controller README: the boot pass and the agent's boot key (R-1395)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -2554,6 +2554,9 @@ that folder is never a dead end, and an install never runs into it silently (R-6
 > - **Guest-reboot convergence is DETERMINISTIC** via the agent's `guest_boot_id`: the controller persists
 >   `LastGuestBootID` and, when it changes, recreates EVERY deployed drive-backed app onto the
 >   re-propagated drive (`processGuestBootChange` — no fragile container-uptime sampling).
+>   **Built, not released (2026-11-14, R-1395):** the boot pass decides through `guestBootVerdict` and prefers the
+>   agent's `guest_boot_key` (the kernel's `boot_id`, not the boot TIME) — a step of the host's clock moved the old
+>   token and recreated every drive-backed app (the N100, 2026-11-14). An agent that sends no key gets the old rule.
 >   **v0.71.0 — boot-race fix:** on a guest `pct reboot`, in-guest dockerd auto-starts the apps ~18s
 >   BEFORE the agent re-binds the drive, so their volume bind fails at create-time
 >   (`mkdir …/userdata: permission denied`, `RestartCount=0` → never retried → stuck `Exited`). The old