Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选择。引导路径只编排现有固件 Hotspot、固定 `http://192.168.4.1/` 系统浏览器页面、恢复互联网和现有六位 Binding；精确环境值 `0` 可回滚为直接六位码。Makelore 不扫描附近设备、不接收 Wi-Fi 密码、不修改固件，也不把 Binding 成功等同于在线。指定固件/发行契约、原生 opener 和真机整链仍未完成验证。
+Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选择。引导路径在页面内扫描附近符合条件的开放 `Xiaozhi-*` 热点，要求用户明确选择后由 Main-owned Windows/macOS 原生适配器连接并核验当前 SSID；失败时保留系统 Wi-Fi 兜底。后续继续使用固定 `http://192.168.4.1/` 系统浏览器页面、恢复互联网和现有六位 Binding；精确环境值 `0` 可回滚为直接六位码。Makelore 不接收 Wi-Fi 密码、不修改固件，也不把热点发现或 Binding 成功等同于可信身份/在线。签名 macOS、Windows 真机、指定固件/发行契约和完整整链仍未完成验证。
 
 ## Recently Completed
 
+- 2026-08-16: Integrated Windows/macOS in-page Robot hotspot discovery, explicit selection, connection, and exact-current-SSID verification behind the existing default-on guided capability. Candidate IDs are bounded and short-lived, native diagnostics stay in Main, system settings remain fallback, and firmware/Portal/Binding contracts are unchanged.
 - 2026-08-16: Enabled the existing Guided Hotspot Binding journey by default after explicit product confirmation. Exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` remains the operational rollback; fixed portal ownership, direct-code fallback, security warnings, firmware-zero-change, and Binding-without-online semantics are preserved.
 - 2026-08-16: Initially implemented ADR-002's Robot onboarding V1 without changing firmware, behind a default-off Main capability and fixed portal opener. The later `b78fc07` decision above changes only the default; the same firmware/issuer/native-opener/physical evidence remains outstanding.
 - 2026-08-15: Corrected the deployed Robot configuration-read contract after the compressed public Works response was observed with `ETag: W/\"0\"` and matching numeric `config_revision: 0`. Electron Main now accepts only canonical strong or weak numeric response tags, still requires exact DTO revision equality, and always sends strong `If-Match` for mutations. No production client rollout is claimed.
@@ -61,7 +63,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Next Recommended Steps
 
-1. 对 default-on Guided Hotspot Binding 核对指定固件镜像与六位码发行/消费契约，补齐原生 opener Electron E2E 和真机 smoke；发布支持保留精确 `=0` 回滚，不把缺失证据表述为已验收。
+1. 对 default-on Guided Hotspot Binding 核对指定固件镜像与六位码发行/消费契约，补齐 Windows 真机热点连接、签名 macOS x64/arm64 CoreWLAN/CoreLocation/worker 打包验证、真实 Host API/native seam Electron E2E 和完整真机 smoke；发布支持保留精确 `=0` 回滚，不把缺失证据表述为已验收。
 2. 成组核对客户端 source+built+contract 上传 → 服务端逐字节校验 → OSS immutable Release → CDN/Edge 的发布契约与客户端 `play_url` 消费契约。
 3. 配置真实生产环境，分别执行“小游戏/小程序创建 → 客户端本地构建与同字节预检 → 提交 → 服务端合同/摘要校验与不可变 Release 固化 → 运营批准 → App 播放”。
 
@@ -71,7 +73,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Risky Areas
 
-- Guided Hotspot Binding 默认开启，但当前 Hotspot/portal 仍是开放 SoftAP + 明文 HTTP，且精确出货镜像、激活码发行契约、原生 opener 与真机整链尚未验证。界面必须保留环境警告，异常发布可用精确环境值 `0` 回滚；不得宣称自动发现、自动认领或在线证明。
+- Guided Hotspot Binding 默认开启并提供未经认证的热点扫描/显式连接，但当前 Hotspot/portal 仍是开放 SoftAP + 明文 HTTP，且精确出货镜像、激活码发行契约、签名 macOS、Windows 真机与完整整链尚未验证。界面必须保留环境警告，异常发布可用精确环境值 `0` 回滚；不得把 SSID 前缀宣称为可信设备发现、自动认领或在线证明。
 - 一键提交已成功但本机 submission binding 落盘失败时必须保持提交成功、显示固定 `binding_warning` 并继续轮询，避免用户误判上传失败。
 - 公共 `play_url` 必须满足 Works Square 同源 HTTPS、无 userinfo/loopback、精确 `/apps/{app_id}/` 路径、无 query/fragment、版本非空且上游标记可播放。
 - `/api/works/projects/publish-source` 必须在读取凭据和项目文件前校验 Renderer capability；Host token/base 不能替代该 UI 边界。

