docs(milestone): record K1 control and archive acceptance

plugins/xgrids-k1/README.md

@@ -34,7 +34,7 @@ The plugin owns:
   acquisition pipeline UI.
 - the interactive canonical application-control session: one socket owner, one
   operator launch intent, response-gated workspace/project/START stages, a
-  separate STOP confirmation, live status gates and no automatic retry.
+  separate explicit STOP action, live status gates and no automatic retry.
 
 The plugin does not own:
 
@@ -74,11 +74,10 @@ in-process and its health is lifecycle-only; process isolation, crash/restart
 containment and signed deployment remain later supervisor gates.
 
 The compatibility profile is descriptive and cannot itself authorize a vendor
-write. The current runtime cannot inspect K1 firmware: it keeps the profile
-inactive until the operator explicitly attests firmware `3.0.2` and direct-LAN
-topology, and records that basis as `operator-attested` rather than
-device-derived evidence. Validate the current exact-match profile without
-device I/O with:
+write. The UI selects the exact firmware `3.0.2` / direct-LAN profile; the
+canonical bootstrap then requires a correlated live `DeviceInfo` match for
+model `LixelKity K1`, platform type `A4`, activation and firmware before START.
+Validate the current exact-match profile without device I/O with:
 
 ```bash
 uv run python plugins/xgrids-k1/profile_loader.py
@@ -92,12 +91,13 @@ START carrying the project name. Local state polling controls only when the
 next reviewed action may be requested; it never schedules a device command by
 elapsed time. START waits for bound `SCANNING + project + init_ready` before
 operations 13–14. STOP is separately permitted, never retried, and keeps the same socket until K1
-reports unbound READY and the operator confirms a steady green indicator. The
+reports unbound READY. That protocol state automatically completes local sealing;
+stable green is physical corroboration rather than a second UI gate. The
 admin CLI still provisions the fixed Keychain item through Apple's hidden
 prompt without accepting the private value as an argument. No physical command
 is emitted merely by loading the plugin, opening the page, navigating, polling
-state or running repository tests. Full v0.5.0 physical acceptance remains an
-operator-run gate.
+state or running repository tests. The full v0.5.0 START/live/STOP/save path is
+physically accepted on the reviewed K1/A4/FW 3.0.2 unit.
 
 The optional owner-controlled iPhone/LixelGO observation tool lives under
 [`lab/iphone-capture/`](lab/iphone-capture/). It pins `pymobiledevice3` in a