Why: collaboration storage U7 (proposal sections 3/5/7) requires two-process
HTTP-level acceptance over shared PG, a reproducible load-test entry honoring
the load contract, and an auditable pre-release checklist; capacity windows and
dual-host runs need user-scheduled resources, so the deliverable here is the
verifiable entry, not capacity claims.
Evidence: make test green (composite); make test-multi-instance green locally
against an isolated PG (five scenarios incl. crash-takeover and restart
invariants); run_load.sh --profile smoke end-to-end green (SSE probe p95~18ms,
zero seq duplicates, stack auto-recycled); backend pinned to feature branch
with the three cross-instance fixes.
Impact: new tests/integration/multi-instance (CI test-pg job step), new
tests/load/collaboration (k6 + SSE probe + run_load.sh), release checklist at
docs/release-multi-instance.md; no runtime behavior change in Dev repo itself.
Refs: backend PR #164; task card feature/u7-load-fault-release.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-u7-load-fault-release.md; R0=c6223724437b8c186d4ef80a20275fab4cf30004.
Impact: task metadata only; the feature workspace starts at c622372443.
Refs: .task/feature-u7-load-fault-release.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-autorecover.md(PR#401) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=77391479a0645f06b631bc64ac9e55554f7e4f4e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: systemd's default KillMode=control-group kills every process in
the unit's cgroup when the oneshot finishes -- the daemon recover just
started died seconds after the recover ok event (observed live on the
host: revived at 22:13:40, gone by 22:13:42).
Evidence: unit text now carries KillMode=process (asserted in
test_watchdog_print_plan); suite 10/10 and make test-governance rerun
recorded on the card; live re-demo on the host after merge.
Impact: scripts/svc.sh wd_service_text only.
Refs: .task/feature-svc-autorecover.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=bbce8db9054b67fd8bacf3935ceb65b205682e63.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: closing the card requires the merged PR reference and honest
verification lines per the anti-debt gate.
Evidence: PR #396 merged at main (CI GATE green on e0b49d1); evidence
table rows written by make evidence.
Impact: task metadata only.
Refs: .task/feature-svc-autorecover.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=3de5791e0841e9c7c40c3dc236be6d95b3969827.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: check_port_free consulted port_owner (ss -ltnp) only, so the
/dev/tcp fallback added to port_listening never ran on the start path;
CI (no iproute2) still started onto a thief-held port.
Evidence: no-ss simulation refuses a bound port and passes a free one;
full suite 10/10 and make test-governance rerun recorded on the card;
CI on the new head is authoritative.
Impact: scripts/svc.sh check_port_free only.
Refs: .task/feature-svc-autorecover.md
Why: the CI runner container has no iproute2, so port_listening went
blind: recover started a service onto a thief-held port and the health
probe hit the thief (HTTP 200), reporting a bogus start success.
Evidence: no-ss PATH simulation shows the fallback detects a bound port
and passes free ports; make test-governance rerun recorded on the task
card; CI on the new head is authoritative.
Impact: scripts/svc.sh port_listening only (ss stays primary when
present).
Refs: .task/feature-svc-autorecover.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-rdm-source.md(PR#398) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: Popen returns before python http.server finishes binding, so on
slower CI runners recover won the race and started the service, turning
the port-stolen case into a flake.
Evidence: single-case rerun OK locally; make test-governance rerun
recorded on the task card; CI on the new head is authoritative.
Impact: test synchronization only.
Refs: .task/feature-svc-autorecover.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6933ec3979fef58e94461f3b80bb79fca3874c99.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: RDM capabilities (two-trees-one-net, rdm.* trace-audit command face)
only exist in the downstream Agent-System-RDM composite binary; svc's three
existing sources all produce the Dev binary, so none of it could be deployed
or lifecycle-managed. This adds --from rdm[@<sha>] with the same isolated
source-repo semantics as the dev source.
Evidence: make test-governance 138/138 (two new stub cases: deploy E2E and
commits/update track); real deployment rdm@2aef3fc recorded in the task card
(pins materialized, pure-Go build, web workbench to htdocs, serve health OK,
rdm.ping/rdm.inspect.capabilities committed, update --check reports latest);
make test full suite exit=0. All segments written by make evidence.
