v0.284.1 — the image clean-up runs on the household's Remove button too; one summary line per pass (decision 53, R-736)

Found live on 9202: v0.284.0 wired the remove half into DeleteStack only; the app page's Remove runs RemoveStack.
Now RemoveStack reads the app's image repositories before its compose down and runs the retention after. Every
retention pass logs one line (images seen, candidates, deleted), so a pass that kept everything is visible.
Tests TestImageRetention_TheRemoveButtonRunsIt / ADoneUpdateRunsItWithThePrevious, red-proofed. v0.284.0 was never
floored (scratch 9202 only).

MinAgent: 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,18 @@
+## v0.284.1 — the image clean-up also runs on the household's Remove button; one summary line per pass (2026-09-30)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings. **v0.284.0 was never floored** — it
+ran only on scratch guest 9202, where this was found; the fleet goes from 0.283.1 to 0.284.1.
+
+- **Found live on 9202:** v0.284.0 wired the remove half of decision 53 into `DeleteStack` only; the app page's Remove
+  (`POST /api/stacks/<n>/remove`) runs `RemoveStack`, so a removed app's images stayed (the "seam built but never wired"
+  class, a fifth instance). Now `RemoveStack` reads the app's image repositories before its `compose down` and runs the
+  retention after (seam `retainAfterRemoveFn`). Its old comment "keep images for potential redeploy" is superseded by
+  decision 53 (a redeploy pulls).
+- **One INFO line per retention pass, whatever it did** (`pass over N image(s) of [repos] — C candidate(s), D deleted`):
+  v0.284.0 logged deletions only, so a pass that ran and kept everything was indistinguishable from one that never ran.
+- Tests `TestImageRetention_TheRemoveButtonRunsIt`, `TestImageRetention_ADoneUpdateRunsItWithThePrevious`; red-proofs
+  (the call removed → each fails).
+
 ## v0.284.0 — a box deletes old app images (decision 53); an after_install app is held until its known login is replaced (R-741) (2026-09-30)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `app_info.install_hold_title`,