docs: establish the Kiwi SDD architecture control plane (#414)

* docs: make Kiwi architecture delivery state auditable

Consolidate the verified current architecture, target design, milestones, work packages, GitHub inventory, and delivery gates into .planning/SDD.md as the sole authoritative project entry. Replace ROADMAP, STATE, and KANBAN project-state content with compatibility pointers, update documentation navigation, and require implementation PRs to link a work package, primary Issue, and REQ entries.

Constraint: Documentation and delivery-control changes only; no runtime, storage, Raft, protocol, build, or CI checker behavior is changed.

Confidence: high

Scope-risk: moderate

Tested: committed and working diff checks; Markdown relative-link and placeholder scans; 38 fence lines paired; 63 REQ and 18 Decision reference closure; eight work-package field contracts; live Issue #413, open-Issue count, critical PR snapshot, and remote main verification; independent review with all Important findings resolved.

Not-tested: Rust build, Clippy, unit tests, integration tests, and sanitizers were not run because this commit changes documentation and the PR template only.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

* docs: record the WP0 pull request

Bind the active WP0 state to PR #414 now that GitHub has assigned the pull-request number. Keep the SDD as the recoverable source for the current Issue, plan, PR, and next safe action before the PR is marked ready for review.

Constraint: Update only the SDD execution pointer; do not change architecture, work-package scope, runtime behavior, Issue state, or merge authorization.

Confidence: high

Scope-risk: narrow

Tested: git diff --check; staged diff check; SDD fence balance; live PR #414 OPEN/DRAFT Head/Base verification.

Not-tested: Rust and runtime tests were not run because this commit only records the newly assigned PR number.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

* fix(docs): enforce SDD review contracts

Close the review gaps in WP0 by separating milestones from work packages, aligning Issue relation keywords with Issue #413, and mapping every target invariant to its current state, gap, owner, and acceptance evidence.

Add a fail-closed SDD validator and CI job that bind the 63 Requirement definitions, 18 Decisions, 20 WP0 artifacts, current-state mirrors, work-package field contracts, Markdown links, and exact baseline diff. Cover comments, fenced and indented code, duplicate or undefined registry entries, gate-text drift, artifact drift, and lifecycle transitions with mutation tests.

Constraint: Preserve runtime, storage, Raft, protocol, and merge behavior; this commit changes only documentation governance and its verification tooling.

Confidence: high

Scope-risk: moderate

Tested: Windows and WSL validator self-tests with 20 failure-path mutations and one lifecycle transition; Windows and WSL main validation; exact 20-file baseline diff closure; Python AST; GitHub Actions YAML parse; external PR #414 contract probe; staged and baseline git diff --check.

Not-tested: Rust build, Clippy, runtime tests, integration tests, and sanitizers were not rerun locally because no Rust, Cargo, or runtime behavior changed; fresh GitHub CI is required on the pushed Head.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

* fix(ci): complete validator license header

Add the repository-required arana-db Community copyright line to the new SDD validator so the SkyWalking Eyes header check recognizes the full configured Apache-2.0 template.

Constraint: Change only the validator file header; preserve validation behavior and the WP0 artifact contract.

Confidence: high

Scope-risk: narrow

Tested: validator self-tests; main validator; git diff --check; staged diff check; exact comparison with the existing Python license header template.

Not-tested: The remote license job must rerun on the new Head.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

* fix(ci): close validator review gaps

Disable checkout credential persistence and make the SDD validator fail closed without tracebacks when either registry artifact is absent.

Tighten the deprecated Issue-keyword match, derive the baseline mutation from current front matter, and add scoped Markdown failure-path coverage. The self-test now exercises 25 negative mutations plus lifecycle and ordinary-prose positive paths.

Constraint: Preserve the 20-artifact WP0 scope and all runtime behavior; change only the planning-doc CI job and validator robustness.

Confidence: high

Scope-risk: narrow

Tested: Windows and WSL validator self-tests; Windows and WSL main validation; Python AST; GitHub Actions YAML parse; external PR #414 probe; staged diff check.

Not-tested: Fresh GitHub CI and CodeRabbit rereview must run on the pushed Head.

