fix(recovery): ignore stale docker cpu attribution

scripts/ops/tests/test_host_runaway_process_exporter.py

@@ -425,6 +425,60 @@ def test_sustained_load_controller_routes_gitea_backlog_from_docker_metrics(tmp_
     assert "host-sustained-load-evidence.py" in payload["commands"]["dry_run"]
 
 
+def test_sustained_load_controller_ignores_stale_docker_stats_attribution(tmp_path: Path) -> None:
+    metrics_file = tmp_path / "host.prom"
+    metrics_file.write_text(
+        "\n".join(
+            [
+                'awoooi_host_runaway_process_monitor_up{host="110",mode="read_only"} 1',
+                'awoooi_host_load5_per_core{host="110"} 2.5',
+                'awoooi_host_swap_used_ratio{host="110"} 0.1',
+                'awoooi_host_runaway_process_remediation_authorized{host="110"} 0',
+                'awoooi_host_gitea_actions_active_container_count{host="110"} 0',
+                'awoooi_host_gitea_actions_active_process_group_count{host="110"} 0',
+                'awoooi_host_runaway_browser_orphan_group_count{host="110",rule="stockplatform_headless_smoke",min_age_seconds="1800",min_cpu_percent="50"} 0',
+                'node_textfile_mtime_seconds{file="/host/home/wooo/node_exporter_textfiles/docker_stats.prom"} 1000',
+                'node_time_seconds 5000',
+            ]
+        ),
+        encoding="utf-8",
+    )
+    docker_file = tmp_path / "docker.prom"
+    docker_file.write_text(
+        "\n".join(
+            [
+                'docker_container_cpu_cores{host="110",container_name="gitea"} 3.4',
+                'docker_container_cpu_cores{host="110",container_name="redis"} 0.2',
+            ]
+        ),
+        encoding="utf-8",
+    )
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            str(CONTROLLER_PATH),
+            "--host",
+            "110",
+            "--metrics-file",
+            str(metrics_file),
+            "--docker-stats-file",
+            str(docker_file),
+            "--json",
+        ],
+        capture_output=True,
+        text=True,
+    )
+
+    assert result.returncode == 75
+    payload = json.loads(result.stdout)
+    assert payload["classification"] == "blocked_unknown_sustained_load_requires_source_specific_playbook"
+    assert payload["readback"]["docker_stats"]["fresh"] is False
+    assert payload["readback"]["top_container_cpu"] is None
+    assert payload["readback"]["top_container_cpu_untrusted"]["container_name"] == "gitea"
+    assert payload["controlled_apply_allowed"] is False
+
+
 def test_sustained_load_controller_routes_unknown_load_to_sanitized_evidence(tmp_path: Path) -> None:
     metrics_file = tmp_path / "host.prom"
     metrics_file.write_text(
@@ -506,6 +560,55 @@ def test_sustained_load_evidence_emits_sanitized_gitea_recommendation(tmp_path:
     assert "/home/wooo" not in result.stdout
 
 
+def test_sustained_load_evidence_keeps_stale_container_samples_untrusted(tmp_path: Path) -> None:
+    metrics_file = tmp_path / "host.prom"
+    metrics_file.write_text(
+        "\n".join(
+            [
+                'node_textfile_mtime_seconds{file="/host/home/wooo/node_exporter_textfiles/docker_stats.prom"} 1000',
+                'node_time_seconds 5000',
+            ]
+        ),
+        encoding="utf-8",
+    )
+    docker_file = tmp_path / "docker.prom"
+    docker_file.write_text(
+        'docker_container_cpu_cores{host="110",container_name="gitea"} 3.4\n',
+        encoding="utf-8",
+    )
+    ps_file = tmp_path / "ps.txt"
+    ps_file.write_text(
+        "100 1 100 120 5.0 1.0 python python monitor.py\n",
+        encoding="utf-8",
+    )
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            str(EVIDENCE_PATH),
+            "--host",
+            "110",
+            "--metrics-file",
+            str(metrics_file),
+            "--ps-file",
+            str(ps_file),
+            "--docker-stats-file",
+            str(docker_file),
+            "--json",
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+
+    payload = json.loads(result.stdout)
+    assert payload["recommendation"] != "gitea_queue_or_hook_backlog_playbook"
+    assert payload["readback"]["docker_stats"]["fresh"] is False
+    assert payload["top_containers"] == []
+    assert payload["top_containers_untrusted"][0]["container_name"] == "gitea"
+    assert payload["operation_boundaries"]["host_write_performed"] is False
+
+
 def test_sustained_load_controller_routes_unknown_load_to_sanitized_evidence(tmp_path: Path) -> None:
     metrics_file = tmp_path / "host.prom"
     metrics_file.write_text(