Why: include the current integration baseline before verification.
Evidence: fetched origin/main=df18c35203601bdec8d1671c60e0f4cf7d0b5aef.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the previous run failed on governance tests because two leaked
mi_dbg test fixtures (pids 1411737/9, ports 18801/2) held the test ports;
killing them restored the suite. Failure and rerun are both recorded.
Evidence: make evidence receipt (make test exit=0) at the synced head
(SELF).
Impact: task card evidence section only.
Refs: WP3-I4, Dev PR #404.
Why: task-sync merged origin/main (a1ac948) into the branch; test evidence
must be recorded at the head offered for merge.
Evidence: make evidence receipt (make test exit=0) at 719340b (SELF).
Impact: task card evidence section only.
Refs: WP3-I4, Dev PR #404.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-generative-ui-u6.md; R0=a1ac948155eb8957a87f37d8da4a9feb870dd532.
Impact: task metadata only; the feature workspace starts at a1ac948155.
Refs: .task/feature-generative-ui-u6.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=a1ac948155eb8957a87f37d8da4a9feb870dd532.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: task-sync flagged that the previous test receipt predates non-card
changes; the tested HEAD must match the PR head.
Evidence: make evidence receipt b8e003fa562c3b4c imported (SELF, exit=0).
Impact: task card evidence section only.
Refs: WP3-I4.
Why: card sections were placeholders (policy requires goal, requirements
and test plan before evidence/review); the gitlinks point the composite
at the I4 sub-repo commits so make test validates the real combination.
Evidence: make test green in this worktree at these gitlinks (log kept
locally; CI is authoritative); card edit is SELF.
Impact: task card content + submodule pointers (backend 9aa51e5,
frontend 01b853f).
Refs: WP3-I4.
Why: the card is the single master record and must carry the PR links once created.
Evidence: SELF - Documents PR #75 and Dev PR #403 created via API; merge order #75 then #403.
Impact: task card only.
Refs: PR #75#403
Why: the user granted push/PR authorization on 2026-10-12; the card must reflect it and carry the test-segment receipt before requesting review.
Evidence: SELF - make test-pins receipt exit 0 (pins ok; nested development-guidelines warns are pre-existing); precheck and task-sync receipts already in card.
Impact: task card only.
Refs: AGENTS.md 完成声明三段输出
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-plugins-compiled-listing.md; R0=89174a0f5c28ff7f49c794f37ea7e9528f9b526e.
Impact: task metadata only; the feature workspace starts at 89174a0f5c.
Refs: .task/feature-plugins-compiled-listing.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=89174a0f5c28ff7f49c794f37ea7e9528f9b526e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: U2's first slice landed via main (PR #396/#401); the plan card's next-task line must point at the remaining U2 delta instead of the closed task.
Evidence: SELF - documents gitlink advanced; merged main range 555fb2162f..c622372 (96 commits) inspected.
Impact: task metadata and submodule pointer only.
Refs: .task/archive/feature-svc-autorecover.md
Why: stage-review table, phase line and next-task line must carry the 2026-10-12 approval and vehicle decision.
Evidence: SELF - user decision; documents gitlink advanced to the approval-record commit.
Impact: task metadata and submodule pointer only.
Refs: modules/documents/docs/records/2026-10-12-service-restart-data-recovery-review.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-autorecover.md(PR#401) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=77391479a0645f06b631bc64ac9e55554f7e4f4e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: systemd's default KillMode=control-group kills every process in
the unit's cgroup when the oneshot finishes -- the daemon recover just
started died seconds after the recover ok event (observed live on the
host: revived at 22:13:40, gone by 22:13:42).
Evidence: unit text now carries KillMode=process (asserted in
test_watchdog_print_plan); suite 10/10 and make test-governance rerun
recorded on the card; live re-demo on the host after merge.
Impact: scripts/svc.sh wd_service_text only.
Refs: .task/feature-svc-autorecover.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=bbce8db9054b67fd8bacf3935ceb65b205682e63.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: closing the card requires the merged PR reference and honest
verification lines per the anti-debt gate.
Evidence: PR #396 merged at main (CI GATE green on e0b49d1); evidence
table rows written by make evidence.
Impact: task metadata only.
Refs: .task/feature-svc-autorecover.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=3de5791e0841e9c7c40c3dc236be6d95b3969827.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: check_port_free consulted port_owner (ss -ltnp) only, so the
/dev/tcp fallback added to port_listening never ran on the start path;
CI (no iproute2) still started onto a thief-held port.
Evidence: no-ss simulation refuses a bound port and passes a free one;
full suite 10/10 and make test-governance rerun recorded on the card;
CI on the new head is authoritative.
Impact: scripts/svc.sh check_port_free only.
Refs: .task/feature-svc-autorecover.md
Why: the CI runner container has no iproute2, so port_listening went
blind: recover started a service onto a thief-held port and the health
probe hit the thief (HTTP 200), reporting a bogus start success.
Evidence: no-ss PATH simulation shows the fallback detects a bound port
and passes free ports; make test-governance rerun recorded on the task
card; CI on the new head is authoritative.
Impact: scripts/svc.sh port_listening only (ss stays primary when
present).
Refs: .task/feature-svc-autorecover.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-rdm-source.md(PR#398) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: Popen returns before python http.server finishes binding, so on
slower CI runners recover won the race and started the service, turning
the port-stolen case into a flake.
Evidence: single-case rerun OK locally; make test-governance rerun
recorded on the task card; CI on the new head is authoritative.
Impact: test synchronization only.
Refs: .task/feature-svc-autorecover.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6933ec3979fef58e94461f3b80bb79fca3874c99.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: RDM capabilities (two-trees-one-net, rdm.* trace-audit command face)
only exist in the downstream Agent-System-RDM composite binary; svc's three
existing sources all produce the Dev binary, so none of it could be deployed
or lifecycle-managed. This adds --from rdm[@<sha>] with the same isolated
source-repo semantics as the dev source.
Evidence: make test-governance 138/138 (two new stub cases: deploy E2E and
commits/update track); real deployment rdm@2aef3fc recorded in the task card
(pins materialized, pure-Go build, web workbench to htdocs, serve health OK,
rdm.ping/rdm.inspect.capabilities committed, update --check reports latest);
make test full suite exit=0. All segments written by make evidence.
Impact: scripts/svc.sh (rdm source resolution/materialization/deploy/update/
commits, probe timeouts, rdm seed skip, ELF env-DSN evidence fallback),
docs/svc.md 5.4, tests/test_svc.py. RDM-side CLI alignment landed as RDM
PR #228; no base submodules touched.
Refs: task card .task/feature-svc-rdm-source.md; RDM PR #228/#229.
Why: CI containers run a PID 1 that does not reap orphans, so the
killed stub lingers as a zombie and os.kill(pid, 0) keeps succeeding;
local dev machines reap instantly, which hid the difference.
Evidence: tests/test_svc_recover 10/10 after the fix; make
test-governance re-run recorded on the task card; CI on the new head
is the authoritative gate.
Impact: test helper only (svc.sh already treats zombies as dead via
empty-cmdline pidcheck).
Refs: .task/feature-svc-autorecover.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-collab-storage-u6-vector.md(PR#395) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
weichen