Co-authored-by: OmX <omx@oh-my-codex.dev>
Signed-off-by: Xin.Zh <alexstocks@foxmail.com>

---------

Signed-off-by: Xin.Zh <alexstocks@foxmail.com>
Co-authored-by: OmX <omx@oh-my-codex.dev>

Author: AlexStocks

.github/pull_request_template.md

@@ -1,30 +1,66 @@
-### Description
-Fixes # (issue)
+## SDD Traceability
 
-<!-- Please describe your changes in detail -->
+- Work package: WP-N
+- SDD baseline: commit SHA
+- Primary issue: Fixes #N / Closes #N / Refs #N / Related #N
+- Parent or Epic: Refs #N / Related #N / N/A
+- Related issues: Refs #N / Related #N / N/A
+- Design context: Discussion #N / N/A
+- Requirements:
+  - REQ-DOMAIN-NNN
+- Decisions:
+  - DNNN / N/A
 
-### Type of Change
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+Use Fixes #N or Closes #N only when this PR completely satisfies every required
+acceptance criterion of that Issue. Partial work must use Refs #N or Related #N.
+
+## Description
+
+<!-- Describe the problem, design, implementation, and intentionally excluded scope. -->
+
+## Type of Change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Breaking change
 - [ ] Documentation update
 - [ ] Performance improvement
 - [ ] Code refactoring
+- [ ] Test or verification infrastructure
+
+## Scope Completion
+
+- [ ] This PR has one primary work-package objective.
+- [ ] The primary Issue still matches the current source and PR scope.
+- [ ] Fixes is used only for a completely satisfied Issue.
+- [ ] Deferred acceptance items are represented by separate open Issues.
+- [ ] Required tests and documentation are included.
+- [ ] Frozen work such as Embedded Redis Hot Tier is not implemented.
+
+## Verification
+
+- Environment:
+- Commands:
+- Results:
+- Uncovered risks:
+- [ ] After merge, record the PR number, merge SHA, exact main commit, commands,
+      environment, result, and residual risk in `.planning/SDD.md` before marking
+      the work package `verified` or `accepted`.
+
+## Checklist
+
+- [ ] Target branch is main or the approved feature branch.
+- [ ] Code follows the Rust style and project conventions.
+- [ ] Formatting checks pass.
+- [ ] Clippy checks pass.
+- [ ] Targeted tests prove the changed success, failure, and boundary paths.
+- [ ] Required existing tests pass.
+- [ ] Public behavior changes include Redis 8.8.1 Oracle evidence.
+- [ ] Storage/Raft changes include required Linux/WSL and fault evidence.
+- [ ] Documentation and compatibility manifests are updated.
+- [ ] No required test is silently skipped.
+- [ ] Security, sensitive logging, and third-party license impact were checked.
+
+## Additional Context
 
-### Checklist
-- [ ] I confirm the target branch is `main` (or appropriate feature branch)
-- [ ] My code follows the project's Rust coding style and conventions
-- [ ] Code has passed local testing (`make test`)
-- [ ] Code has passed clippy checks (`make lint`)
-- [ ] Code is properly formatted (`make fmt`)
-- [ ] I have added tests that prove my fix is effective or that my feature works
-- [ ] All new and existing tests pass
-- [ ] I have updated the documentation (if applicable)
-- [ ] My changes generate no new warnings or errors
-- [ ] I have checked for potential security issues
-
-### Testing
-<!-- Describe the tests you ran to verify your changes -->
-
-### Additional Context
-<!-- Add any other context about the PR here -->
+<!-- Add migration, rollback, compatibility, follow-up, or review context. -->

.github/workflows/ci.yml

@@ -33,6 +33,21 @@ env:
   RUST_BACKTRACE: short
 
 jobs:
+  planning-docs:
+    name: planning SDD validation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Validate failure paths
+        run: python3 scripts/validate_sdd.py --self-test
+
+      - name: Validate SDD control plane
+        run: python3 scripts/validate_sdd.py
+
   license-check:
     name: license header check
     runs-on: ubuntu-latest

