v0.300.0: R-645, R-856 (MinAgent 0.131.0)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,10 @@
+## v0.300.0 — the night backup leaves an app alone that runs another version than it saved; after a crash boot app mails wait 15 minutes (R-645, R-856; operator rulings `09` §3 142, 143) (2026-10-06)
+
+**MinAgent: 0.131.0** (unchanged — R-856 reads the agent's `GET /host/crash-guard` (agent 0.149.0); an older agent answers 404 and the controller keeps the normal 90 s grace).
+
+- R-645 (09 decision 142): the night backup skips an app whose pinned version is not the version it runs — DB dump, volume dump, recovery-unit capture and Tier-2 all leave it alone, the log says so per leg, and the backups page shows one amber line (hu + en). A hold lifted by hand no longer lets the just-failed definition overwrite the good recovery unit. Unknown (no pin / no running record) never skips. Manual 'back up now' and the update's own pre-update copy are unchanged. Strings (hu + en): `backup.status.version_skip (hu: 'A(z) %s nem a beállított ve`.
+- R-856 (09 decision 143, extends 129): after a crash boot of the host, the controller's app mails (app_start_failed, app_stopped_unhealthy) wait about 15 minutes instead of 90 s; a normal boot keeps 90 s. The fact comes from the host crash guard through the agent's new GET /host/crash-guard; without it (older agent, no guard) every boot keeps 90 s. MinAgent: unchanged (degrades to today's behaviour on an older agent); the effect needs the agent release that adds the route.
+
 ## v0.299.0 — the real disk percentage (df's), every household mail in its language, no formal form left in the bundle, the hold panel points at the kept log (R-889, R-585, R-621, R-516) (2026-10-06)
 
 **MinAgent: 0.131.0** (unchanged). **Behaviour change, by operator ruling (`09` §3 decision 138):** every disk percent the