v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/selfupdate/state.go

@@ -71,3 +71,14 @@ func ClearState(dataDir string, logger *log.Logger) {
 	}
 	logger.Printf("[INFO] [selfupdate] Update state cleared")
 }
+
+// RecordedPrevious is the controller image the box ran before `running`, by the swap's own record (decision 56,
+// R-745): the previous_image of an update that ended on the running version. "" when the record names none — the
+// last swap failed, was to another version, or there is no record (a box set up by hand). Pinned by
+// TestRecordedPrevious in state_test.go.
+func (s *UpdateState) RecordedPrevious(running string) string {
+	if s == nil || s.Status != "success" || s.TargetVersion != running || s.PreviousVersion == running {
+		return ""
+	}
+	return s.PreviousImage
+}