R-858: after a Docker engine step the wrapper restarts ONLY the containers that mount the docker socket (controller, traefik); the health rule fails when the controller cannot reach Docker from inside its container (ruling 95)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

configs/test_felhom_os_apply.py

@@ -186,6 +186,14 @@ class Fake:
             return 0, self.engine + "\n", ""
         if cmd == "docker" and a[1:3] == ["ps", "-q"]:
             return 0, "".join(i + "\n" for i in self.ids), ""
+        if cmd == "docker" and a[1] == "inspect":
+            mounts = {"aaa111": "/felhom-controller|/var/run/docker.sock;/app/data;", "bbb222": "/app|/data;"}
+            return 0, mounts.get(a[-1], "/other|;") + "\n", ""
+        if cmd == "docker" and a[1] == "restart":
+            self.restarted_containers = a[2:]
+            return 0, "", ""
+        if cmd == "docker" and a[1] == "exec":
+            return (1, "", "Cannot connect to the Docker daemon") if getattr(self, "controller_blind", False) else (0, self.engine + "\n", "")
         if cmd == "docker":
             ids = self.ids + ["x"] * 2
             return 0, f"felhom-controller\trunning\tUp 1 hour (healthy)\t{ids[0]}\napp\trunning\tUp 1 hour (healthy)\t{ids[1]}\n", ""
@@ -804,6 +812,26 @@ class DockerLane(unittest.TestCase):
         rc, rep = run(f)
         self.assertEqual(rep["plan"]["upgrade"], 0, "an older version on an unsigned step is 'already', never installed")
 
+    def test_step_restarts_only_the_socket_users(self):
+        # R-858: after an engine step, ONLY the container that mounts the docker socket is restarted (here the controller)
+        f = docker_fake(signed=signed_job())
+        rc, rep = run(f)
+        self.assertEqual(rc, 0, rep)
+        self.assertEqual(f.restarted_containers, ["felhom-controller"])
+        self.assertEqual(rep["socket_restarted"], ["felhom-controller"])
+
+    def test_no_install_restarts_nothing(self):
+        f = docker_fake(signed=signed_job())
+        f.installed.update({"docker-ce": "5:29.8.2-1~debian.13~trixie", "containerd.io": "2.3.6-1~debian.13~trixie"})
+        rc, rep = run(f)
+        self.assertFalse(hasattr(f, "restarted_containers"), "nothing installed -> no container restart")
+
+    def test_health_says_when_the_controller_cannot_reach_docker(self):
+        f = docker_fake(signed=signed_job())
+        f.controller_blind = True
+        rc, rep = run(f)
+        self.assertFalse(rep["health_after"]["controller_docker_ok"])
+
     def test_health_carries_container_ids(self):
         f = docker_fake(signed=signed_job())
         rc, rep = run(f)