Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-autorecover.md; R0=5e57029b439e5690f28dc6002f9784f0b08920eb.
Impact: task metadata only; the feature workspace starts at 5e57029b43.
Refs: .task/feature-svc-autorecover.md
Why: svc services are bare nohup'd processes with persisted registration
but no supervision -- a crash, an OOM kill, or a reboot left them dead
until manual restart (2026-10-11 outage: dev service lost, runtime/ also
wiped by hand, nothing brought services back).
Evidence: tests/test_svc_recover.py 10 cases green (start records
autostart, stop clears it incl. dead-process stop, SIGKILL then recover
revives with persisted exec=, lock-held skips, port-stolen fails with
recover fail event, watchdog unit text via --print); make test-governance
146/146 OK locally; real-machine watchdog install + kill -9 revival to be
recorded on the task card.
Impact: svc.sh gains autostart key in svc.env, `recover [name]
[--quiet]` (postgres-first, per-service .start.lock, recover history
events), `watchdog install|remove|status` (systemd user timer, cron
fallback hint), lifecycle lock across start/stop/restart/deploy/update;
spawned services no longer inherit the lock fd (9>&-), and lock release
no longer clobbers script stderr. Makefile adds svc-recover/svc-watchdog;
docs/svc.md documents semantics and boundaries.
Refs: task card .task/feature-svc-autorecover.md; docs/svc.md 6.5/6.6;
parallel planning card feature/service-restart-recovery-plan (same
problem space, plan-stage).
Why: the completion claim needs tool-written evidence per the evidence gate.
Evidence: make evidence wrote the make test-governance run (146/146 OK) into the card.
Impact: task metadata only.
Refs: .task/feature-svc-autorecover.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=acc8bf124c04b89ed05093467ebce865934bdddc.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: task-sync advanced the base; key checks re-run at the merged head per the evidence gate.
Evidence: make evidence appended the post-sync make test-governance run (146/146 OK); sync row recorded by task-sync.
Impact: task metadata only.
Refs: .task/feature-svc-autorecover.md
Why: CI containers run a PID 1 that does not reap orphans, so the
killed stub lingers as a zombie and os.kill(pid, 0) keeps succeeding;
local dev machines reap instantly, which hid the difference.
Evidence: tests/test_svc_recover 10/10 after the fix; make
test-governance re-run recorded on the task card; CI on the new head
is the authoritative gate.
Impact: test helper only (svc.sh already treats zombies as dead via
empty-cmdline pidcheck).
Refs: .task/feature-svc-autorecover.md
Why: Popen returns before python http.server finishes binding, so on
slower CI runners recover won the race and started the service, turning
the port-stolen case into a flake.
Evidence: single-case rerun OK locally; make test-governance rerun
recorded on the task card; CI on the new head is authoritative.
Impact: test synchronization only.
Refs: .task/feature-svc-autorecover.md
Why: the CI runner container has no iproute2, so port_listening went
blind: recover started a service onto a thief-held port and the health
probe hit the thief (HTTP 200), reporting a bogus start success.
Evidence: no-ss PATH simulation shows the fallback detects a bound port
and passes free ports; make test-governance rerun recorded on the task
card; CI on the new head is authoritative.
Impact: scripts/svc.sh port_listening only (ss stays primary when
present).
Refs: .task/feature-svc-autorecover.md
Why: check_port_free consulted port_owner (ss -ltnp) only, so the
/dev/tcp fallback added to port_listening never ran on the start path;
CI (no iproute2) still started onto a thief-held port.
Evidence: no-ss simulation refuses a bound port and passes a free one;
full suite 10/10 and make test-governance rerun recorded on the card;
CI on the new head is authoritative.
Impact: scripts/svc.sh check_port_free only.
Refs: .task/feature-svc-autorecover.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=3de5791e0841e9c7c40c3dc236be6d95b3969827.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
svc 自恢复：autostart 期望态 + recover + watchdog
任务卡（同一份文档）：
.task/feature-svc-autorecover.md（分支内，证据表含 precheck/task-sync/测试三段，均由 make evidence 写入）。背景（2026-10-11 事故）
变更
svc.sh recover [name] [--quiet]：postgres 优先扫描，对 autostart=1 且已死的服务裸 start 拉回（复用持久化 exec= 与数据库绑定）；逐服务非阻塞持.start.lock；写 recover ok/fail 事件。svc.sh watchdog install|remove|status：systemd 用户 timer 每分钟 recover（~/.config/systemd/user/agent-system-svc-recover.*），无用户会话环境给 cron 降级指引；linger 提示。验证
关联
Why: services needed crash/OOM auto-recovery.
Evidence: task card evidence table (SELF) + CI on PR HEAD (GATE).
Impact: scripts/svc.sh, Makefile, docs/svc.md, tests/test_svc_recover.py.