v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-05 07:13:02 +02:00
parent 69e914534f
commit 7861bf9dde
16 changed files with 607 additions and 36 deletions
@@ -1731,7 +1731,9 @@ func main() {
 			return
 		case <-time.After(3 * time.Minute):
 		}
-		stackMgr.RunImageRetentionOnce()
+		// R-863: retried every 2 minutes while an install/update/restore is pulling (a new household's first
+		// installs land exactly here), instead of deleting an image compose has pulled but not yet used.
+		go stackMgr.RunImageRetentionOnceUntilDone(ctx, 2*time.Minute, 30)
 		// decision 56 (R-745): the controller's own images — keep the running one and the one before it. At every
 		// start, 3 minutes in: a swap has ended by then (the agent's verify window is 90 s), so the image the agent
 		// would roll back to is the running one, and the one before it is in the swap record read here.