This time it seems like the remote side initiate a new IKE_SA without properly closing the old one. This tricked strongswan to keep both, but when the old one timed out. the vti-up-down script killed the VTI.

Just to add some context. This keeps on happening regularly, but for some reason more often on our trans-atlantic VPNs. Maybe once a week( it varies).

No plan on fixing on 1.4?

FYI: The configuration is valid and works. It just fails during boot.

Here is an example of a perferctly valid vyos vpn config that will never recover a child SA when resetting it.

In 1.4 and 1.5 command reset vpn ipsec has a termination meaning.

No, it says reset, both the command, and auto complete output. It does not say terminate or clear. If you run a reset you do expect it to restart or re-populate in one way or another, not just stop working completley.

Not sure if it is meaningful to create a new operational vyos command "initiate" or re-write the reset to be consistent with older VyOS.

I can confirm it is broken for

reset vpn ipsec-peer XXX

too when you run policy-based VPNs.
Peer reset log: