[Sim Theme B] Launch menu & simulator lifecycle

[jmservera]

Implements Theme B of the Simulation & Visualization PRD (FR-B1..B8). Lane 1 (foundation) — depends on Theme A (registry + GET /simulators). Adds launch/stop endpoints, concurrent + reload-persistent lifecycle, allowlisted start/stop, configurable autostart. Plan: docs/plans/sim-theme-b-launch-menu.md. Draft.

[jmservera]

🤖 Automated PR review

Launch menu & lifecycle — POST /simulators/{id}/launch|stop, per-sim autostart reconcile, and the interactive menu with polling + namespaced sim:<id> Golden Layout panels that survive pop-out/reload. Base: #26.

Findings

Severity	Location	Finding
🟡 Medium	services/control/server.js (reconcileAutostart)	Runs on every control-plane boot and stops any running autostart:false sim. A control-plane restart (crash / restart: unless-stopped) therefore silently kills a simulator the user launched manually from the menu. Consider a one-shot-at-stack-start guard or a "user-touched" marker so reconcile doesn't revert manual launches.
🟢 Low	services/control/server.js	reconcileAutostart fires once after a fixed UBEROS_AUTOSTART_DELAY_MS (3s); a slow host that hasn't finished creating containers misses reconciliation. A short bounded retry would be more robust.

✅ Security hardening is exemplary: launch/stop uses a registry-derived allowlist distinct from the restart allowlist, the id is charset-constrained by regex and validated against the registry, and only start/stop-by-container-id are issued — no exec/create/shell. Idempotent 204/304 handling, clean polling teardown in onDestroy.

Recommendation: Approve; consider the reconcile-on-restart behavior before merge.

[jmservera]

🤖 Automated line-anchored review — see the summary comment for the full findings table.

[jmservera]

🟡 Medium — reconcile-on-every-boot reverts manual launches. reconcileAutostart() runs on every control-plane boot and stops any running autostart:false sim. A control-plane restart (crash / restart: unless-stopped) therefore silently kills a simulator the user launched manually from the menu. Consider a one-shot-at-stack-start guard or a "user-touched" marker so reconcile doesn't undo manual launches. Separately (🟢 Low): the single fixed UBEROS_AUTOSTART_DELAY_MS timer can miss slow container creation — a short bounded retry would be more robust. The launch/stop allowlist hardening in this file is otherwise exemplary.