feat(recovery): add p0 dr escrow checklist

docs/operations/awoooi-priority-work-order-readback.snapshot.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "awoooi_priority_work_order_readback_v1",
-  "generated_at": "2026-06-29T13:28:25+08:00",
-  "status": "integrated_p0_register_next_blocker_credential_escrow",
+  "generated_at": "2026-06-29T14:00:19+08:00",
+  "status": "p0_005_dr_escrow_checklist_ready_waiting_redacted_refs",
   "source_refs": {
     "global_scorecard": "~/.codex/product-runtime-governance-completion-scorecard.snapshot.json",
     "workstation_dashboard": "~/.codex/codex-workstation-sync-dashboard.snapshot.json",
@@ -9,12 +9,13 @@
     "full_stack_cold_start_check": "scripts/reboot-recovery/full-stack-cold-start-check.sh --monitor-read-only --no-color",
     "delivery_closure_workbench": "https://awoooi.wooo.work/api/v1/agents/delivery-closure-workbench",
     "public_gitea_queue_readback": "ops/runner/read-public-gitea-actions-queue.py --json",
-    "credential_escrow_scorecard": "/tmp/awoooi-credential-escrow-intake-scorecard-20260629-1200-priority.json"
+    "credential_escrow_scorecard": "/tmp/awoooi-credential-escrow-intake-scorecard-20260629-1200-priority.json",
+    "dr_escrow_evidence_checklist_generator": "scripts/reboot-recovery/dr-escrow-evidence-checklist.py"
   },
   "current_head": {
-    "gitea_main_sha": "780587810c8b241ae60a153bdea1e557ba06218f",
-    "latest_successful_deploy_marker": "780587810 chore(cd): deploy a19b659 [skip ci]",
-    "latest_successful_deployed_source_sha": "a19b659f07c8f212a0514bf4af1affe657fa0fe1",
+    "gitea_main_sha": "bd55386e6edc46ce0b188011b171191b7773c5ba",
+    "latest_successful_deploy_marker": "9362588ce chore(cd): deploy a423301 [skip ci]",
+    "latest_successful_deployed_source_sha": "a4233017ad5fd03977233f3db6a4bb45d71507ed",
     "latest_source_readiness_commit_sha": "0c8d4e88c39157b92322fa41a92e6b15c317ac49",
     "latest_source_readiness_cd_run_id": "3882",
     "latest_source_readiness_cd_run_status": "Success",
@@ -102,8 +103,8 @@
     {
       "workplan_id": "P0-005",
       "title": "產品資料與備份 contract",
-      "status": "blocked_waiting_non_secret_credential_escrow_evidence",
-      "reason": "Backup core and product freshness are green, but DR completion still requires five non-secret credential escrow evidence markers.",
+      "status": "checklist_ready_waiting_non_secret_credential_escrow_evidence",
+      "reason": "Backup core and product freshness are green, and the P0-005 lane now has one no-secret checklist packet for the five remaining credential escrow evidence markers.",
       "evidence": {
         "product_data_green": true,
         "stock_freshness_status": "ok",
@@ -115,7 +116,9 @@
         "rclone_configured": true,
         "script_missing_count": 0,
         "credential_marker_write_authorized_count": 0,
-        "secret_value_collection_allowed": false
+        "secret_value_collection_allowed": false,
+        "checklist_generator_present": true,
+        "checklist_schema_version": "awoooi_dr_escrow_evidence_checklist_v1"
       },
       "missing_items": [
         "restic_repository_password",
@@ -126,10 +129,11 @@
       ],
       "professional_fix": {
         "owner": "DR evidence lane",
-        "action": "Create one DR escrow checklist packet with the five required item ids, accept only redacted evidence refs, then run the existing preflight once.",
+        "action": "Use the single DR escrow checklist packet with the five required item ids, accept only redacted evidence refs, then run the existing preflight once.",
         "exit_criteria": [
           "effective_escrow_missing_count=0",
-          "owner_response_accepted_count=5",
+          "owner_response_accepted_count=1",
+          "forbidden_true_field_count=0",
           "secret_value_collection_allowed=false",
           "post_reboot_readiness OVERALL_DECLARATION no longer includes DR_ESCROW_BLOCKED"
         ],
@@ -138,7 +142,7 @@
           "Do not create additional owner-package variants for the same five refs."
         ]
       },
-      "safe_next_step": "create_single_dr_escrow_evidence_checklist_then_rerun_preflight"
+      "safe_next_step": "fill_single_dr_escrow_evidence_checklist_with_five_non_secret_refs_then_run_one_preflight"
     },
     {
       "workplan_id": "P0-003",
@@ -240,7 +244,7 @@
     "database_write_or_restore_performed": false
   },
   "next_execution_order": [
-    "P0-005: create a single DR escrow evidence checklist for the five missing refs and rerun one preflight.",
+    "P0-005: fill the single DR escrow evidence checklist with five non-secret refs and rerun one preflight.",
     "P0-003: convert private/internal inventory to Gitea-only readback and remove retired GitHub from active P0 blocker math.",
     "P0-006: run source-to-runtime drift cleanup using product manifest, committed runtime sources, production readback, and public route evidence."
   ]