controller v0.271.0: automatic app updates — the update leg after the off-site copy, the backup gate waits, the switch (09 6.4 part 7; R-680, R-678, R-643)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/update.go

@@ -944,8 +944,16 @@ func (m *Manager) verifyAndConclude(ctx context.Context, name, dir string, env [
 	_ = m.RefreshStatus()
 	m.removeUndoCopies(name, entry.UndoCopies)
 	m.recordUpdateUndone(name, dir, nil) // a successful update ends the "undone" note
+	m.clearFailedStep(name, dir)         // R-680: and the failed-step record
 	m.clearJournal(name)
 	m.removePreUpdateCopies(dir)
+	// R-678 (v0.271.0): the app's catalog fields — ladder_steps_left, the badge's inputs, the pin — are
+	// re-read NOW, before Updating goes false, so neither a person nor the automatic leg ever reads the
+	// pre-update values after `done`. MEASURED 2026-09-24: ~50 s stale, six re-presses by the caller.
+	// COMPANION RED-PROOF (REPORT.md): drop this scan — TestR678_StepsLeftFreshAtDone fails.
+	if err := m.ScanStacks(); err != nil {
+		m.logger.Printf("[WARN] [stacks] update %s: rescan after the update failed: %v — the page catches up at the next scan", name, err)
+	}
 	m.finishUpdate(name, UpdatePhaseDone, "")
 	m.logger.Printf("[INFO] [stacks] update %s: DONE in %s", name, m.now().Sub(start).Round(time.Second))
 }
@@ -1008,6 +1016,9 @@ func (m *Manager) failAndHold(ctx context.Context, name, dir string, env []strin
 		holdWhy = w
 		m.markUpdateHeld(name)
 	}
+	if entry != nil { // R-680: the automatic leg never presses this step again on this ladder
+		m.recordFailedStep(name, dir, entry.NewPin, "held")
+	}
 	_ = m.RefreshStatus()
 	m.clearJournal(name)
 	m.removePreUpdateCopies(dir)