fix(state): pending-boot Restarting overlay must not mask a user stop

Formal gate take-2 went 4/5: iteration 5's vaultwarden stop-wait saw
'restarting' for the full 120s window. A reconcile pass had queued every
app into pending_boot_starts moments before the stop marker landed, and
the scanner's overlay painted the deliberately-stopped app Restarting
until the slow sequential pass reached it (legacy container, so no unit
state to contradict it).

Two filters: the scanner overlay skips user-stopped ids (the marker is
written before the stop runs, so it's reliably present), and the
reconciler no longer queues apps whose lifecycle op is in flight into the
pending overlay (it skips them via the same probe anyway).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-07-09 09:45:06 -04:00
co-authored by Claude Fable 5
parent 6109074748
commit dce541dc49
2 changed files with 21 additions and 6 deletions
@@ -1473,12 +1473,21 @@ impl ProdContainerOrchestrator {
// pass so the scanner overlays queued-but-down apps as Restarting
// instead of Stopped. Each app is deregistered as its turn finishes,
// so a start that genuinely failed shows its real state again.
crate::crash_recovery::pending_boot_starts_add(manifests.iter().flat_map(|lm| {
[
lm.manifest.app.id.clone(),
compute_container_name(&lm.manifest),
]
}));
crate::crash_recovery::pending_boot_starts_add(
manifests
.iter()
// An app mid-lifecycle-op must not enter the pending overlay:
// the scanner would show it Restarting while its stop worker
// is deliberately taking it down (and this pass will skip it
// via the same probe below anyway).
.filter(|lm| !crate::app_ops::lifecycle_op_in_flight(&lm.manifest.app.id))
.flat_map(|lm| {
[
lm.manifest.app.id.clone(),
compute_container_name(&lm.manifest),
]
}),
);
for lm in manifests {
let app_id = lm.manifest.app.id.clone();
let container_name = compute_container_name(&lm.manifest);