.planning/DECISIONS.md

@@ -98,3 +98,50 @@
 - 当前应用：Redis 8.8.1 Oracle provenance 的六文件实现草稿保持未暂存、未提交、未 push，并在原 recovery worktree 冻结。本 task 只发布方案 A 的项目真相、设计和后续实施计划。
 - 后续要求：实施必须另开 task，在新的隔离 worktree 保存独立 recovery checkpoint；可只读参考冻结草稿，但必须逐项对照 `D011` 和 `REQ-COMPAT-008` 至 `REQ-COMPAT-010` 重新审计，不能把既有绿测当作接受证据。
 - 理由：Kiwi 底层兼容、存储和 Raft 工作并行且依赖严格。混合规划和实现会隐式改变任务优先级、污染 dirty ownership，并让未批准代码反向定义架构。
+
+## D013：使用单一 SDD 权威入口
+
+- 日期：2026-08-02
+- 状态：accepted
+- 决定：.planning/SDD.md 是项目唯一权威入口，统一维护当前架构、M0-M10 路线、M0-M6 当前可执行里程碑范围、WP0-WP7 工作包、当前状态、Issue/PR 追踪和验证门禁。
+- 后果：STATE.md、KANBAN.md 和 ROADMAP.md 只保留兼容迁移指针，不维护独立状态。PROJECT、REQUIREMENTS、DECISIONS、OPEN_QUESTIONS 和 REFERENCES 作为 SDD 下属注册表。
+- 理由：此前同一状态分散在多份文件中，PR 合并后容易产生状态、优先级和当前计划漂移。
+
+## D014：实施 PR 强制关联工作包、Issue 和 Requirement
+
+- 日期：2026-08-02
+- 状态：accepted
+- 决定：每个实施 PR 必须声明一个 SDD 工作包、一个 primary GitHub Issue 和适用的 REQ-*。
+- 关闭语义：只有完整满足 Issue 全部 required acceptance criteria 时使用 Fixes/Closes；部分实现使用 Refs/Related。
+- 后果：没有精确 Issue 的工作包不能进入 ready；宽泛 Epic 必须拆 child Issue；Discussion 只能作为设计来源。
+
+## D015：保持 network/storage 数据面隔离并建立统一生命周期
+
+- 日期：2026-08-02
+- 状态：accepted
+- 当前事实：进程有 bootstrap、network、storage 三个 Tokio Runtime；双 Runtime 只描述请求数据面。
+- 决定：保留 network/storage 数据面隔离，不增加第四 Runtime；通过统一 supervisor、有界队列、absolute deadline、cancel 和 JoinHandle 建立确定性生命周期。
+- 退出顺序：停止 admission，drain network、storage 和 Raft，结束后台任务，关闭 RocksDB，最后停止 Runtime。
+
+## D016：未知持久化版本默认 fail closed
+
+- 日期：2026-08-02
+- 状态：accepted
+- 决定：未知 disk format、CF schema、comparator、StorageManifest 或 Snapshot metadata 版本默认拒绝启动或安装。
+- 例外：只有显式列入兼容范围并有真实 upgrade/rollback 与 reopen 证据的版本可以接受。
+- 理由：旧二进制无法推断未来版本对 CF、encoding、comparator、topology 或恢复语义的改变。
+
+## D017：当前不支持真正 Multi-Key
+
+- 日期：2026-08-02
+- 状态：accepted
+- 决定：当前真正 Multi-Key 命令在 storage 和 Raft 前统一拒绝；本阶段不实现跨 Slot 原子性、2PC、跨实例快照或分布式锁协议。
+- 重新立项条件：明确 slot map、原子 batch、锁或事务协议、故障恢复和 Redis 8.8.1 可观察语义。
+- 来源：Discussion #346。
+
+## D018：兼容性与故障验证使用分层门禁
+
+- 日期：2026-08-02
+- 状态：accepted
+- 决定：PR fast gate 运行受影响的 raw RESP、单元、集成和静态门禁；nightly/full gate 运行 TCL、完整 differential、fuzz、deterministic Raft 和故障矩阵；M6/release gate 运行 fresh rebuild、真实 upgrade/rollback、close/reopen 和 3/5 节点历史验证。
+- 后果：绿色 PR fast gate 不能被解释为系统稳定或生产级一致性已经证明。

.planning/KANBAN.md

@@ -1,98 +1,5 @@
-# Kiwi Kanban
+# 看板入口已迁移
 
-> 更新日期：2026-07-31
->
-> 当前里程碑：M1 Redis 8.8.1 Cache OFF compatibility foundation
->
-> 当前 task：PR `#404` integration（远端 `codex/fix-resp-parser-limits`，本地 v4）；最新基线 `main` at `ed49ab4c3c362ba77111dbcd9791f93ebfce74a4`
->
-> 当前运行模式：Cache OFF
->
-> 规则：每张实现卡必须引用完整 Requirement ID；完成必须附 exact commit、环境和可重复验证证据。
+M0-M10 路线、M0-M6 当前可执行里程碑范围、WP0-WP7 工作包及其状态和依赖统一维护在 [SDD.md](SDD.md)。
 
