browser/openspec/changes/repair-run-runtime-state-and-log-recovery/tasks.md

0. Task Boundaries

正向提示词：为服务器管理第一方区域建立可靠的 Run 运行状态与重启后日志恢复能力。成功标准是：Run 观察到的启动、停止、退出和恢复状态能安全投影到 Platform；Run 重启后管理终端继续收到新日志；Run 离线时界面明确显示状态未验证而不伪造“已停止”。

方向提示词：在 platform/ 实现签名 Run 契约、运行观测投影和日志进度查询，在独立 git@git.npc0.com:admin343/run.git 实现通用进程观察与 spool 水位恢复，在 platform_web/ 展示状态新鲜度。保留插件声明的生命周期和日志源、Platform-Run 通道隔离、现有 SSE 历史回放。验证必须覆盖两个仓库的定向测试、scripts/check-structure.sh，以及严格 OpenSpec 校验。

任务边界：不得把 run/ 源码加入本仓库；不得在 Platform 或 Run 写入 SCUM 可执行文件、端口、Steam、路径或文件尾随特例；不得提供浏览器到主机的直接 shell、socket、路径或凭据访问；不得将 Run 失联直接投影为服务器已停止；不得混入账单、云主机销售或第三方平台代理工作流。

1. Platform Contracts And Projections

• 1.1 Add typed domain, DTO, API, validation, and protocol contracts for signed Run log-stream progress queries scoped to the authenticated Run endpoint and bound server instance.
• 1.2 Implement Platform log-stream progress lookup that returns only the latest acknowledged sequence and cannot disclose log bodies, host paths, credentials, or another server's stream metadata.
• 1.3 Extend Run lifecycle observations with stable managed-process identity and ordering data, then make lifecycle projection idempotent and reject stale state regressions.
• 1.4 Project autonomous Run recovered and exit observations through the existing signed lifecycle channel, preserving requested-stop versus unexpected-exit classification.
• 1.5 Expose a server runtime observation view that combines the persisted lifecycle projection with generic bound-endpoint heartbeat freshness without changing lifecycle state solely because Run is unavailable.
• 1.6 Add focused Platform tests for report ordering/idempotency, authorization and scope of log progress, progress values after durable ingest, and fresh versus unverified runtime observation.

2. Independent Run Recovery

• 2.1 Update the shared/copyable Run-Platform protocol types and API client in git@git.npc0.com:admin343/run.git for lifecycle observation ordering and signed log-stream progress reconciliation.
• 2.2 Add atomic per-stream allocated and acknowledged watermark persistence to the Run log spool, including restart loading and acknowledgement-before-segment-deletion ordering.
• 2.3 Replace the worker-global in-memory log counter with stream-specific allocation restored from the spool watermark and pending durable segments.
• 2.4 Reconcile signed Platform stream progress before a stable Run-bound stream with no local watermark emits new entries; cover newly created and recreated-spool cases.
• 2.5 Classify acknowledged-range conflicts and sequence gaps as durable recovery failures, quarantine the affected spool segment with redacted diagnostics, and resume only after safe watermark reconciliation.
• 2.6 Make autonomous process supervision report observed exit and startup-recovery transitions through the lifecycle channel, with retry-safe process identity and ordering metadata.
• 2.7 Define and test graceful Run shutdown behavior that preserves durable state and never reports a server stop unless its generic supervisor observed that process state.
• 2.8 Add Run unit tests for per-stream interleaving, restart continuity, missing-watermark progress lookup, conflict quarantine, process exit reporting, and Windows supervisor recovery.

3. Management Runtime Presentation

• 3.1 Extend Platform Web API types and server-management contracts to consume lifecycle projection and runtime observation freshness separately.
• 3.2 Update server list and server detail status UI so stale running is presented as last observed with a Run offline/unverified qualifier, not confirmed online.
• 3.3 Update the management terminal header and empty/error states to show that live output awaits Run recovery while preserving accepted bounded SSE history.
• 3.4 Add focused frontend tests for fresh, stale, offline, and recovered Run observations plus terminal presentation during log recovery.

4. Cross-Repository Verification And Release

• 4.1 Run Platform and Run contract compatibility tests for signed progress recovery and lifecycle observation ordering.
• 4.2 Perform a Windows generated Run scenario covering normal start, supervised process exit, direct Run restart with retained spool, recreated spool reconciliation, quarantined conflict, and operator-requested stop.
• 4.3 Run targeted Go and frontend test suites, scripts/check-structure.sh, and openspec validate repair-run-runtime-state-and-log-recovery --strict; record the evidence before completing tasks.
• 4.4 Deploy Platform compatibility before the Run release, then verify runtime freshness and terminal delivery in an environment with no direct browser-to-host access.