docs(validator): close remaining operator-truth gaps

VALIDATOR.md

@@ -30,7 +30,7 @@ UID-aligned Bittensor weight decision. It supports two concurrent paths:
 | Validator thin-path checks | Implemented |
 | Concurrent shadow provenance audit | Implemented; the only recurring runtime |
 | Authority/full operator mode | Removed from profiles and command-line entrypoints |
-| Current deployed vector vs independent verifier | `FAIL`: public v1/GPU-allocation contract does not match the v2/fixed-burn/body-binding verifier |
+| Current deployed vector vs independent verifier | `NOT PROVEN`: dated sources disagree, and no fresh live reproduction passed during this review. Re-derive against the live signed vector before any broadcast. |
 | General validator launch | Pending a scoreable corpus and final acceptance |
 
 ### Launch truth, 2026-08-28
@@ -44,10 +44,11 @@ The shipped recurring relay policy is not the consumed UID30 100/0 launch
 vector. Do not start it with `--broadcast` until a no-write preview proves the
 exact intended UID row and burn allocation. Any mismatch fails the launch gate.
 
-The current public contract mismatch is a launch blocker. Shadow mode reports
-it but does not veto an otherwise valid thin vector, which is why operators
-must remain in non-writing preview modes until the supported release
-converges.
+Current agreement between the deployed vector and independent verifier is not
+proven. Dated records disagree across different deployments. Shadow mode
+reports mismatches when they occur but does not veto an otherwise valid thin
+vector. Treat the unknown state as a launch blocker and remain in non-writing
+preview until a fresh reproduction against the live signed vector passes.
 
 ## What happens on each tick
 
@@ -572,7 +573,8 @@ Do not add `--broadcast` until all of the following are true:
 - [ ] You verified the source/package digest and all signing-key pins.
 - [ ] Synthetic-map and metagraph-backed dry runs passed on your machine.
 - [ ] The current vector, evidence index, and provenance outcome match your
-      intended assurance level; the known public contract mismatch is resolved.
+      intended assurance level; a fresh live reproduction proves the deployed
+      vector and independent verifier agree.
 - [ ] Your validator hotkey, permit, wallet isolation, RPC, and rollback-state
       backup are confirmed.
 - [ ] You have explicit operator authorization for a mainnet transaction.

docs/SN39_VERSIONED_RELEASES.md

@@ -82,6 +82,6 @@ A passing source test does not authorize a seal. Before preflight, prove:
    receipt being sealed.
 4. A claimed replay checkpoint has matching controlled envelopes, public
    evidence, candidate set, and pinned verifier bytes.
-5. The shadow or authority provenance gate is currently passing.
+5. The supported shadow provenance gate is currently passing.
 6. An independent operator can reproduce the versioned release from a clean
    checkout after publication.

docs/VIOLET_EXTERNAL_SCORES.md

@@ -87,15 +87,23 @@ CATHEDRAL_EXTERNAL_SCORES_TOKEN_CATHEDRAL_CONFIDENTIAL_TDX=<secret>  # Per-sourc
 
 **Thin-validator contract (mass=1):** The signed vector must carry `mode=confidential_primary`, `complete=true`, `fresh=true`, and `confirmed=true` in its policy metadata. Rows must explicitly include both `base_component` (always 0.0) and `external_component` (equals weight). Any deviation raises `VectorError` and aborts the tick.
 
-**Validator policy pin (`confidential_primary_v1`):** operators who run confidential-primary can pin the thin validator so it applies ONLY this contract:
+**Validator policy pin (`confidential_primary_v1`):** offline or non-Finney
+consumers that validate confidential-primary can pin the thin validator so it
+applies ONLY this contract:
 
 ```bash
-# CLI flag or env; default is unpinned (accepts legacy, v3, and confidential_primary)
+# Explicit offline or non-Finney validation pin. The default is validated_supply_v1.
+# Set confidential_primary_v1 to validate only that exact policy contract.
 cathedral-validator serve --require-policy confidential_primary_v1
 export CATHEDRAL_VALIDATOR_REQUIRE_POLICY=confidential_primary_v1
 ```
 
-When pinned, every vector lacking a valid `confidential_primary` v1 policy block is rejected with `VectorError`, and the legacy and v3 fallback mapping paths are unreachable. Validators that do not set the pin keep the existing behavior (all signed shapes accepted).
+When explicitly pinned, every vector lacking a valid `confidential_primary` v1
+policy block is rejected with `VectorError`, and the legacy and v3 fallback
+mapping paths are unreachable. Omitting the flag does not unpin the validator.
+It keeps the `validated_supply_v1` default. Finney SN39 broadcast accepts only
+`validated_supply_v1` or `validated_supply_v3`; `confidential_primary_v1` is
+not an accepted SN39 broadcast pin.
 
 ### Per-Source Tokens (Optional)