v0.269.1: an installed app keeps the image digest it runs until a guarded Update moves it

Found live on 9202 (night 2026-09-24 Part B): the sync rendered the ladder's newest
tested digest into a RUNNING app's compose, so the next restart would pull a new image
with no backup and no undo. stacks.CarryDigests keeps the running digest for an
installed app; a fresh install still takes the tested digest. Red-proofed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,21 @@
+## v0.269.1 — an installed app keeps the image it runs until an Update moves it (2026-09-24 night, Part B live finding)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (as v0.269.0). New strings: none.
+
+- **Found live on 9202 (Part B, `audits/night-2026-09-24/B/10-floating-tag.*`):** the catalog re-tested
+  `redis:7-alpine` at a new digest; v0.269.0's sync wrote that digest into the RUNNING app's compose before
+  anyone pressed Update. The next restart (a backup's stop/start, a power cut, a reboot) would have pulled the
+  new image with no backup and no undo — the guarded update bypassed.
+- **Fix:** `stacks.CarryDigests` — for an INSTALLED app the sync keeps the digest the app's current file names
+  for each service whose reference did not change, and adds none. A fresh install still takes the ladder's
+  tested digest; only a guarded update (`advancePinTo`) moves an installed app's digest. The badge is
+  unchanged: it still reads „Frissítés elérhető" for a newer tested digest.
+- Test: `TestDigest_SyncerKeepsTheRunningDigest` (an older digest kept; no digest stays none; the fix still
+  flows; the stored definition gets the same bytes). Red-proof: the pre-fix call site fails both cases
+  ("the sync MOVED the running digest").
+- One release per repo was the brief's rule; this is the second controller release tonight, because the first
+  would have shipped the bypass to the fleet with the floor. Decided by CC unattended — operator may reverse.
+
 ## v0.269.0 — the second drive brings a file app back whole; a crash loop is stopped; exact image fingerprints; each step judged by its own file (2026-09-24 night, `09` §3 decisions 26–28, R-661, R-666, R-667, R-668, R-664, R-665, R-662, §6.4 part 6)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 for `app_stopped_unhealthy` (older hubs answer 400 and the