feat: add d601 recovery guardrails

Adds read-only D601 recovery diagnostics, fixture coverage, CLI wiring, and recovery hotfix runbook updates. Validated with recovery contract, check --files, scripts tsc, artifact matrix direct contract, and read-only live diagnostic.
2026-05-23 21:18:44 +08:00
parent 6c44f66289
commit e2646763c0
9 changed files with 1406 additions and 5 deletions
@@ -296,6 +296,7 @@ D601 上必须显式使用原生 k3s kubeconfig：`KUBECONFIG=/etc/rancher/k3s/k

 D601 是 Windows + WSL Ubuntu + Docker Desktop 节点，Docker Desktop 当前 `LiveRestore=false` 时，机器或 Docker daemon 重启会停止容器，恢复链路必须同时覆盖 Windows 登录、WSL keepalive、Docker daemon ready、provider-gateway 和业务用户服务：

+- 首选只读诊断入口：`bun scripts/cli.ts check recovery-guardrails`。该入口报告 malformed `/proc/mounts` Docker Desktop `/Docker/host` 9p 行、kubelet mount-table validation risk、stale CRI sandbox count、Code Queue deploy worktree/`/home/ubuntu/cq-deploy` symlink readiness、Code Queue/MDTODO k3s hostPath readiness、MDTODO adjacent hostPath 透明度和 `ContainerCreating` hostPath 分类。输出只给 safe read-only 证据、manual host hotfix redlines 和禁止自动动作；不得据此自动重启 k3s、删除 CRI sandbox、删除 Pod、修改 live hostPath、执行 deploy/rollout 或 destructive prune/reset。完整 hotfix exception、用户数据边界和 ClaudeQQ/用户请示条件见 `docs/reference/devops-hygiene.md`。
 - Windows 登录任务：计划任务 `UniDesk-D601-Autostart` 在用户 `DESKTOP-1MHOD9I\liang` 登录时运行 `C:\WINDOWS\System32\cmd.exe /c ""C:\Users\liang\AppData\Local\UniDesk\d601-autostart.cmd""`，工作目录为 `C:\Users\liang\AppData\Local\UniDesk`。
 - Windows launcher：`C:\Users\liang\AppData\Local\UniDesk\d601-autostart.cmd` 先启动 `%ProgramFiles%\Docker\Docker\Docker Desktop.exe`，再执行 `C:\Windows\System32\wsl.exe -d Ubuntu -u ubuntu -- /bin/bash -lc "/home/ubuntu/.local/bin/unidesk-d601-autostart task"`；D601 的 WSL distro 名必须写 `Ubuntu`，不能写成未验证的 `Ubuntu-22.04`。
 - WSL keepalive：`/home/ubuntu/.local/bin/unidesk-d601-autostart` 使用 `~/.state/unidesk/d601-autostart.lock` 防重复，启动 WSL `sshd`，等待 Docker Desktop daemon 和原生 k3s 就绪，把 `unidesk-provider-gateway-D601` 修正为 `restart always` 且 running，然后调用 `/home/ubuntu/.local/bin/unidesk-microservice-autorecover boot`；进入常驻 watchdog 后每 300 秒重复检查 provider-gateway、Docker 直管服务和 k3s 代管服务。