🐛 Fix container stop issue

compose.yaml

@@ -50,8 +50,18 @@ services:
     build:
       context: ./mosquitto
     restart: unless-stopped
-    # Spec §29: no docker.sock. Control sidecar shares the broker's PID namespace
-    # and the mosquitto_config volume; it signals PID 1 (the broker) directly.
+    # Spec §29: no docker.sock. INVERTED PID ownership: the broker joins
+    # the CONTROL SIDECAR's PID namespace, not the other way around.
+    # The sidecar is the namespace init and survives broker restarts
+    # (previously the sidecar joined the broker's namespace and was
+    # kernel-killed whenever the broker exited — with a race on its
+    # own restart because it could not re-join a still-down broker).
+    # The broker is therefore NOT PID 1: control.py discovers its PID
+    # via /proc instead of hardcoding PID 1.
+    pid: "service:mosquitto-control"
+    depends_on:
+      mosquitto-control:
+        condition: service_started
     environment:
       # Used by the dynsec plugin on first start to seed the 'admin' client
       # (verified: Mosquitto 2.1 dynamic security docs).
@@ -87,12 +97,14 @@ services:
     build:
       context: ./broker-control
     restart: unless-stopped
-    depends_on:
-      mosquitto:
-        condition: service_started
-    # Shares PID namespace with the broker so `mosquitto_signal -p 1 ...`
-    # reaches the broker process without mounting docker.sock.
-    pid: "service:mosquitto"
+    # PID-namespace OWNER: the broker joins us via its `pid:` directive.
+    # Owning the namespace means a broker restart (SIGTERM to the broker
+    # process) only kills the broker — this sidecar keeps running to
+    # report status and orchestrate the revival. Runs tini as PID 1
+    # (signal forwarding + zombie reaping). If THIS container dies, the
+    # kernel tears down the namespace and kills the broker too — the
+    # sidecar is deliberately minimal so that path should never trigger.
+    # No depends_on: the broker depends on us (inverted), not vice versa.
     environment:
       # Minimal default token for the internal control API; in production
       # this MUST be replaced (it only guards a backend-net-only endpoint).