perf: streamline repository and deployment awareness

tests/unraid-deployment.test.mjs

@@ -317,6 +317,7 @@ test("low-level inventory scan is read-only and user discovery auto-links exact
   assert.equal(profiles[0].containerName, "Portfolio");
   assert.equal(profiles[0].adoptedFromServer, true);
   assert.equal(states.get(profiles[0].id).matchesGitea, true);
+  assert.deepEqual(discovery.refreshedProfileIds, [profiles[0].id]);
 });
 
 
@@ -385,6 +386,18 @@ test("server inventory includes stopped DockerMan containers without Git and kee
   assert.match(workloads[0].candidates[0].reasons.join(" "), /manual confirmation/i);
 });
 
+test("server inventory batches Docker inspect and retains a disappearing-container fallback", async () => {
+  const source = await unraidSource();
+  assert.match(source, /docker inspect "\\\$\{container_ids\[@\]\}"/);
+  assert.match(source, /for container_id in "\\\$\{container_ids\[@\]\}"/);
+});
+
+test("server inventory avoids a second Compose process for static image definitions", async () => {
+  const source = await unraidSource();
+  assert.match(source, /has_override=false/);
+  assert.match(source, /\[ -z "\$images" \].*config --images/);
+});
+
 test("server inventory groups multi-service Compose projects and preserves their identity", () => {
   const baseContainer = {
     image: "example/app:latest",
@@ -477,6 +490,40 @@ test("manual workload linking does not claim Gitea parity for unrelated provenan
   assert.equal(savedState.giteaSha, null);
 });
 
+test("inventory provenance alone never claims Gitea commit parity", async () => {
+  let savedState = null;
+  const service = new UnraidDeploymentService({
+    store: { getDeploymentState: () => ({}), saveDeploymentState: async (_id, state) => { savedState = state; return state; } },
+  });
+  await service.saveWorkloadState(
+    { id: "profile", remoteFolder: "app", cloneUrl: "git@gitea.test:Owner/App.git" },
+    {
+      workloadId: "workload", observedAt: new Date().toISOString(),
+      metadata: { sourceRepository: "git@gitea.test:Owner/App.git", liveRevision: "a".repeat(40) },
+      runtime: { running: true, health: "healthy" }, containers: [{ name: "app", running: true, health: "healthy" }], compose: {},
+    },
+    { basePath: "/mnt/user/appdata" },
+  );
+  assert.equal(savedState.matchesGitea, false);
+  assert.equal(savedState.giteaSha, null);
+});
+
+test("a stopped workload cannot become healthy through a reused healthcheck port", async () => {
+  let savedState = null;
+  const service = new UnraidDeploymentService({
+    store: { getDeploymentState: () => ({}), saveDeploymentState: async (_id, state) => { savedState = state; return state; } },
+  });
+  await service.saveWorkloadState(
+    { id: "profile", remoteFolder: "app", healthcheckUrl: "http://server.test/health" },
+    { workloadId: "workload", metadata: {}, runtime: { running: false, health: "unverified" }, containers: [{ name: "app", running: false }], compose: {} },
+    { basePath: "/mnt/user/appdata" },
+    { health: { configured: true, healthy: true, status: 200 } },
+  );
+  assert.equal(savedState.containerRunning, false);
+  assert.equal(savedState.healthy, false);
+  assert.equal(savedState.runtimeVerification, "stopped");
+});
+
 test("Docker ignore checks identify exact runtime and Git context exclusions", () => {
   const rules = "# build context\n.git\ndata/\nlogs/**\n!logs/keep.txt\n";
   assert.equal(dockerIgnoreHasPath(rules, ".git"), true);