destroy vm should always succeed, so it maybe other problem, can you provide the problem details what you meet?

The stopped event should be added in Destroying's state because it is possible that the status of the VM changed from destroying to stopped in the error function of the FlowChain.

Sorry to reply late. In this condition，ZStack will checkState on host, then vm state will out of Destroying unless management restart( you can destroy it again to escape destroying state after management node started).

otherwise I mean APIDestroyVm should always succeed, destroyVmOnHypervisor is possible to fail

So it's not root cause，you can fix that syncVm cannot sync vm state from Destroying to Destroyed. The problem is in KvmVmSyncPingTask.java, thx a lot.

Thank you very much, I'm using an old version, after switching to the new version I found this in the method checkState in VmInstanceBase.java.

else if (VmInstanceState.Stopped.toString().equals(state) && self.getState().equals(VmInstanceState.Destroying)) {
    changeVmStateInDb(VmInstanceStateEvent.destroyed);
} ```