osupdate: the health baseline is the start of the leg (inventory reading merged with the apply's own) — an app that stops during the run fails it (found live on demo-hp)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/osupdate/leg_test.go

@@ -263,3 +263,19 @@ func TestWrapperSuite(t *testing.T) {
 		t.Fatalf("wrapper suite did not report OK:\n%s", out)
 	}
 }
+
+// An app that stops BETWEEN the start of the leg and the apply's own "before" reading still fails the run.
+// Measured live 2026-10-04 on demo-hp (privatebin stopped 1 s after the apply plan was written: the old rule
+// passed). Red-proof: use ap.HealthBefore alone as the baseline and this fails.
+func TestHealth_BaselineIsTheStartOfTheLeg(t *testing.T) {
+	stoppedEarly := &Health{DockerOK: true, NetworkOK: true, Controller: "healthy", Containers: map[string]Container{
+		"felhom-controller": {State: "running", Health: "healthy"}, "app": {State: "exited"}}}
+	w := &fakeWrapper{t: t, pending: pend, applyRep: WrapperReport{Upgraded: []Package{{Name: "libc6"}},
+		HealthBefore: stoppedEarly, HealthAfter: stoppedEarly},
+		healthSeq: []*Health{stoppedEarly, stoppedEarly, stoppedEarly, stoppedEarly, stoppedEarly, stoppedEarly, stoppedEarly}}
+	l, _ := newLeg(t, w, &hub.WireOSUpdate{Ring: 0, Enabled: true})
+	rep := l.Run(context.Background(), 9201, "night")
+	if rep.Outcome != "health_failed" || !strings.Contains(rep.HealthReason, "app was running") {
+		t.Fatalf("an app that stopped during the run passed: %+v", rep)
+	}
+}