v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

Five red-proofs. MinAgent 0.131.0 unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/update.go

@@ -416,6 +416,20 @@ func (m *Manager) UpdatePreflight(name string) *UpdateRefusal {
 			fmt.Sprintf("installed is provably NEWER than the catalog on every differing service (installed=%v catalog=%v)",
 				st.AppConfig.InstalledImages, st.CatalogImages))
 	}
+	// R-679 (v0.270.0) — AN APP ALREADY AT THE HEAD IS NOT UPDATED. MEASURED 2026-09-24 (night, Part C):
+	// navidrome at the catalog head was pressed four times; each press made a safety dump, pulled and
+	// restarted the app (8.5 s of downtime) and changed nothing. "Current" is CatalogOrder's own verdict:
+	// the installed images equal the catalog's AND no newer tested digest exists for a floating tag — so a
+	// re-tested digest still updates. Unknown / unorderable / behind fall through as before. Before this, a
+	// same-version Update was called "the repair path" in a test comment; Restart is the repair path now.
+	//
+	// COMPANION RED-PROOF (REPORT.md): drop this check → TestR679_CurrentAppIsRefused fails at "an app at
+	// the head was allowed to update".
+	if CatalogOrder(*st) == UpdateOrderCurrent {
+		return m.refuseUpdateErr(name, "already_current", util.MsgError("err.stacks.update_already_current"),
+			fmt.Sprintf("installed equals the catalog head on every service and no newer tested digest (installed=%v catalog=%v)",
+				st.AppConfig.InstalledImages, st.CatalogImages))
+	}
 	// R-475: any tier counts, and an app with no copy at all is backed up first by the job. So the only
 	// refusal left here is Scenario L — no copy on any tier AND no way to make one now. (With a copy
 	// but no way to back up, the job still applies the age rule and refuses then if the copy is stale.)