---
# Intentional, narrowly scoped Compose reconciliation. This never changes
# compose files, images, secrets, DNS, or databases. It is gated because a
# container recreate can briefly interrupt a public service.
- name: Reconcile explicitly selected Docker Compose services
  hosts: docker_hosts
  become: true
  gather_facts: false
  serial: 1
  roles:
    - role: compose_reconcile
      tags: [compose, reconcile, mutating]