-## In Progress
-
-| ID | 工作项 | Requirement / Gate 关系 | 当前状态 |
-|---|---|---|---|
-| `RESP-LIMITS-001` | 在已合并 #406 的零声明驱动分配合同上，完成 #404 的有界 RESP 解析、未认证 buffer、parser 历史副本和 optional pipeline 背压 | `REQ-COMPAT-002`、`REQ-COMPAT-006`、`REQ-STABILITY-002`、`REQ-STABILITY-003`、`REQ-WORK-003` | #402、#403、#405、#406 已合并；v4 已解决最新 base 的 parser/pipeline 冲突，并通过 Windows/WSL 最终验证；当前发布、CI 与 review 状态从 PR #404 实时查询 |
-
-## Ready for a separate implementation task
-
-启动下列卡片必须创建新的 Codex task、linked worktree、TaskId 和 recovery checkpoint。Planning branch 和旧草稿 worktree 都不能直接切换成 implementation。
-
-| ID | 工作项 | Requirement / Decision | 前置条件 |
-|---|---|---|---|
-| `M1-001-T2` | Redis 8.8.1 trusted Oracle provenance：primary build、fresh-checkout independent rebuild、binary hash equality、rebuild runtime evidence | `REQ-COMPAT-001`、`REQ-COMPAT-008`、`REQ-COMPAT-009`、`REQ-COMPAT-010`；`D011`、`D012` | PR `#383` 已合并；仍须新建专用 implementation task/worktree；当前 PR `#388` 不替代该任务；真实双 checkout reproducibility 是卡片内第一道实现门禁 |
-| `M1-002` | RESP2/RESP3 持久连接级 raw wire differential harness | `REQ-COMPAT-002`、`REQ-COMPAT-006` | `M1-001-T2` 产生可验证 provenance |
-| `M1-003` | Redis 8.8.1 TCL external-server runner | `REQ-COMPAT-004` | `M1-001-T2` |
-| `M1-004` | redis-rs test-only compatibility crate | `REQ-COMPAT-005`、`REQ-COMPAT-006` | `M1-001-T2` |
-| `M1-005` | partial-I/O property tests、parser fuzz seeds 与连接生命周期测试 | `REQ-COMPAT-002`、`REQ-COMPAT-006` | Task 1 manifest 可用 |
-| `M2-001` | RocksDB authority/durability contract | `REQ-STORAGE-001`、`REQ-STORAGE-002` | Task 1 manifest；与 M1 Oracle 保持隔离 |
-| `M2-002` | 扩展 close/reopen 至全部 RocksDB handle、TTL/metadata、Snapshot 和故障证据 | `REQ-STORAGE-002`、`REQ-STORAGE-004` | `M2-001` |
-| `M2-003` | format version、Comparator 和 Kiwi RocksDB key/value encoding contract | `REQ-STORAGE-003`、`REQ-STORAGE-005` | `M2-001` |
-| `M4-001` | `kiwi_redisraft_public_v1` 机器可读 manifest | `REQ-RAFT-003`、`REQ-RAFT-004` | Task 1 manifest schema |
-
-## Accepted implementation
-
-| ID | 工作项 | Evidence | 状态 |
-|---|---|---|---|
-| `M1-001-T1` | Redis 8.8.1 exact compatibility manifest | PR `#372`；final Head `6a692bc195f96327296296977a100af301deaf01`；merge commit `9e91707d774ad367d682e23677dcef79ecb14338` | 已合并到 `main` |
-| `PR388-001` | C/C++ sccache 构建接入、跨平台回归探针、PRD/用户故事及 review 一致性修复 | PR `#388`；final Head `1ee8c916a55d03d02a250ed95af83712fa14a742`；2026-07-30 merged | 已合并到 `main` |
-
-## Frozen unaccepted drafts
-
-| ID | Worktree | 内容 | 规则 |
-|---|---|---|---|
-| `M1-001-T2-DRAFT` | `D:\test\github\kiwi\.worktrees\redis-8.8.1-stability-foundation` | 六文件未提交 Oracle build/verifier 草稿 | 不继续、不 stage、不 commit、不 push、不清理；后续新 task 只读审计，不把绿测当作方案 A 证据 |
-
-## Frozen by system stability gate
-
-下列卡片在 `docs/quality/system-stability-gate.md` 全部通过、M7 前置设计完成审查且用户明确批准对应的单独 implementation task 前，不得转入 Ready 或 In Progress。Gate PASS、PR 合并或里程碑 Ready 均不自动授权生产实现。
-
-| ID | 工作项 | Requirement | Gate | 冻结范围 |
-|---|---|---|---|---|
-| `M7-001` | 建立并修改用于 Kiwi 发行的 Redis fork | `REQ-HOT-002`；`REQ-LICENSE-002` 至 `REQ-LICENSE-008` | Gate PASS + 单独 implementation task 明确批准 | fork 代码、patch、生产构建均禁止 |
-| `M7-002` | Embedded Redis Hot Tier 动态库 C ABI spike | `REQ-HOT-010`、`REQ-HOT-012`；`REQ-LICENSE-003`、`REQ-LICENSE-005`、`REQ-LICENSE-007` | Gate PASS + 单独 implementation task 明确批准 | `.so`、`.dylib`、`.dll`、import/static library 均禁止 |
