The Docker table offered a live Update button for containers whose update
the server had already refused, most often because the host's agent was
installed without command access. The click then failed with "command
agent is not connected", so on such hosts the feature never worked and
never said why.
The server's refusal arrives only over REST. Opening the Docker page from
another platform page seeded its cache from the websocket-fed
all-resources cache, which read as fresh, and websocket ticks kept it
fresh, so the page never fetched REST and never learned of the refusal.
Each cache entry now records when it last received a REST snapshot, and a
prefer-ws-then-rest route revalidates at mount when that snapshot is
missing or stale. The table also builds each row's update action
reactively, so readiness that arrives after mount reaches the row.
The update control now requires the server to advertise the update
capability, so a host with stale inventory no longer offers it either.
The locked pill reads "Update" to fit the column and explains the cause:
for an agent without command access it names the host and the install
option that grants it.
Locally built images have no RepoDigest, so no registry holds them. The
agent asked Docker Hub anyway and reported its 401 as "Check failed" on
every cycle. It now reports a "local image" state without a registry
request, shown as Local beside Pinned.
Contract-Neutral: performance-and-scalability gains one mock fixture state with no hot-path change; storage-recovery routes keep REST-first hydration, which this change does not alter.
rcourtman
6517a9d891