With #5558, commit-confirm with action reload starts its timer from the 01vyos-commit-revision post-commit hook, after the change is applied. The commit and its hooks run in the operator's CLI session, so if that session ends in between (ssh client closed, Ctrl-C), the hook does not run: the change stays and no timer is started. Before #5558 the timer was started before the commit and the change was reverted.

The window is short by default, but 00vyos-sync runs before 01vyos-commit-revision. With service config-sync pointing at an unreachable secondary, each commit spends about 60 s there (secondary timeout, default 60 s, up to 3600 s).

Steps:

1. set system config-management commit-confirm action reload; commit.
2. Point service config-sync at an unreachable secondary (or add a post-commit hook that sleeps 60 s before 01vyos-commit-revision).
3. Over ssh: set system host-name test-cc, commit-confirm 1.
4. While the commit is waiting, close the ssh client.
5. After 1 minute: host-name is still test-cc, commit-confirm.timer was not started.