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -12,6 +12,7 @@
 
 ## Scope
 
+- On 2026-08-16, resume the existing Integration owner to merge reviewed cross-platform in-app Robot hotspot connection source `c1326a2` into local `main`, supersede only ADR-002's manual operating-system hotspot-selection step, preserve firmware/credential/Binding boundaries, and keep remote push outside this resumption.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed default-on Guided Hotspot Binding source `b78fc07` into local `main`, accept the user's explicit reversal of the prior default-off policy, preserve exact environment value `0` as rollback, and keep firmware edits and remote push outside this resumption.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed Robot Guided Hotspot Binding implementation commit `b7a1590` into local `main`, reconcile canonical memory from planned to implemented/default-off, and keep firmware edits, capability enablement, and remote push outside this resumption.
 - On 2026-08-16, resume the existing Integration owner to accept reviewed Robot Guided Hotspot Binding V1 design commit `14afe4a`, promote only its confirmed minimal-firmware decision into canonical memory, and keep product implementation, firmware changes, and remote push outside this integration step.
@@ -48,6 +49,7 @@
 - The 2026-08-16 Robot onboarding confirmation accepts the current-firmware Hotspot + six-digit Binding V1. It does not authorize firmware edits, claim automatic nearby discovery, enable the pilot capability by default, or revive the unready Security 2/automatic-claim proposal as a V1 contract.
 - The reviewed implementation may move canonical truth from planned to present, but release guidance must retain the exact shipped-firmware, issuer/validator, gate-on Electron, and physical-device smoke prerequisites. The source task record remains read-only and must stay on its feature history.
 - The user's latest instruction explicitly authorizes default-on and supersedes only the earlier default-off/capability-not-enabled constraint. It does not authorize firmware changes, automatic discovery/claim claims, arbitrary portal URLs, Wi-Fi credential handling, or remote push. Missing installed-Electron/physical-device evidence remains an explicit residual release risk, not completed evidence.
+- The user has now explicitly authorized page-owned selection and connection of nearby open `Xiaozhi-*` provisioning hotspots on both Windows and macOS. This supersedes only manual operating-system hotspot selection; discovery remains unauthenticated convenience, Main remains the sole native-network owner, and signed macOS plus physical-Robot smoke remain release gates.
 
 ## Project Context Loaded
 
@@ -95,6 +97,14 @@ Relevant understanding:
 Gate result:
 - Passed.
 
+### 2026-08-16 Cross-Platform Robot Hotspot Integration Resume
+
+- Reused the existing Integration owner because it exclusively owns clean local `main` at `abecd5f34485ab467e5f032c618083d88e34b74d`; `task_context.py touch` refreshed the reservation and the registry reports this exact `main` worktree/branch owner.
+- Formed reviewed source commit `c1326a298026a697181c822cdd3062cc96c3aa2d`; it is exactly one commit ahead of current `main`, its feature task is `ready_for_integration`, its worktree is clean, and final read-only Sol review returned PASS on Standards and Spec with no P0-P3 findings.
+- Read the source task outcome, verification, follow-ups, and proposal against ADR-002, current Robot architecture/domain memory, release commitments, and relevant peer task scopes. The user-confirmed Windows/macOS page connection decision resolves the only semantic conflict with ADR-002's manual operating-system hotspot-selection step.
+- No peer owns `main`. Related Robot tasks are isolated and either support this direction or remain historical/deferred: authenticated automatic claim is not revived, discovery does not prove identity, and source task records remain read-only.
+- Gate result: Passed for a local no-ff merge and canonical reconciliation. Firmware edits, remote push, signed macOS x64/arm64 acceptance, and physical-Robot acceptance remain outside this resumption.
+
 ### 2026-08-16 Guided Hotspot Default-On Integration Resume
 
 - Reused the existing Integration owner because it still exclusively owns clean local `main` at `971865c256c2ddfe1f8ab4f8f4731a1f608599c0`; `task_context.py touch` refreshed the reservation and the registry reports this exact `main` worktree/branch owner.
@@ -147,6 +157,13 @@ Gate result:
 
