v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

Image retention: after a done/undone guarded Update and at remove, an app's images older than its running
and previous one are deleted — never an image any container, installed compose or installed/previous record
names (box-wide keep set read at delete time); exact id, never forced or pruned; paused while any update runs;
a one-time sweep of catalog app images at the first start. Install hold: an after_install app is installed
behind the setup gate's door and opens when after_install succeeds or the household says it changed the login.
Tests TestImageRetention_* and TestInstallHold_* with red-proofs; parity fixture for the held card.

MinAgent: 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,17 +1,10 @@
-# REPORT — 2026-09-30: v0.283.0 + v0.283.1
+# REPORT — v0.284.0 (2026-09-30 late evening)
 
-Full session report: `felhom.eu/REPORT-fixes-first-tester-2026-09-30.md`. Evidence:
-`felhom.eu/documentation/audits/evidence-fixes-first-tester-2026-09-30/`.
-
-- **v0.283.0 — decision 50 (R-720):** a fresh install joins the off-site copy when the customer has off-site; one
-  press for older apps on both backup pages; the size card over the quota. Measured first: over the quota nothing
-  but the ruled retention runs — pinned by `TestDecision50_OverQuotaDeletesNothingExtra`.
-- **R-721:** a Stop pressed while a machine has the app down holds — quiesce resume, volume dump, update leg (v0.283.0),
-  the dump's PRODUCTION adapter and the startup crash recovery (v0.283.1, after the live test on 9202 caught v0.283.0
-  restarting the app 8 s after the Stop).
-- **R-724 / R-725 (box half):** real schedule and local times on Beállítások and the dashboard; „az előző N órája
-  készült"; the restore-test card names its tier; the recovery wizard speaks „te" (formal ceiling 18 → 17).
-- Red-proofs RP31–RP38, RP43, RP44. Parity: two new cases (`backups_remote_offsite_offer_fit`,
-  `backups_apps_offsite_offer`); four fixtures re-captured, diff = the intended lines only.
-- Live: 9202 (press, fresh app ON, Stop during the dump holds on 0.283.1); both demo boxes on 0.283.1 by the floor.
-- MinAgent 0.131.0 (unchanged). No golden this session (see STATUS: the operator's choice before Tester-2's install).
+- **Image retention (`09` §3 decision 53, R-736):** after a done/undone guarded Update and at remove, an app's older
+  images are deleted; the box-wide keep set (containers, installed composes, installed/previous records) is read at
+  delete time; exact id, never forced/pruned; paused while any update runs; a one-time sweep 3 min after start.
+- **Install hold (R-741):** an `after_install` app is held behind the setup gate's door from its first start until the
+  known login is replaced (after_install, or the household's "I changed it").
+- Tests: `TestImageRetention_*` (6), `TestInstallHold_*` (6), parity fixture `app_info_install_hold`; red-proofs in
+  `felhom.eu/documentation/audits/night-rulings-2026-09-30/{B,C}/`. Green gate: build, vet, test ./... rc=0.
+- Evidence and the live proofs: `felhom.eu/documentation/audits/night-rulings-2026-09-30/`.