-| `M7-003` | Kiwi 安全 loader、pairing manifest 和 FFI binding | `REQ-HOT-010`、`REQ-HOT-011`、`REQ-HOT-012` | Gate PASS + 单独 implementation task 明确批准 | 生产 crate 依赖、配置和加载路径均禁止 |
-| `M7-004` | String update-or-invalidate MVP | `REQ-HOT-001`、`REQ-HOT-003` 至 `REQ-HOT-007`、`REQ-HOT-009` | Gate PASS + 单独 implementation task 明确批准 | Cache ON 读写路径禁止 |
-| `M8-001` | Cache OFF/ON differential 与热层故障注入 | `REQ-HOT-004` 至 `REQ-HOT-008`；`REQ-RAFT-002` | M7 全部资格门禁 | 不得用未实现热层替代当前正确性测试 |
-| `M8-002` | Redis/Kiwi OFF/Kiwi ON 性能与资源基线 | `REQ-PERF-001`、`REQ-PERF-002`、`REQ-PERF-003`；`REQ-OBS-003` | M7/M8 正确性门禁 | 性能工作不得先于语义与故障证明 |
-
-## Backlog
-
-| ID | 工作项 | Requirement | Milestone |
-|---|---|---|---|
-| `M3-001` | Redis 8.8.1 String/Hash/List/Set/ZSet required profile 闭环 | `REQ-COMPAT-003`、`REQ-COMPAT-007` | M3 |
-| `M3-002` | Transaction、WATCH、Lua 与错误/TTL 语义闭环 | `REQ-COMPAT-003`、`REQ-COMPAT-006`、`REQ-COMPAT-007` | M3 |
-| `M3-003` | Pub/Sub、阻塞命令、ACL、RESP3 与连接行为闭环 | `REQ-COMPAT-002`、`REQ-COMPAT-003`、`REQ-COMPAT-006`、`REQ-COMPAT-007` | M3 |
-| `M4-002` | Rust OpenRaft deterministic simulator | `REQ-RAFT-006` | M4 |
-| `M4-003` | RAFT.CLUSTER/NODE/TRANSFER_LEADER 与 INFO/CONFIG | `REQ-RAFT-003`、`REQ-RAFT-004` | M4 |
-| `M4-004` | Membership、Snapshot、Leadership Transfer 和 LogStore reopen 扩展 | `REQ-RAFT-001`、`REQ-RAFT-002`、`REQ-RAFT-005` | M4 |
-| `M5-001` | 3/5 节点 process harness 与网络故障矩阵 | `REQ-RAFT-006`、`REQ-RAFT-007` | M5 |
-| `M5-002` | 磁盘故障、Snapshot 中断和 Elle/Jepsen history | `REQ-STORAGE-004`；`REQ-RAFT-005`、`REQ-RAFT-007` | M5 |
-| `M5-003` | `SUBMIT_UNKNOWN`、查询和受控去重 | `REQ-RAFT-008` | M5 |
-| `M6-001` | System Stability Gate Review | `REQ-STABILITY-001` 至 `REQ-STABILITY-006` | M6 |
-| `M9-001` | 跨平台发行、SBOM、升级/回滚与运维门禁 | `REQ-LICENSE-003` 至 `REQ-LICENSE-008`；`REQ-WORK-003` | M9 |
-| `M10-001` | 单 Group 瓶颈证据与 Multi-Raft 立项评估 | 新里程碑批准时新增 | M10 |
-
-## Done in planning/documentation
-
-以下状态只表示项目真相、设计合同和实施计划完成，不表示源码实现完成。
-
-| ID | 工作项 | 证据 |
-|---|---|---|
-| `M0R-001` | 项目宪法、需求、决定、Roadmap、State 与 Kanban 已统一 | Redis 8.8.1 stability foundation 文档基线 |
-| `M0R-002` | Redis 8.8.1 兼容、系统边界、许可证与未来 ABI 设计已冻结 | 专题设计和稳定性门禁 |
-| `M0R-003` | 系统稳定门禁已建立，热层实现卡已冻结 | `docs/quality/system-stability-gate.md` |
-| `M0R-004` | Cache OFF 稳定基础总计划已写入 | `docs/superpowers/plans/2026-07-26-redis-8.8.1-stability-foundation.md` |
-| `M0R-005` | Trusted Oracle independent-rebuild 设计和实施计划已冻结 | `D011`；`REQ-COMPAT-008` 至 `REQ-COMPAT-010`；2026-07-28 spec/plan |
-| `M0R-006` | 规划 task 与实施 task 分离规则已冻结 | `D012`；`REQ-WORK-005`；`CLAUDE.md` recovery rules |
-
-## WIP 与授权规则
-
-- 同一时间只允许一个 implementation card 处于 In Progress；当前为 `RESP-LIMITS-001`，planning/docs task 不得隐式持有 implementation card。
-- 规划批准不授权修改 source、tests、build scripts 或 CI，也不授权 stage/commit/push 实现文件。
-- 从 planning 转 implementation 必须创建新 Codex task、TaskId、worktree、dirty allowlist 和 recovery checkpoint；不能只把 recovery mode 从 `planning` 改成 `implementation`。
-- 冻结草稿不得覆盖、续写、清理或回退；后续实施只读参考并重新审计。
-- `M1-001-T2` 必须先通过真实双 checkout reproducibility；不能把方案 A 降级为 metadata self-attestation。
-- 系统稳定门禁通过后，M7 仍需用户明确批准一个单独 implementation task，不能因 Gate PASS、PR 合并或 Ready 状态自动启动。
+本文件仅为兼容历史链接保留，不再维护独立看板。工作包不得通过修改本文件改变状态。

