v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/cmd/controller/main.go

@@ -1696,6 +1696,14 @@ func main() {
 		case <-time.After(3 * time.Minute):
 		}
 		stackMgr.RunImageRetentionOnce()
+		// decision 56 (R-745): the controller's own images — keep the running one and the one before it. At every
+		// start, 3 minutes in: a swap has ended by then (the agent's verify window is 90 s), so the image the agent
+		// would roll back to is the running one, and the one before it is in the swap record read here.
+		prevCtl := ""
+		if st, err := selfupdate.LoadState(cfg.Paths.DataDir); err == nil {
+			prevCtl = st.RecordedPrevious(Version)
+		}
+		_, _ = stackMgr.RetainControllerImages(stacks.ControllerImageRecord{Repo: cfg.SelfUpdate.Image, Running: Version, Previous: prevCtl})
 	}()
 
 	// --- Initialize API router ---