v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -1939,6 +1939,13 @@ that folder is never a dead end, and an install never runs into it silently (R-6
   kept are every container's image, every installed compose's, and each installed app's running + `previous_images`.
   By exact id, never forced or pruned; no pass while any update runs; a one-time sweep at the first start after the
   release (marker `image-retention-v2.done` in the data dir). See `internal/stacks/image_retention.go`.
+- **Controller image retention (v0.285.0, decision 56)** — 3 minutes after every start the box keeps the controller
+  image it runs and the one before it (the swap record `update-state.json` `previous_image` of a swap that ended on the
+  running version; without one, the highest version below the running one), every version above the running one (a
+  pulled target) and every non-version tag (`latest`, `-rc`); older and untagged controller images are deleted by exact
+  name/ID after the in-use check. Nothing while the controller swaps itself; registry tags are never touched. The
+  agent's own roll-back needs only the running image (it restores what `/etc/felhom-controller-image` named when the
+  swap began). See `internal/stacks/controller_image_retention.go`.
 - **The setup gate (v0.280.0, decision 46)** — `.felhom.yml` `setup_gate: true` + optional `setup_done_probe: {url, field,
   done}`. A FRESH install is closed to everyone but the household: the traefik file
   `<stacks>/traefik/dynamic/setup-gate-<app>.yml` is written BEFORE the first start (a failed write refuses the install) and