nx_iot_provision_softap.nx

nx_iot_provision_softap.nx -- the auto-pair STATE MACHINE. Roadmap: NISHI_IOT_HUB_ROADMAP.md Epoch 3 (PAIR), the rung that turns the anchor (WHO) + the vendor drivers (HOW) + the classifier (PROBE) into the operator's actual outcome: lights that re-join the house on their own, with NO manual re-pair step. THE PROBLEM THIS CLOSES (operator-reported, 2026-05-16 + 2026-06-18): "they disconnect all the time and blink and then I MANUALLY have to re-pair and then they duplicate in the app." The anchor already killed the duplicate (re-adopt -> same logical id). This kills the MANUAL step: when a fixture drops to its open pairing SoftAP (e.g. TP-LINK_HS210_C209), the hub scans for it, joins it on the free Wi-Fi 6E radio, pushes the house creds over the vendor's own pairing path, waits for it to re-join the LAN, verifies it, and anchors it -- no human in the loop, no new app row. WHAT THIS ORGAN IS (and is NOT): This is the pure, deterministic LOGIC -- a sealed-enum state machine. It takes the RESULT of each radio/driver step as an event and returns the NEXT action the runner must perform. The radio calls themselves (scan / join SoftAP / socket-send creds / re-probe LAN) are the Windows-native live step, injected by the caller. Keeping the logic pure + buffer-only makes the whole auto-pair flow gate-provable today, off the LAN, on every nxc2 backend -- and lets the live runner be a thin shim that just performs actions and feeds back events. NEVER-BRICK BY CONSTRUCTION (CLAUDE.md #26 -- ABSOLUTE, brand-critical): Provisioning is the one IoT flow that writes persistent device state (the Wi-Fi credential). The guarantee here is MECHANICAL, not an asserted promise: 1. The action alphabet (PROV_ACT_*) contains NO firmware/OTA/flash action. The machine is structurally incapable of emitting one. 2. The most device-touching action it CAN emit, PUSH_CREDS, carries only a bounded Wi-Fi credential over the vendor's documented, reversible pairing API; a rejected push leaves the device safe in pairing mode (PROV_FAIL_PUSH, recoverable) -- never a half-write. 3. nx_iot_prov_action_writes_firmware is a FAIL-SAFE classifier: it returns 0 only for the explicit allow-list of safe actions and 1 (= writes firmware = brick risk) for anything else, so a future