v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,25 @@
+## v0.285.0 — a box keeps two controller versions (decision 56); a crash in the update clean-up fixed (2026-10-01)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings.
+
+- **Controller image retention — `09` §3 decision 56 (R-745).** Decision 53's sweep never touched the controller's
+  own repository, so every release a box ran stayed (demo-hp's guest: 83 controller images on 2026-10-01). Now, 3
+  minutes after every start (`stacks/controller_image_retention.go`), the box keeps the controller image it runs, the
+  one before it — by the swap's own record (`update-state.json` `previous_image` of a swap that ended on the running
+  version, `selfupdate.UpdateState.RecordedPrevious`), by version order only when no record names one present —
+  every version ABOVE the running one (a pulled target not swapped to yet) and every non-version tag (`latest`, `-rc`).
+  Older and untagged controller images are deleted by exact name/ID after the in-use check; never forced, never pruned;
+  nothing while the controller swaps itself; registry tags never. One INFO line per pass, one per deletion with size.
+  **Measured first:** the agent's swap rolls back to what `/etc/felhom-controller-image` named when the swap began — the
+  RUNNING image — and is never handed a previous image; so the self-update's own roll-back needs only the running one.
+- **R-751 (found by the full suite):** the retention after an update runs in a goroutine and re-reads the stack after a
+  rescan; when the app was gone by then it dereferenced a nil stack — a panic in a goroutine ends the controller. Now
+  it returns. The two retention seams are no-ops in the package's tests (`TestMain`), where the goroutine outlived its
+  test and wrote into a removed temp dir.
+- Tests `TestControllerRetention_*` (6), `TestRecordedPrevious`, `TestRetainImagesAfterUpdate_AppGoneDoesNotPanic`;
+  red-proofs: drop the previous from the keep switch, ignore the record, drop the swap check, drop the in-use check,
+  drop the success check, drop the nil-stack check — each fails (`felhom.eu/documentation/audits/rulings-2026-10-01/B/`).
+
 ## v0.284.2 — the image clean-up sees digest-pulled (untagged) images (2026-09-30)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings. v0.284.0 and v0.284.1 were never