* feat(resources): bind prune to fingerprinted itemized plans
* fix(resources): repair prune plan volume usage and preview list
Source volume RefCount from docker df, keep preview rows from flex-shrinking, tighten managed image attribution and becomesFree, and stop audit summaries from claiming success on rejected prunes.
* fix(monitor): decouple janitor disk-usage check from 30s cycle (F-6)
`docker system df` (called by the MonitorService janitor check) can take
30+ seconds on Docker Desktop with many volumes. Running it on the 30s
evaluate cycle compounded with the per-container stats fan-out and pushed
the cycle to 140s+, blocking subsequent monitoring work.
This change:
- Moves the janitor disk-usage check into its own 15-minute cycle with
a tight 8s timeout. A circuit breaker opens after 3 consecutive
timeouts (60-minute cooldown) so a sick daemon stops pinning Dockerode
sockets every tick. The first janitor tick is deferred 45 seconds past
boot to avoid head-of-line collision with the initial monitor cycle's
stats fan-out.
- Adds a paired 8s `withTimeout` wrap to the admin prune-estimate routes
(`/api/system/prune/estimate` and the dry-run path of
`/api/system/prune/system`) so a slow df does not hang the admin tab.
Both routes respond 503 with code `docker_df_slow` on timeout.
- Factors `withTimeout` and `TimeoutError` into `utils/withTimeout.ts`
so the route layer does not have to import from a service module.
- Adds 10 unit tests covering the decoupling guardrail, breaker
open/close, cooldown, threshold gate, the 100 MB reclaimable floor,
re-entrancy, recovery logging, non-timeout error handling, and the
full timer-cleanup contract of `stop()`.
- Adds 4 integration tests for the prune routes covering the 503
timeout response, the success path, and the non-timeout 5xx path.
* fix(fleet,monitor): extend F-6 timeout to fleet prune routes; close breaker-recovery log gap
Codex audit findings on PR #1164:
Major. The fleet routes that fan out prune-estimate work on local nodes
(`POST /api/fleet/labels/fleet-prune` dry-run path and
`POST /api/fleet/prune/estimate`) called `estimateSystemReclaim` without
a timeout, so a slow local Docker daemon could still hang the fleet
admin tab even though the system-maintenance routes were already
bounded. Wrap both call sites with the shared `withTimeout(..., 8s)`
and surface a "Docker daemon is busy" message via the per-target and
per-node error channels the routes already used for other failures.
The destructive (non-dry-run) prune path stays unwrapped because it
calls `pruneSystem` / `pruneManagedOnly`, not `df`.
Minor. The janitor circuit breaker zeroed `janitorConsecutiveTimeouts`
when it opened, so a successful call after a full breaker-open cooldown
slipped past the `if (counter > 0)` recovery-log branch and never
emitted `[Monitor] Janitor disk-usage check recovered`. The operator
observability signal was missing exactly when it mattered most.
Extend the predicate to also trip on `janitorBreakerUntil > 0` (which
stays set to its past timestamp after cooldown until the next success
clears it), so recovery logs symmetrically for both partial-failure
and post-breaker recovery paths. Added a dedicated test.
Three new integration tests cover the fleet routes (timeout, success,
and the estimate endpoint's per-node unreachable shape).
Anso