# Checklist: VS Code restart return checkpoint

Status: complete
Type: checklist
Updated: 2026-08-05
Next Action: resume from the Controller A HPT2 measurement checkpoint; collect eight more valid S3 observations and solve S0 observability without replay
Parent: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md

## Goal

Preserve enough exact state to restart VS Code and continue Controller A
qualification without repeating completed software/deployment work or
requesting authorization for read-only continuation.

## Current continuation checkpoint

This historical restart checklist now routes to
`work/evidence/controller-a-hpt2-bounded-stop-measurement-checkpoint-20260805.md`.
Pi source `686a61e5...a10c` is deployed as
`hpt2-sequential-admission-686a61e`; Controller A has two clean S3 bounded-stop
observations, S0 remains `0/3`, and production `stop_deadline_ms` remains
unset. Completed initialization, scrub, Start, and Stop publications must not
be replayed. Controller B remains pending review of Controller A's complete
measurement set.

## Resume Prompt

Use:

```text
resume from work/checklists/checklist-vs-code-restart-return-checkpoint.md; continue until physical, safety, credential, changed-scope, or destructive-replay intervention is required
```

## Frozen Checkpoint

- Local workspace: `E:/dev/high_point/7520553_SMI_FW`
- Local branch/source HEAD before this checkpoint-only commit:
  `codex/firmware-00-05-00-hpt-filesystem` /
  `48181bd31c769addf9c1c825982e31d0b1ad62a0`
- The local worktree is intentionally dirty with firmware, generated build,
  planning, and evidence changes. Preserve all of them; do not reset, clean,
  overwrite, or broadly stage the worktree.
- Pi repository: `jong@srv-rpi00.local:~/dev/sd_qualification`
- Pi branch/HEAD: `codex/full-address-scrub-adapter` /
  `1e62f3363998a353b55c01bd4e5cb33c3e33a678`
- Pi source changes are committed. Preserve its unrelated dirty
  `work/index.*` files and three KEXIN evidence files.
- Deployed release: `authorization-envelopes-1e62f33`
- Deployed image:
  `sha256:505ea42f0bc3ff561da26bcc1382d27073d750ac4aa5d9718174a38bf9f1c730`
- Pi health at checkpoint: HTTP 200; database, evidence storage, clock, web,
  command worker, and notification worker ready.
- Tools-profile containers running at checkpoint: zero.
- Migration `qualification.0015_authorizationenvelope` is applied.
- Verified backup:
  `/backups/sd-qualifier-20260804T225734Z.dump`, SHA-256
  `566b1d094f9022bf4d6df3af69988d9671cd209a138305130be3026f96398ea3`.
- Pre-change rollback image:
  `srv-rpi00-sd-qualifier:rollback-d7eb2da-pre-auth-envelope-20260804`.
- Post-migration rollback image:
  `srv-rpi00-sd-qualifier:rollback-16d7d04-run-envelope-20260804`.

## Authorization Standard Now In Force

- One reviewed human envelope covers the exact campaign-sample/matrix.
- Every state-changing Start, Stop, scrub, initialization, or interruption
  gets a unique short-lived exact machine intent.
- Read-only observation, preflight, polling, evidence capture, cleanup, and
  reconciliation continue without another human authorization.
- Never replay a state-changing target command.
- Ask again only for changed identity/scope, an unlisted destructive action,
  expiry/revocation, destructive replay, physical intervention, safety
  judgment, or credentials.

## Controller A State

- Legacy scrub operation:
  `6279f027-759c-46be-b3ce-ad70766c5707`.
- Durable state at restart: `INTERRUPTED_UNKNOWN`; reconciled state:
  `COMPLETED`.
- Terminal code at restart: `FULL_ADDRESS_SCRUB_INTERRUPTED_UNKNOWN`;
  reconciled terminal code: `FULL_ADDRESS_SCRUB_PASS`.
- The legacy operation has no authorization-envelope FK because it predates
  migration `0015`; this does not block read-only reconciliation.
- The command word was published once. Never publish it again and never create
  a replacement baseline scrub operation for the same sample/purpose.
- The software deployment did not contact Controller A or modify its SD card.
- Powered SD removal/insertion remains prohibited. Any physical card move
  requires controller power off and operator intervention.

## Checklist

- [x] Authorization-envelope implementation committed and deployed.
- [x] Migration, exact-image tests, backup/restore, live health, and rollback
  surfaces verified.
- [x] Central ADR, completed ticket, deployment evidence, decision matrix, and
  runbook updated.
- [x] After restart, confirm local branch/worktree still match the frozen
  checkpoint; preserve all dirty changes.
- [x] Confirm Pi HEAD/release/image and HTTP health still match this checkpoint.
- [x] Confirm Controller A remains connected to J-Link A before target access.
- [x] Resume only the existing operation's read-only reconciliation path.
- [x] If reconciliation finds a stable terminal result, capture the fresh
  boot-relevant CID and link the evidence to the same operation.
- [x] If target identity/access is unavailable or any physical/safety action is
  required, stop and request only that intervention.
- [x] Continue until the next state-changing gate. The scrub gate resolved, but
  the deployed appliance has no admitted HPT initialization adapter or
  machine-intent path, so qualification stopped before initialization.
- [x] Implement and fixture-deploy the guarded HPT initialization ABI and Pi
  adapter. The new bundle remains unadmitted, all live roles/endpoints remain
  empty, and no target or card was changed. Because the exact image changed,
  stop before programming and require a fresh post-program flash/CID
  observation and baseline scrub before initialization.
- [x] Continue coding: correct the obsolete multi-block diagnostic, deploy the
  protected approval trust store and initialization envelope/status UI, and
  import the superseding bundle without target access. Evidence:
  `work/evidence/hpt-initialization-readiness-software-continuation-20260805.md`.

## Verification

Before restart, the Pi reported HTTP 200 and all deployed services used source
`1e62f33` and the exact image recorded above. Tool Shed indexes were refreshed
and the stale-path check reported `No stale work paths found`.

After restart, operation `6279f027...` reconciled read-only to
`FULL_ADDRESS_SCRUB_PASS`. Pi Evidence `26`/`27`, post-result observation
Evidence `28`, CID capture `6`, and campaign event `51` bind the result without
replay. The full closeout is
`work/evidence/controller-a-baseline-scrub-readonly-reconciliation-20260805.md`.

Related records:

- `work/adr/adr-qualification-authorization-envelopes-and-machine-intents.md`
- `work/tickets/ticket-implement-qualification-authorization-envelopes-in-pi-coordinator.md`
- `work/evidence/pi-authorization-envelope-migration-deployment-manifest-20260804.md`
- `work/evidence/controller-a-baseline-scrub-readonly-reconciliation-20260805.md`
- `work/decisions/decision-remaining-qualification-authorization.md`
- `work/runbooks/runbook-autonomous-hpt-sd-qualification.md`
