docs: record corrective verification and recovery compatibility

docs/en-US/developer-guide.md

@@ -250,3 +250,9 @@ High-value tests:
 - One-click update: `internal/update/` (status, apply, rollback), HTTP surface in
   `internal/handler/update.go`, CLI switches in `cmd/server/update_cli.go`, thin shell in
   `upgrade.sh`
+
+### Recovery evidence and MCP activation edits
+
+Self-update recovery validates JSON field names/types, duplicate keys, commit/hash relationships and the actual binary files before resuming filesystem changes. The plain-text legacy build marker remains supported, but any accompanying State is validated too. An ambiguous, incomplete or unsupported record is refused with the files and recovery evidence preserved. Do not delete a pending record just to bypass the refusal: first reconcile the source commit, live binary and previous binary/backup.
+
+Editing an existing external MCP without activation fields preserves its current enabled/stopped state. Explicit `disabled` or `external_mcp_enable` fields change activation; `disabled: true` takes precedence. A new server defaults to enabled. Start/Stop also persist the corresponding disabled state, so editing or restarting the application does not silently enable a stopped server.

docs/feature/self-update-recovery-fixes.md

@@ -46,3 +46,12 @@ Tests added for malformed build/rollback journals, all independent review counte
 ### F4 follow-up: activation round-trip consistency
 
 Final GET-to-edit inspection found that manager Start/Stop retained a stale disabled flag even after changing ExternalMCPEnable. Synchronize these two existing fields in the manager as well as persistence, and test the actual GET payload after Start followed by the UI-shaped edit. Maintainability assessment: external_manager.go is 1665 lines (high risk); this narrow fix adds only three assignments beside existing activation assignments, without new control flow or broad refactoring. The additional handler/MCP race suites validate this consistency change.
+
+## Verification and user documentation (F5)
+
+- Recovery code at fab7e603: `go test -race ./internal/update ./internal/handler` passed (84.580s / 16.692s). This includes malformed/null/duplicate/contradictory records, legacy and fresh State entry points, actual absence, pre-merge phase rejection and valid crash controls.
+- Final activation consistency change at ff50af02: `go test -race ./internal/handler ./internal/mcp -count=1` passed (18.658s / 3.281s), including Stop/edit/reload/Start/GET/edit behavior. Independent targeted handler tests also passed.
+- Full Go suite, `go build ./...`, 277 JS tests and shell syntax passed during implementation. A frozen-code full Go/build rerun and exact-head GitHub CI are tracked in F6 before integration.
+- Independent fresh-context code review at ff50af02 found no remaining blockers. Six independent recovery counterexamples were promoted to permanent tests and passed. No acceptance relies solely on test status: refusals assert retained journals/binary data, and valid controls prove continued recovery.
+- English and Chinese developer guides describe refusal/reconciliation behavior and MCP activation field precedence. No public request shape or release version changed.
+- Limits: local validation is macOS arm64; Windows/Linux results come from CI. No production restart/deployment smoke or exhaustive disk fault testing was performed.

docs/zh-CN/developer-guide.md

@@ -290,3 +290,9 @@ i18n 规范见 [前端国际化方案](frontend-i18n.md)。
 - SQLite 迁移兼容。
 
 这些地方比普通 getter/setter 更容易出现真实用户故障。
+
+### 恢复证据与 MCP 编辑启停状态
+
+自更新恢复在改写文件前验证 JSON 字段名称/类型、重复键、提交与哈希配对及实际二进制文件。旧版纯文本待编译标记仍受支持，但关联 State 也必须通过验证。记录不完整、矛盾或格式不受支持时会拒绝恢复并保留文件与恢复证据。不要仅为绕过报错而删除标记，应先核对源码提交、当前二进制和旧二进制/备份的配对。
+
+编辑已有外部 MCP 时，省略启停字段会保留当前启用/停止状态。显式 `disabled` 或 `external_mcp_enable` 可改变启停状态，`disabled: true` 优先；新建 MCP 默认启用。启动/停止按钮同时持久化对应的 disabled 状态，避免编辑或应用重启悄悄启用已停止的服务。