v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

Five red-proofs. MinAgent 0.131.0 unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/deploy.go

@@ -397,6 +397,16 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 	}
 	m.mu.Unlock()
 
+	// R-681: the install's own journal — removed when it ends either way; found at start = interrupted.
+	if err := markInstallPending(stackDir); err != nil {
+		m.logger.Printf("[WARN] [stacks] Stack %s: cannot write the install marker (%v) — a restart mid-install would go unreported", req.StackName, err)
+	}
+	m.mu.Lock()
+	if s, ok := m.stacks[req.StackName]; ok {
+		s.InstallInterrupted = false
+	}
+	m.mu.Unlock()
+
 	// Run docker compose up -d asynchronously
 	go m.runComposeDeploy(req.StackName, stackDir, env, appCfg)
 
@@ -453,6 +463,7 @@ func (m *Manager) runComposeDeploy(name, stackDir string, env map[string]string,
 		// The app.yaml is deliberately NOT deleted here: it is the crash-safe record written with
 		// Deployed:false, it carries the settings the customer typed, and a redeploy reuses them. The
 		// state the surfaces read is `not_deployed`, which is the fact that matters.
+		clearInstallPending(stackDir) // R-681: the install ended (badly) and said so
 		if m.deployDoneHook != nil {
 			m.deployDoneHook(name, false, composeErr.Error())
 		}
@@ -477,9 +488,12 @@ func (m *Manager) runComposeDeploy(name, stackDir string, env map[string]string,
 			s.AppConfig = nil
 		}
 		m.mu.Unlock()
+		clearInstallPending(stackDir)
 		return
 	}
 
+	clearInstallPending(stackDir) // R-681: the durable record says deployed — the install is over
+
 	// Clear deploying flag
 	m.mu.Lock()
 	if s, ok := m.stacks[name]; ok {