Impact: scripts/svc.sh (rdm source resolution/materialization/deploy/update/
commits, probe timeouts, rdm seed skip, ELF env-DSN evidence fallback),
docs/svc.md 5.4, tests/test_svc.py. RDM-side CLI alignment landed as RDM
PR #228; no base submodules touched.
Refs: task card .task/feature-svc-rdm-source.md; RDM PR #228/#229.
Why: CI containers run a PID 1 that does not reap orphans, so the
killed stub lingers as a zombie and os.kill(pid, 0) keeps succeeding;
local dev machines reap instantly, which hid the difference.
Evidence: tests/test_svc_recover 10/10 after the fix; make
test-governance re-run recorded on the task card; CI on the new head
is the authoritative gate.
Impact: test helper only (svc.sh already treats zombies as dead via
empty-cmdline pidcheck).
Refs: .task/feature-svc-autorecover.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-collab-storage-u6-vector.md(PR#395) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-rdm-source.md; R0=acc8bf124c04b89ed05093467ebce865934bdddc.
Impact: task metadata only; the feature workspace starts at acc8bf124c.
Refs: .task/feature-svc-rdm-source.md
Why: task-sync advanced the base; key checks re-run at the merged head per the evidence gate.
Evidence: make evidence appended the post-sync make test-governance run (146/146 OK); sync row recorded by task-sync.
Impact: task metadata only.
Refs: .task/feature-svc-autorecover.md
Why: stage review needs results and evidence in the card before the PR merges.
Evidence: make test / test-backend-pg (real pgvector) / make build exit 0 via the evidence tool.
Impact: task metadata only.
Refs: backend PR #159; Dev PR #395.
Why: stage review needs results and evidence in the card before the PR.
Evidence: make test / test-backend-pg (real pgvector) / make build exit 0 via the evidence tool.
Impact: task metadata only.
Refs: backend PR #159.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=acc8bf124c04b89ed05093467ebce865934bdddc.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the completion claim needs tool-written evidence per the evidence gate.
Evidence: make evidence wrote the make test-governance run (146/146 OK) into the card.
Impact: task metadata only.
Refs: .task/feature-svc-autorecover.md
Why: svc services are bare nohup'd processes with persisted registration
but no supervision -- a crash, an OOM kill, or a reboot left them dead
until manual restart (2026-10-11 outage: dev service lost, runtime/ also
wiped by hand, nothing brought services back).
Evidence: tests/test_svc_recover.py 10 cases green (start records
autostart, stop clears it incl. dead-process stop, SIGKILL then recover
revives with persisted exec=, lock-held skips, port-stolen fails with
recover fail event, watchdog unit text via --print); make test-governance
146/146 OK locally; real-machine watchdog install + kill -9 revival to be
recorded on the task card.
Impact: svc.sh gains autostart key in svc.env, `recover [name]
[--quiet]` (postgres-first, per-service .start.lock, recover history
events), `watchdog install|remove|status` (systemd user timer, cron
fallback hint), lifecycle lock across start/stop/restart/deploy/update;
spawned services no longer inherit the lock fd (9>&-), and lock release
no longer clobbers script stderr. Makefile adds svc-recover/svc-watchdog;
docs/svc.md documents semantics and boundaries.
Refs: task card .task/feature-svc-autorecover.md; docs/svc.md 6.5/6.6;
parallel planning card feature/service-restart-recovery-plan (same
problem space, plan-stage).
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=dc97048556caebd03168866075d959f0f55d02a7.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the parent must pin the merged component SHA for combined build and CI.
Evidence: backend origin-main tip e49f165 (includes #159 and later merges) fetched post-recovery; internal core pin 89f3906 matches Dev modules/core.
Impact: gitlink only.
Refs: backend PR #159.
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-rdm-e2e-acceptance.md(PR#393) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=660f581d81bb54c9868920df07e0b8fdbec8e036.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: task-sync advanced the Dev backend gitlink past the RDM pin; a newer-schema user-create CLI migrates the fresh store beyond what the RDM binary (schema ceiling of its pin) can open.
Evidence: reproduce on 20261011-180439 run (v25 store vs v24 binary); rerun green recorded after this change.
Impact: scripts/e2e.sh only; seeding and serving now share one base version.
weichen