v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

Image retention: after a done/undone guarded Update and at remove, an app's images older than its running
and previous one are deleted — never an image any container, installed compose or installed/previous record
names (box-wide keep set read at delete time); exact id, never forced or pruned; paused while any update runs;
a one-time sweep of catalog app images at the first start. Install hold: an after_install app is installed
behind the setup gate's door and opens when after_install succeeds or the household says it changed the login.
Tests TestImageRetention_* and TestInstallHold_* with red-proofs; parity fixture for the held card.

MinAgent: 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,33 @@
+## v0.284.0 — a box deletes old app images (decision 53); an after_install app is held until its known login is replaced (R-741) (2026-09-30)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `app_info.install_hold_title`,
+`app_info.install_hold_closed` (hu + en).
+
+- **Image retention — `09` §3 decision 53 (R-736).** A remove ran `compose down --rmi local`, which never removes a
+  registry-pulled image; an update left the old version's image; nothing else deleted any (9202: 84 images, 53 GB
+  used by no container, an install refused). Now (`stacks/image_retention.go`): when a guarded Update ends `done`,
+  `previous_images` records what the app ran before; the app's images older than the running one and that previous one
+  are deleted. At `undone` the attempt's image goes. At remove the app's images go. **Never** an image any container
+  (running or stopped) uses, any installed app's live compose names, or any installed app's installed/previous record
+  names — a box-wide keep set read at delete time; deletion by exact image id, never forced, never `prune`; an id
+  with several repositories' names is left alone; a keep set that cannot be read deletes nothing; **no pass runs while
+  any update runs** (its undo's image is named by nothing then). One line per deletion (names, id, size). A one-time
+  sweep at the first start after this release (3 min after start, a marker file) applies the rule to every image the
+  catalog names, so the images of apps removed before this release go too; never the controller's or infrastructure's.
+  Tests `TestImageRetention_*` (6); red-proofs: the undo's image, a stopped app's compose, the update-in-flight pause,
+  the unreadable keep set, the shared engine image.
+- **The install hold — R-741 (decision 45).** Measured 2026-09-30: calibre-web answered its public default login
+  through traefik for 1–18 s after a fresh install, before `after_install` replaced it. Now an `after_install:` app is
+  installed HELD (`stacks/install_hold.go`): before its first start a traefik file puts the setup gate's forwardAuth
+  door in front of every router it publishes, at a priority above the gate and the sign-up block. A stranger is refused;
+  the household (dashboard session) passes, so a failed `after_install` leaves it able to change the login by hand and
+  press "I changed it", which opens the hold. `after_install` succeeding opens it (record, then file). The gate loop
+  reconciles: stale files go, a record that says the login was replaced opens, an install whose hook a restart cut off
+  re-runs `after_install` once (only installs older than the process). The app page shows a card while held.
+  Tests `TestInstallHold_*` (6); red-proofs RP-IH1..4 (the file before the first start, the open on success, the
+  household's word, the re-run only after a restart). Found while testing: `DeployedAt` has whole seconds, so the
+  comparison uses the process start truncated to the second.
+
 ## v0.283.1 — a Stop holds during the nightly volume dump IN PRODUCTION, and at the crash recovery (R-721) (2026-09-30)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings.