Lock stacks during compose runs, cache stats, persist runtime state (0.47.0)

F7 — Nothing stopped two compose operations landing on the same stack. There
was a busy flag, but is_busy() was only ever read to colour the status column;
no lifecycle handler consulted it before acting. Two tabs, or auto-update
picking up a stack somebody had just clicked, both ran pull + up -d against the
same project and raced over recreating containers.

Lifecycle calls, the two deploy WebSockets and the auto-update pass now take a
real lock; a second caller gets 409 (or an error frame and close 4409) and
auto-update skips and retries next cycle. The lock is a row rather than a set
in one worker's memory, so it holds across workers and across a restart, and it
carries an expiry — a worker killed mid-deploy would otherwise strand the stack
with no fix short of editing the database.

F10 — /api/stacks/stats sampled every running container on every call, one
blocking daemon request each, and both the dashboard and the stacks list poll
it every five seconds. Two tabs on a 40-container host meant a sustained ~16
samples a second. Cached for 4s behind a lock so concurrent callers share one
sweep, the same shape dashboard_service already used for its fleet aggregate.

F11 — Three module dicts assumed exactly one uvicorn worker without saying so
and were lost on restart. The busy set is the lock above. The image update
cache is now mirrored to SQLite, so a restart shows the badges immediately
instead of blanking them for up to an hour, and the already-notified marks come
back with them rather than re-announcing the same updates. The login rate
limiter is a table, so it cannot be cleared by getting the process to restart
and no longer multiplies by the worker count.

The constraint that shaped this: compose_service and update_service are shared
with the agent, which has no database. Neither may import one. So the lock is a
separate service the central app enforces at its own entry points, and update
persistence is an opt-in callback the central app registers in its lifespan —
the agent registers nothing and behaves exactly as before. A test asserts
update_service never imports the database, since that is the kind of thing a
later change breaks silently.

Both new nets were checked by reverting the fix: dropping the lock from
_lifecycle fails six tests, removing the stats cache fails the one that names
the behaviour.

Also wires up cache pruning in the same sweep — without it both the dict and
the table grew one entry per image tag ever run, for the life of the install.

31 new tests (729 total).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dk43rmEeRfYi5wsLDbmfyG

backend/services/update_service.py

@@ -10,6 +10,7 @@ import asyncio
 import logging
 import time
 from dataclasses import asdict, dataclass
+from collections.abc import Callable
 from typing import Optional
 
 import httpx
@@ -50,6 +51,49 @@ _CACHE: dict[str, UpdateStatus] = {}
 # background loop doesn't re-notify on every cycle.
 _NOTIFIED: set[str] = set()
 
+#: Optional sink for cache writes.
+#:
+#: This module is shared with the agent, which has no database, so persistence
+#: cannot live here. The central app registers a callback that mirrors each
+#: entry into SQLite (see ``services/image_status_store.py``) and seeds the
+#: cache from it at startup; the agent registers nothing and behaves exactly as
+#: before. Without it a restart blanked every update badge until the next
+#: background sweep — up to an hour — and re-announced updates it had already
+#: notified about.
+_persist_cb: Optional[Callable[[UpdateStatus, bool], None]] = None
+
+
+#: Optional sink for "these images are still in use", same opt-in shape as
+#: _persist_cb. Keeps both the dict and the table from growing one entry per
+#: image tag that was ever running, for the life of the install.
+_prune_cb: Optional[Callable[[set], int]] = None
+
+
+def set_persist_callback(
+    callback: Optional[Callable[[UpdateStatus, bool], None]],
+    prune: Optional[Callable[[set], int]] = None,
+) -> None:
+    global _persist_cb, _prune_cb
+    _persist_cb = callback
+    _prune_cb = prune
+
+
+def restore_cache(entries: list[tuple[UpdateStatus, bool]]) -> None:
+    """Seed the in-memory cache from persisted rows at startup."""
+    for status, notified in entries:
+        _CACHE[status.image] = status
+        if notified:
+            _NOTIFIED.add(status.image)
+
+
+def _store(status: UpdateStatus, notified: bool) -> None:
+    _CACHE[status.image] = status
+    if _persist_cb is not None:
+        try:
+            _persist_cb(status, notified)
+        except Exception as exc:  # noqa: BLE001 - persistence is best-effort
+            logger.debug("Could not persist update status for %s: %s", status.image, exc)
+
 
 # --------------------------------------------------------------------------- #
 # Image reference parsing
@@ -168,9 +212,11 @@ async def check_image(image: str) -> UpdateStatus:
         checked_at=time.time(),
         error=error,
     )
-    _CACHE[image] = status
     if update_available and image not in _NOTIFIED:
+        # Marked before the attempt, not after: a notifier that is down should
+        # not make every cycle re-announce the same update.
         _NOTIFIED.add(image)
+        _store(status, True)
         try:
             await notify_service.notify(
                 EVENT_UPDATE_AVAILABLE,
@@ -179,8 +225,10 @@ async def check_image(image: str) -> UpdateStatus:
             )
         except Exception as exc:  # noqa: BLE001 - notifications are best-effort
             logger.debug("update notify failed for %s: %s", image, exc)
-    elif not update_available:
-        _NOTIFIED.discard(image)
+    else:
+        if not update_available:
+            _NOTIFIED.discard(image)
+        _store(status, image in _NOTIFIED)
     return status
 
 
@@ -291,9 +339,22 @@ async def check_all() -> dict[str, dict]:
     images = _all_running_images()
     for image in images:
         await check_image(image)
+    _forget_unused(set(images))
     return {k: v.to_dict() for k, v in _CACHE.items()}
 
 
+def _forget_unused(keep: set) -> None:
+    """Drop images no running container references any more."""
+    for image in [i for i in _CACHE if i not in keep]:
+        del _CACHE[image]
+        _NOTIFIED.discard(image)
+    if _prune_cb is not None:
+        try:
+            _prune_cb(keep)
+        except Exception as exc:  # noqa: BLE001 - housekeeping is best-effort
+            logger.debug("Could not prune persisted update statuses: %s", exc)
+
+
 def get_cache() -> dict[str, dict]:
     return {k: v.to_dict() for k, v in _CACHE.items()}