[BUG] Disabled state file is still executable using salt-ssh

Description

For deployments to productive environments there is a need to avoid applying concurrent salt states to the same minion at a time. Disabling a critical salt state seems to be solution to that problem.

Following the documentation here a state file is disabled on a minion, but is still executable in that minion.

Setup

Please be as specific as possible and give set-up details.

• on-prem machine
• VM (Virtualbox, KVM, etc. please specify)
• VM running on a cloud service, please be explicit and add details
• container (Kubernetes, Docker, containerd, etc. please specify)
• or a combination, please be explicit
• jails if it is FreeBSD

The salt master host uses salt-ssh to apply states on the remote minions.
There are no current issues in our daily work using salt for remote management.

Steps to Reproduce the behavior

A state file with a dummy operation (for testing) is:

salt-ssh laphkroeber state.sls tmp.run_once
laphkroeber:
----------
          ID: deploy_file
    Function: file.managed
        Name: /home/hkroeber/tmp/test_deploy
      Result: True
     Comment: File /home/hkroeber/tmp/test_deploy exists with proper permissions. No changes made.
     Started: 14:21:22.379130
    Duration: 3.329 ms
     Changes:   

Summary for laphkroeber
------------
Succeeded: 1
Failed:    0
------------
Total states run:     1
Total run time:   3.329 ms

It is disabled using:

$ salt-ssh laphkroeber state.disable tmp.run_once
laphkroeber:
    ----------
    msg:
        Info: tmp.run_once state already disabled.
    res:
        True

List disabled states shows doesn't show the disabled state immediately. It takes multiple calls of the following command ti see that result (10 times in ~2 minutes).

salt-ssh laphkroeber state.list_disabled
laphkroeber:
    - tmp.run_once

The disable state file is still executable on that minion.

$ salt-ssh laphkroeber state.sls tmp.run_once
laphkroeber:
----------
          ID: deploy_file
    Function: file.managed
        Name: /home/hkroeber/tmp/test_deploy
      Result: True
     Comment: File /home/hkroeber/tmp/test_deploy exists with proper permissions. No changes made.
     Started: 14:47:54.442692
    Duration: 3.8 ms
     Changes:   

Summary for laphkroeber
------------
Succeeded: 1
Failed:    0
------------
Total states run:     1
Total run time:   3.800 ms

Expected behavior

• Disabled states must be listed using state.list_disabled immediately after disabling.
• As stated in the documentation a disabled state file / state must not be executable on the addressed minions.

Screenshots

Additional context

Content of the 'grains' file in the salt tmp - directory on the minion.

state_runs_disabled:
- tmp.run_once

Start with the salt-ssh entry points for state.disable, state.list_disabled, and state.sls, using the reproduction commands and the minion's state_runs_disabled grains data. Done means disabled states appear immediately in state.list_disabled and cannot be executed through state.sls, as described in the expected behavior.