# ISS-0039: Agent 应在 node restart 场景下主动检查 Activity Hub 事件

## Background

In workspace `ws-1776646913272-b0d2b9b99` (TCOC-5140), 4 TiKV nodes restarted during the latency spike window. The agent analyzed metrics, logs, memory, and TopSQL extensively but never checked Activity Hub events for human operations. The root cause — a `ScaleResourcePool` operation by `debin.jia@pingcap.com` — was only discovered after the user's 4th intervention ("这个过程有可能是人工干预/操作导致的吗？").

Activity Hub clearly showed:
- Operation: `ScaleResourcePool` (TiKV CPU 16→32 cores)
- Operator: `debin.jia@pingcap.com`
- Timestamp: 10:47:23 UTC+8 (exactly matching the first SIGTERM at 10:47:58)

This should have been one of the first things checked.

## Root Cause

The `tidb-clinic-diagnosis` SKILL.md does not include Activity Hub event querying as a standard step for node restart scenarios. The `collect_evidence.py` script collects metrics and logs but does not query Activity Hub events.

## Fix Plan

### Step 1: Add Activity Hub query to collect_evidence.py

Add a new section (A7 or similar) to `collect_evidence.py` that queries Activity Hub events:

```python
# A7: Activity Hub events
events = clinic_api.get_cluster_events(
    cluster_id=cluster_id,
    start=start_epoch - 1800,  # 30 min before
    end=end_epoch + 1800       # 30 min after
)
```

Output should include event type, operator, timestamp, and details.

### Step 2: Add routing rule to SKILL.md Node C

```markdown
### Node Restart Routing

If evidence shows node restarts (from A2 health check or metrics):
1. **FIRST**: Check Activity Hub events for human operations (ScaleResourcePool, UpgradeCluster, RollingRestart, Maintenance)
   - If found → attribute restarts to the operation, analyze impact on latency/availability
   - If not found → proceed with OOM/crash/eviction investigation
2. Check termination signals (SIGTERM vs SIGKILL)
3. Check memory/CPU/disk pressure
```

### Step 3: Verification

1. Replay TCOC-5140 and verify:
   - Agent queries Activity Hub events early in the analysis
   - Agent finds ScaleResourcePool operation
   - Agent correctly attributes restarts to the scaling operation without human guidance