Fixed
Gluetun-style dependents are now recreated after the VPN container updates, not just restarted (#8, @famewolf).
The restart_dependents cascade ran docker restart on each sidecar — but a container updated by Docksentry is recreated (new container ID), and a sidecar with network_mode: container:<head> can't rejoin by restart: it still references the head's dead old ID, the restart fails with No such container, and the sidecar is left stopped.
The cascade now recreates netns-sharing dependents against the head's current name (reusing the v1.26.3 netns-by-name resolution — same image, no pull, with backup + rollback); non-netns group members are still just restarted.
Two gaps closed: (1) the cascade actually works after a head recreate now, and (2) it now also runs in the manual "Update all" path — previously only the scheduled auto-update path triggered it, so updating manually (with only the head having an update) left the sidecars broken. Dependents already in the same batch are skipped (they self-heal). End-to-end tested.