 ## Plan
 
+### 2026-08-16 Cross-Platform Robot Hotspot Integration Plan
+
+1. Merge reviewed source `c1326a2` into local `main` with a normal no-ff merge while preserving source history; exclude the source-owned task record and proposal from the integrated tree.
+2. Accept the proposal as a new ADR that supersedes only ADR-002's manual OS hotspot-selection step, and reconcile current state, decision/architecture/domain/evidence/commitment memory without overclaiming platform or physical-device validation.
+3. Run the 132-test Robot hotspot selection, full unit suite, typecheck, lint, production build, task-aware document gates, whitespace/unmerged-entry checks, and exact topology checks on the staged merge.
+4. Obtain an independent read-only Sol PASS/FAIL integration review, fix any blocking findings, create the local no-ff merge commit, and leave firmware and remote push untouched.
+
 ### 2026-08-16 Guided Hotspot Default-On Integration Plan
 
 1. Merge reviewed source `b78fc07` into local `main` with a normal no-ff merge, preserve feature history, and exclude the source-owned task record from the integrated tree.
@@ -205,6 +222,10 @@ Gate result:
 
 ## Outcome
 
+- On 2026-08-16, formed reviewed in-app Robot hotspot source commit `c1326a298026a697181c822cdd3062cc96c3aa2d` as the exact direct child of local `main` at `abecd5f34485ab467e5f032c618083d88e34b74d`, then started a normal `--no-ff --no-commit` merge. Git reported no textual conflicts.
+- The staged main tree now owns Windows WLAN and macOS CoreWLAN/CoreLocation scan/connect/verify adapters behind one bounded Main Module and typed Host seam. Renderer exposes explicit candidate selection, safe recovery, system-Wi-Fi fallback, and the unchanged fixed-Portal/six-digit Binding continuation.
+- Excluded the source-owned task record and proposal from the integrated tree while preserving both on source commit/branch `c1326a2`. Accepted ADR-003 and reconciled ADR-002, current state, architecture, domain rules, evidence, and release commitments without claiming signed macOS or physical-Robot acceptance.
+- This resumption is a local `main` merge only. It changes no firmware and performs no remote push; exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` remains rollback.
 - On 2026-08-16, started a normal `--no-ff --no-commit` merge of reviewed default-on source `b78fc07`; Git reported no textual conflicts. The feature task record remains reachable on the source commit/branch and is excluded from the integrated `main` tree.
 - Integrated only the Main default change and focused route regressions: unset environment reports guided capability true; exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` and dependency-injected false report disabled. Renderer, Host wire shape, fixed portal, cloud Binding contract, credentials, and firmware are unchanged.
 - Reconciled ADR-002, decision index, success criteria, current state, Robot architecture/domain/glossary, README, and commitments to default-on with exact `=0` rollback. The documents explicitly preserve unverified shipped-firmware, activation-issuer, native-opener, and physical-device evidence instead of claiming those checks passed.
@@ -304,6 +325,14 @@ Gate result:
 
 ## Verification
 
+- 2026-08-16 cross-platform Robot hotspot source final Sol review — `PASS` on Standards and Spec with no P0-P3 findings; macOS termination/cancellation races, Renderer post-connect state, default-on rollback, security boundaries, and firmware-zero-change were confirmed.
+- Staged merged-main Robot hotspot selection — 4 files / 132 tests passed.
+- Staged merged-main `pnpm test` — 157 files / 1796 tests passed.
+- Staged merged-main `pnpm run typecheck` and `pnpm run lint:check` — passed; lint retained 0 errors and the same 6 warnings outside the merge paths.
+- Staged merged-main `pnpm run build:vite` — Renderer, Electron Main, and Preload passed; emitted Windows and macOS Main chunks, with only existing mixed-import/chunk-size warnings.
+- Staged merged-main Electron module-navigation E2E — 2/2 passed after rebuilding the production Renderer/Main/Preload tree. The fixture does not simulate a physical Robot or signed macOS association and is not claimed as native acceptance.
+- Integration task-aware document drift, project-document structure, staged/unstaged whitespace, source-record exclusion, and unmerged-entry checks passed before independent integration review.
+- Independent final cross-platform Robot hotspot integration review — `PASS` on Standards and Spec with no P0-P3 findings. It confirmed source-code identity, exact merge topology, source-record exclusion, Main-owned native/security boundaries, ADR-003's narrow supersession, canonical consistency, and honest residual release gates.
 - 2026-08-16 default-on feature final Sol review — `PASS`, no P0-P3 findings; independently confirmed default-on, exact environment opt-out, dependency-injection opt-out, fixed portal ownership, local-before-Works-token behavior, error redaction, unchanged Binding contract, and zero firmware changes.
 - Merged-main Robot selection — 3 files / 94 tests passed, including fresh-module exact `=0` rollback coverage.
 - Merged-main `pnpm run typecheck` and scoped ESLint on the two source files — passed.