Why an ICP canister stays in the stopping state
A controller preparing maintenance can observe a third state between running and stopped. Its duration depends on work already in flight.
Follow the outstanding request
Suppose a settlement canister is waiting for the ledger when the controller calls stop_canister. Record the ledger operation identifier and read canister_status. While the state is stopping, callbacks for existing calls can still execute. Give the callback a chance to record the outcome before inspecting balances for the maintenance report.
running → stop_canister → stopping → outstanding calls finish → stopped
Choose a maintenance boundary
Wait for stopped before treating application state as quiescent. An elapsed deployment timeout describes the controller's wait and says little about the ledger result. If maintenance is cancelled, use start_canister and reconcile the original transaction before accepting a replacement payment.