chore(release): drop Windows target, extend stop grace, document single-replica

The Windows release shipped a zip that self-update cannot extract, so
remove the Windows platform, matrix leg, and its dead archive handling
rather than add zip support. Raise the compose stop grace period above the
serial drain plus worker-shutdown budget so Docker does not SIGKILL mid
shutdown. Record that the deployment is single-replica and why, since the
worker leader lease and self-update swap are per-replica.

Co-authored-by: Claude <noreply@anthropic.com>

.github/workflows/release.yml

@@ -105,7 +105,7 @@ jobs:
               require_string(platform, key, "#{platforms_path}: platforms[#{index}]")
             end
             archive = platform["archive"]
-            fail("#{platforms_path}: platforms[#{index}].archive must be tar.gz or zip") unless ["tar.gz", "zip"].include?(archive)
+            fail("#{platforms_path}: platforms[#{index}].archive must be tar.gz") unless archive == "tar.gz"
             platform_key = "#{platform["os"]}-#{platform["arch"]}"
             fail("#{platforms_path}: duplicate platform #{platform_key}") if seen_platforms[platform_key]
             seen_platforms[platform_key] = true
@@ -324,7 +324,6 @@ jobs:
           import pathlib
           import shutil
           import tarfile
-          import zipfile
 
           APP_NAME = "codex-proxy-rs"
 
@@ -360,8 +359,7 @@ jobs:
 
               binary_dest = package_root / platform["binary"]
               shutil.copy2(binary_src, binary_dest)
-              if platform["os"] != "windows":
-                  binary_dest.chmod(0o755)
+              binary_dest.chmod(0o755)
               shutil.copytree(frontend_dir, web_dist, dirs_exist_ok=True)
 
               archive_name = f"{APP_NAME}_{version}_{platform['os']}_{platform['arch']}.{platform['archive']}"
@@ -369,11 +367,6 @@ jobs:
               if platform["archive"] == "tar.gz":
                   with tarfile.open(archive_path, "w:gz") as archive:
                       archive.add(package_root, arcname=APP_NAME)
-              elif platform["archive"] == "zip":
-                  with zipfile.ZipFile(archive_path, "w", zipfile.ZIP_DEFLATED) as archive:
-                      for path in sorted(package_root.rglob("*")):
-                          if path.is_file():
-                              archive.write(path, path.relative_to(package_dir))
               else:
                   raise SystemExit(f"Unsupported archive format: {platform['archive']}")
               archives.append(archive_path)

backend/crates/gateway-host/src/system_update/release.rs

@@ -298,7 +298,6 @@ fn repository_character(character: char) -> bool {
 fn platform_os_aliases() -> &'static [&'static str] {
     match env::consts::OS {
         "macos" => &["macos", "darwin"],
-        "windows" => &["windows", "win32"],
         "linux" => &["linux"],
         _ => &[env::consts::OS],
     }

deploy/compose.yaml

@@ -77,7 +77,9 @@ services:
     restart: unless-stopped
     user: '10001:10001'
     init: true
-    stop_grace_period: 30s
+    # 关闭是串行两段：HTTP drain（host.drain_timeout_seconds=30s）之后 worker join
+    # （host.worker_shutdown_timeout_seconds=30s），宽限期必须大于两者之和。
+    stop_grace_period: 75s
     depends_on:
       postgres:
         condition: service_healthy

docs/architecture.md

@@ -4,7 +4,7 @@
 
 ## 1. 系统边界
 
-Codex Proxy RS 是单进程、可多副本部署的多 Provider AI 网关：
+Codex Proxy RS 是单进程、单副本部署的多 Provider AI 网关：
 
 - 客户端面提供 OpenAI Responses 兼容的 JSON、SSE、WebSocket 与模型目录协议。
 - 管理面提供 `/api/admin/*` 和 Vue 静态管理端。
@@ -15,6 +15,8 @@ Codex Proxy RS 是单进程、可多副本部署的多 Provider AI 网关：
 - PostgreSQL 是业务与配置事实的唯一权威存储。
 - Redis 只保存可丢失、可重建或有自然过期时间的协调状态。
 
+部署假定：单副本。带 lease 的周期任务只做单周期互斥而非跨周期 leader 选举，N 副本会让同一任务最坏以 N 倍频率执行（见第 10 节）；自更新只替换并重启处理该请求的那个副本，其余副本停留在旧版本。不要以多副本方式运行本网关。
+
 Gateway Engine 不识别具体 Provider 协议；Provider 不拥有客户端 admission、跨 Provider 路由或业务重试预算。
 
 ## 2. Workspace 与依赖方向

release/platforms.yaml

@@ -23,10 +23,3 @@ platforms:
     target: aarch64-apple-darwin
     binary: codex-proxy-rs
     archive: tar.gz
-
-  - os: windows
-    arch: amd64
-    runner: windows-latest
-    target: x86_64-pc-windows-msvc
-    binary: codex-proxy-rs.exe
-    archive: zip