@@ -100,7 +100,7 @@ github.com/docker/containerd aa8187dbd3b7ad67d8e5e3a15115d3eef43a7ed1

 github.com/tonistiigi/fifo 1405643975692217d6720f8b54aeee1bf2cd5cf4

 # cluster

-github.com/docker/swarmkit 0af40501a9cc98cd3e9425d2e4246dd3eff5526e

+github.com/docker/swarmkit 1c7f003d75f091d5f7051ed982594420e4515f77

 github.com/golang/mock bd3c8e81be01eef76d4b503f5e687d2d1354d2d9

 github.com/gogo/protobuf v0.3

 github.com/cloudflare/cfssl 7fb22c8cba7ecaf98e4082d22d65800cf45e042a

@@ -104,17 +104,21 @@ func Resolve(ctx context.Context, task *api.Task, executor Executor) (Controller

 	// depending on the tasks state, a failed controller resolution has varying

 	// impact. The following expresses that impact.

-	if task.Status.State < api.TaskStateStarting {

-		if err != nil {

-			// before the task has been started, we consider it a rejection.

-			status.Message = "resolving controller failed"

-			status.Err = err.Error()

+	if err != nil {

+		status.Message = "resolving controller failed"

+		status.Err = err.Error()

+		// before the task has been started, we consider it a rejection.

+		// if task is running, consider the task has failed

+		// otherwise keep the existing state

+		if task.Status.State < api.TaskStateStarting {

 			status.State = api.TaskStateRejected

-		} else if task.Status.State < api.TaskStateAccepted {

-			// we always want to proceed to accepted when we resolve the contoller

-			status.Message = "accepted"

-			status.State = api.TaskStateAccepted

+		} else if task.Status.State <= api.TaskStateRunning {

+			status.State = api.TaskStateFailed

 		}

+	} else if task.Status.State < api.TaskStateAccepted {

+		// we always want to proceed to accepted when we resolve the controller

+		status.Message = "accepted"

+		status.State = api.TaskStateAccepted

 	}

 	return ctlr, status, err