docs(validator): reconcile native proof and staged Core readiness

ACCOUNT_PAIRING.md

@@ -9,6 +9,9 @@ Keep `VALIDATOR_PAIRING_ENABLED=0` until the cross-repo rollout is verified.
 Core's separate [scoped pilot change](https://github.com/AIPowerGrid/grid-core/pull/60)
 adds a default-empty, expiring account allowlist for native qualification. It
 requires a new reviewed Core deployment; it is not in the deployed `407f2984`.
+Its immutable `f51875ce` candidate passed the production-backup scratch-restore
+and schema proof on 2026-08-27 at 20:59 UTC, without cutover, restart or activation.
+That removes the preparation gate, not the live native pairing gate.
 
 ## What It Means
 

AGENTS.md

@@ -104,6 +104,9 @@ generator here or imply that passing public templates proves model quality.
   probe-fingerprinting gaps, red-team acceptance tests, and economic gates.
 - **`ROADMAP.md`** — dev-manager build order from V0 preview through targeted
   validation, text/image/video policy work, and Base-anchored economics.
+  Its active ten-item milestone distinguishes published native runtime proof
+  from human desktop use, staged restore proof from cutover, and registration
+  from independently reviewed qualification. Keep those gates separate.
 - **`RELEASE_V0.md`** — cross-repo evidence-only release runbook: core migration/API,
   console scorecards, validator packaging, canary operation, and rollback notes.
 - **`PREVIEW_COHORT.md`** — public recruitment and qualification contract for

PRODUCTION_BASELINE.md

@@ -5,6 +5,38 @@ This is a dated rollout snapshot, not a live status page. Query
 `GET https://api.aipowergrid.io/v1/validator/capabilities` for current public
 state.
 
+## 2026-08-27 20:59 UTC - Pilot Candidate Restore Proof, No Cutover
+
+The immutable Core candidate `f51875ce8fe550640008f1824625e2f5a071f88b`
+passed a fresh production-backup restore and Alembic/schema check at 20:59:32
+UTC. The 71,656,136-byte custom-format backup was checksum/archive verified
+and retained with root-only mode `0600`. Restoration and migration checks ran
+only in the generated scratch database, reached head `0030` with no schema
+drift, and removed that scratch database afterward. A separate read-only check
+confirmed its removal. The candidate's read-only live schema check also passed.
+
+This is **staged and restore-tested, not deployed**. The running service remains
+Core `407f29841988fd253afe867a1f5a07e23349219e`, continuously active since
+19:00:23 UTC. Production environment bytes and payout/backup timer states
+match their pre-proof snapshots. Pairing, its pilot allowlist, media issuance
+and bond sync remain disabled. No production migration, restart, account
+association, payout invocation or economic activation occurred. The current
+release remains the rollback target for any later candidate cutover.
+
+Validator [PR #63](https://github.com/AIPowerGrid/grid-validator/pull/63) merged
+as `35b4e04590daa7d5180af99aa3d0056090d3954a`. Its exact reviewed PR source
+passed all four native builds, clean installs and assembled-payload verification
+in [run 33115331270](https://github.com/AIPowerGrid/grid-validator/actions/runs/33115331270).
+The [native pairing procedure](NATIVE_PAIRING_CANARY.md) remains unexecuted
+against live Core. Public downloads are still preview.13.
+
+The final read-only operator check at 20:57 UTC found 33 verified signed reports
+for the previously reported external registration and three for the new
+preview.13 registration; both heartbeats were fresh. The latter's operator has
+not been identified from independent confirmation. These are participation
+facts, not a completed human Windows journey or an independence review. The
+five-operator 72-hour qualification remains open.
+
 ## 2026-08-27 20:49 UTC - Cohort And Pairing Qualification Status
 
 Read-only public health and production queries still report Core

ROADMAP.md

@@ -14,38 +14,56 @@ longer architecture, not permission to activate paid audits or economics.
 
 1. Reconcile reviewed source, published artifacts, deployed versions, and local
    work. Preserve the unfinished video-decoder fairness patch separately.
+   The reviewed harness/docs are merged as `35b4e04`; public binaries remain
+   preview.13. Live Core is `407f2984` with migration `0030`. Pilot-capable Core
+   `f51875ce` is staged and passed a fresh backup/restore proof, but is not live.
 2. PR #48's Windows launcher/identity fix shipped in preview.11; preview.12
-   includes the local app. Native build/install checks pass; ordinary-user live
-   Windows qualification remains open. Window persistence alone is not enrollment.
+   introduced the local app, retained in current preview.13. Native build/install
+   and published Windows Server runtime tests pass; ordinary-user double-click
+   qualification remains open. Window persistence alone is not enrollment.
 3. Ship explicit dedicated-account enrollment without private-key/API-key
    juggling. Source canary authentication through verified stored evidence is
    proven. Published preview.12 also completed clean Linux ARM64 enrollment
-   through three accepted reports; packaged Windows live qualification remains.
+   through three accepted reports. Published preview.13 completed the Windows
+   Server journey through two verified reports; no human desktop claim follows.
 4. Build expiring authenticated pairing for an existing account, without account
    merging or payout-wallet changes. Dedicated-node signup is not pairing.
    Core PR #58 and Console PR #21 are merged and deployed dark; six real
    cross-repo HTTP integration tests and all four native build/install targets
    pass. The matching local app remains an unpublished build candidate.
    Windows/Linux live pairing proof, immutable client release and supervised
    association/removal remain required. Pairing is still disabled.
+   PR #63's manual native harness is merged and its offline safety suites pass
+   on all four platforms. This is preparation, not a completed pairing canary.
 5. Make start/stop, registration, heartbeats, assignments, submitted evidence,
    errors, redacted diagnostics, and recovery understandable without a shell.
-   The opt-in local `app` ships in preview.12 with native package checks and
+   The opt-in local `app` ships in preview.13 with native package checks and
    desktop/mobile browser QA. Its packaged child protocol completed Linux ARM64
-   live operation and outage recovery; native user-interface qualification remains.
+   and Windows Server live operation and outage recovery; ordinary-user native
+   interface qualification remains.
 6. Prove clean first-run through accepted signed evidence on Windows and Linux,
    including cancellation, offline recovery, restarts, and upgrades.
    The Linux ARM64 binary passed those lifecycle paths on 2026-08-27. A misleading
    network-error label found live was corrected in preview.13 and its published
-   Linux binary passed the real outage/recovery check. Windows remains open.
+   Linux binary passed the real outage/recovery check. Published Windows
+   preview.13 also passed cancellation, accepted evidence, bad credentials,
+   restarts, upgrades, real firewall outage/recovery and credential retirement
+   in run `33110290699`. Hosted HTTP-driven controls do not prove human UI use.
    See [PRODUCTION_BASELINE.md](PRODUCTION_BASELINE.md).
 7. Qualify at least five independently controlled operators for 72 hours;
    registration, wallets, and first-party canaries do not prove independence.
+   At 20:57 UTC on 2026-08-27, Peteq's node was healthy with 33 verified reports;
+   another preview.13 node had three. Its identity still needs confirmation
+   before calling it Donli's. No independent qualification window has started.
 8. Maintain hostile-worker tests for template solvers, replay, fabricated
    evidence, substitution, and probe-aware switching. Generated challenges are
    protocol/capability evidence, never automatically quality evidence.
 9. Finish decoder fairness, then independent-reference deterministic image and
    video pilots. Local failures and reference disagreement are inconclusive.
+   Fairness fixes are reviewed and merged in `5de518b0` with native test coverage,
+   but are not in preview.13. Original local work is preserved separately.
+   Independent reference operators and supervised image/video pilots remain open;
+   media issuance and bond synchronization remain disabled.
 10. Keep DOX, public claims, release links, and rollback records synchronized;
     distinguish merged, released, deployed, and verified at every milestone.