The 5-min VRAM stress is skipped unless verify.sh reports
unlocked-ok (--vulkan always still forces it) - no point testing
the locked stock chip. The unlock install prompt now defaults to
Y (Enter confirms) since each run exists to unlock; --unlock stays
for non-interactive runs. README updated to match.
save_bios now distinguishes nvflash driver-loaded refusal from a
missing sysfs rom node (ROM BAR not exposed) vs enable denial,
and appends host lockdown/Secure Boot state to the note. New
opt-in last resort: unload NVIDIA modules, retry nvflash --save,
always reload (y/N prompt default n, or --bios-unload). Docs
(flow, flags, safety, AGENTS.md invariant) updated to match.
Folder identity switches from the physical serial (which neither
nvflash nor nvidia-smi exposes on the 170HX) to the auto-read GPU
UUID from nvidia-smi. The physical serial probe result (or N/A) is
saved to <folder>/serial.txt and report.json. No manual serial
prompt anymore; --serial only overrides the recorded serial.
Unidentified runs fall back to unidentified/<bdf>/. AGENTS.md
invariant and README updated to match.
AGENTS.md now documents the real workflow: single remote origin (SSH),
push only on explicit request, never force-push or add remotes
unasked. README gains the Gitea repo link and points the driver
requirement at cmpunlocker's driver/VERSION (610.xx / 615.xx).
Insert a "cmpunlocker unlock (install)" step after unlock verification:
y/N confirmation (default n) or --unlock runs install.sh from the
harness clone (main branch, ff-only pull first) with live terminal
output and full log to cards/<serial>/install_unlocker.log. On success
the Vulkan stress is skipped until after the cold reboot.
Score now enforces the post-unlock invariant: when verify reports
unlocked-ok, any final link other than Gen2 x16 fails with a red
[ERROR] and exit 1. README safety section and AGENTS.md harness
cloning invariant updated to match.
qbuissondebon