Why: absorb the external source-review round - pin the shutdown budget change, close the U1 acceptance gap for program/cwd changes, gate U4 public states on a mapping table, and make the svc-autorecover coordination an explicit human decision.
Evidence: SELF - external review round 2 in the review record; r2 SHA256 9cfda2520b913e6966c68fb3f66fb7bc8382a8f7a2b69cb364122216dcdb72cd; all reviewed claims re-verified against the pinned baselines.
Impact: documents only; four targeted amendments (U1/U3/U4/section 9) plus version bump and INDEX update; requirements and metrics unchanged.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: the reviewer record must reflect that all r2 gap claims hold at the post-sync backend pin 25fbea85, and that the svc-autorecover ownership decision now has 373 lines of unregistered, partially failing in-flight work to weigh.
Evidence: SELF - drift-check receipt in the Dev task card (exit 0, all cited gaps hold); svc-autorecover suite observed 5 of 10 tests failing on 2026-10-11.
Impact: review record addendum only; proposal r2 (SHA256 9cfda252...) unchanged.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: the human gate resolved on 2026-10-12 - r2 approved (five stages at once) and option (a) adopted; the review record, proposal index and status navigation must reflect it.
Evidence: SELF - user decision relayed in conversation; stage-review details in the Dev task card; proposal r2 body unchanged (SHA256 9cfda252...).
Impact: review record, INDEX entry; no plan content change.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: between the review round and the approval decision another session completed and merged svc-autorecover (PR #396/#400/#401/#402), so the (a)-decision tracking must reflect the landed slice and the remaining U2 delta.
Evidence: SELF - merged main history c622372 and archived card .task/archive/feature-svc-autorecover.md (10/10 tests, 146/146 governance, CI green on e0b49d1).
Impact: review record, INDEX; proposal r2 body unchanged.
Refs: PR #396#401
weichen
merged commit b5dceb5e47 into main2026-10-12 02:02:12 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: 系统在 svc 停止/重启或异常终止后需能恢复全部服务与数据。本 PR 交付经两轮审阅并已获用户批准（2026-10-12，五阶段一并）的完整方案 r2：10 项需求合同、7 个实施增量（U1–U7，批次 A/B/C）与故障验收矩阵。
Evidence: SELF —— 六角色文档自审（records 同名 review 第一轮）＋外部源码复核（第二轮：五个基线 SHA、svc.sh:1373 统一解析、RenewExecution/SetRecoveryHold 无生产调用、命令认领即 consumed、HTTP 停机 5s 超时跳过事件清冲、Surface 待投影默认 100 条等逐项独立核验）；task-sync 后漂移检查 PASS（backend 25fbea85 起）；U2 首切片已由 svc-autorecover 合入 main（Dev PR #396/#401）的落地追踪与批准记录见 review 文件。CI（GATE）为权威验证源。
Impact: 仅文档：docs/proposals/2026-10-12-service-restart-data-recovery.md（r2，正文 SHA256 9cfda252…）、docs/records/2026-10-12-service-restart-data-recovery-review.md（两轮＋批准＋追踪）、docs/proposals/INDEX.md。业务实施、故障注入、部署与运行验收 NOT_RUN。
Refs: Dev 任务卡 .task/feature-service-restart-recovery-plan.md（precheck/task-sync/pins 收据）；协作存储案 2026-10-11-collaboration-storage-and-distribution.md；首个实施任务 feature/recovery-u1-instance-identity（manifest 合同设计 v0.1 已产出，待评审）。合入顺序：本 PR 先于 Dev 侧 gitlink PR。