.planning/OPEN_QUESTIONS.md

@@ -2,7 +2,7 @@
 
 > 本文件集中收录当前未闭合、需要 owner / 决策 / 证据才能推进的问题。
 > 与 `REQUIREMENTS.md`（已按 P0/P1/P2 标注）互补：REQUIREMENTS 描述"要做什么"，本文件描述"还不确定什么"。
-> 任何一项得出结论后，应同步更新 `DECISIONS.md` / `ROADMAP.md` / `KANBAN.md`，并从本清单移除。
+> 任何一项得出结论后，应同步更新 `DECISIONS.md` 和 `SDD.md`，并从本清单移除。
 
 ## OQ-1 [OPEN] 热层（Hot Tier）解冻条件与门禁证据
 - **背景**：`REQ-STABILITY-001/002/005` 规定，未来内嵌 Redis 8.8.1 原生内存热层在投入生产前，必须由系统稳定性门禁明确给出"通过"结论并由用户批准解除冻结。当前整体处于冻结态（`REQ-HOT-*` 全部 `P2`）。
@@ -63,5 +63,5 @@
 
 ## 维护规则
 - 新增待确认项：标题使用 `OQ-N [OPEN] 标题`；若缺少前置证据或外部决定，改为 `OQ-N [BLOCKED] 标题` 并写明阻塞条件。
-- 得出结论：将结论写入 `DECISIONS.md`，更新 `ROADMAP.md` / `KANBAN.md`，并删除本清单对应条目；已决定事项不在本文件保留副本。
+- 得出结论：将结论写入 `DECISIONS.md`，更新 `SDD.md`，并删除本清单对应条目；已决定事项不在本文件保留副本。
 - 本清单不替代 issue 讨论；issue 是讨论场所，本文件是决策前的聚合视图。