v0.260.0 — a box ahead of the catalog reads „Naprakész", and the pin never moves backwards (R-524)

MEASURED 2026-09-15 (BIGNIGHT Phase 6): privatebin updated 2.0.5 -> 2.0.6, catalog
reverted to 2.0.5, and the box read „Frissítés elérhető — ma" over an Update that
would have moved the pin BACKWARDS onto a possibly-migrated datadir.

- stacks.CatalogOrder: the comparison gains a fourth answer (Ahead) and moves out of
  web, so the badge and UpdatePreflight cannot drift apart.
- The badge: ahead reads „Naprakész"/"Up to date", tag-ok, with a title saying why.
- The refusal: UpdatePreflight returns `downgrade` (409), born as a bundle key; the
  API now renders update refusals through errText so it reaches English households.
- Ahead is narrow: every differing service must be orderable AND newer, else Behind.
- Ordering is util.Version.Compare behind a tag normaliser — no second comparator.
- Three red-proofs, each seen to fail.

R-589 was already fixed in v0.258.0; only its register row was stale.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -517,10 +517,23 @@ the current template pins and returns a `*MetaBadge` rendered by the existing `m
 | state | badge |
 |---|---|
 | every service matches the template | „Naprakész" (`tag-ok`) |
+| **every differing service is provably NEWER than the catalog** (v0.260.0) | **„Naprakész" (`tag-ok`)**, with a title saying the app is ahead |
 | any service differs, `catalog_since` usable | „Frissítés elérhető — N napja" (`tag-warn`) |
 | any service differs, `catalog_since` absent/malformed/future | „Frissítés elérhető" |
 | **no record, or the template cannot be read** | **nothing is rendered** |
 
+**The fourth row is v0.260.0 (R-524), and it is also a REFUSAL.** The comparison lives in
+`stacks.CatalogOrder` (`internal/stacks/updateorder.go`) — Unknown / Current / Behind / **Ahead** —
+and `web.compareInstalledToTemplate` is a thin wrapper over it, because the badge and
+`Manager.UpdatePreflight` must reach the same verdict. A box AHEAD of the catalog (the catalog was
+reverted under it) reads „Naprakész" and its Update is **refused** with reason `downgrade`:
+„Ez a változat újabb a katalógusban lévőnél — visszalépés csak az üzemeltető kérésére."
+**Ahead is narrow on purpose:** EVERY differing service must be orderable and newer, or the answer
+falls back to Behind. Ordering is `util.Version.Compare` (the one comparator) behind a tag
+normaliser — `X.Y`/`X.Y.Z`, optional leading `v`, and a trailing suffix that must be IDENTICAL on
+both sides, so `31.0.14-apache → 31.0.15-apache` orders while `postgres:16-alpine`,
+`26.05.2-ls310 → -ls311`, `apache-2.57.0`, a date stamp and a digest pin do not.
+
 - **No version string is shown to the customer anywhere** — operator ruling, 2026-09-02: a household
   cannot act on `26.05.2`, only on "you are behind, and by this long". Versions stay in the logs, the
   API and the hub.