[Tom Longhurst (thomhurst)]

When the final managed network disconnects, the container controller reports statusChanged but its state initializers only assign Status.Networks for nonempty results. The old network remains in status, so each reconciliation detects the same disconnect, inspects the container again, and writes status again.

Assign the network result when network status actually changed, including an empty result. Apply the correction to the running/paused, exited, and failed-start callers. Lookup failures still preserve the last known network status and request another reconciliation.

Regression coverage checks all four states: one old network becomes empty, the first pass reports a status update, and the next pass reports no change. It also checks lookup failures and exercises last-network removal and container stop through the standard integration API server.

Validation:

• The new controller regression fails on the original code in all four disconnect cases and passes with the fix.
• Windows controller and integration suites pass in the full Windows test driver. The full run has one unrelated existing failure in TestValidateRestrictedDirectoryAllowsInheritedReadOnlyAccess, reproduced separately with unchanged filesystem code.
• Linux controller suite passes in a Go 1.27.1 container.
• golangci-lint passes on Windows, Darwin, and Linux.
• Real Docker Redis stop controls report exit code 0 and empty network status. Each control logs one disconnect update; 20 consecutive post-exit API reads retain one resource version. A separate Windows resource-log handle issue still reports session-folder cleanup failure after graceful shutdown.

The same defect affects DCP 0.26.6. The release/0.26 backport for paired consumers is #324.