userTransfer: rootless Docker data-root is copied live and Docker is never started on the target (stop on source before the final sync, start on target after)

[MagnaCapax]

Problem

userTransfer.php copies a user's rootless Docker data-root (~/.local/share/docker) in its final "volatile" sync while the user's containers may still be running on the source. It also does nothing to start the user's rootless Docker on the target afterwards.

Observed in a production migration, verified by size and file counts only:

• After a complete transfer (31 passes plus the final volatile sync), the data-root on the target was about 2.4 GB and about 29k files short of the source. Every bit of the gap was inside the Docker store. Containers kept running on the source (a live data-root) and changed it after the final sync.
• After the transfer the user's rootless Docker was not running on the target (util/userDocker.php USER status reported it not running). So the account's container apps were only up on the source that was about to be retired.

A consistent move needed three manual steps: util/userDocker.php USER stop on the source, re-running the final sync, and util/userDocker.php USER start on the target. With the source quiesced, the data-root matched apart from containerd runtime state (a few hundred small files the daemon recreates) and per-container metadata.

Expected

For an account with rootless Docker, userTransfer stops the user's Docker on the source before the final volatile sync, and starts it on the target after post-setup. It logs how many containers ran before and after, by state only.

Notes

• Mechanism, from source: pmssUserTransferBuildRsyncMain() excludes .local, and pmssUserTransferBuildRsyncFinal() syncs .local in the volatile pass (scripts/lib/userTransfer/remoteScripts.php). The source is not locked during the move.
• Separate but related: container-owned file ownership when subordinate ID ranges differ between the hosts is userTransfer: rootless Docker ownership breaks when source/target subuid ranges differ (data-root keeps foreign sub-IDs, bind mounts get flattened) #961.

(A live store copies like a moving train.)

---

_{Tier-3 declared at filing: --why multi-file — GH#631 tier gate. Declared fix size: 40 lines vs 21-line body — size gate (operator directive 2026-07-29). Owner: scripts/lib/userTransfer/remoteScripts.php in MagnaCapax/PMSS — owner gate.}

[MagnaCapax]

Commit c9b6e80: stopped the source account's running rootless Docker containers before one additional volatile pass, then started the recorded set on the target after post-setup. A failed additional pass attempts to restart the set on the source. Added bounded ID validation, readiness polling, tests, and ADR 0072.

Validation: PHP lint and the compatibility lint passed. Development suite: 3198 tests, 2 failures, 18 skipped; the failures are in unrelated update-compression and WireGuard characterization tests.