v0.234.0: a known limitation written on 2026-09-02 was a defect by the next morning

The operator looked at demo-felhom and found OpenGist - up 15 hours, running
exactly the catalog pin, showing no badge at all. 09-update-architecture.md had
recorded that as an accepted limitation the day before: 'the fleet view fills in
gradually'. On a quiet box gradually means never, and a feature that fills itself
in on an event nobody triggers is, on the quiet installations, not shipped. That
limitation row is now struck with the reason kept.

The living document gains slice 1b, the two admission rules of the backfill (it
never overwrites, and it refuses to seed a partial observation because the badge
reads a service-count mismatch as BEHIND), and the note that the same field having
two writers with two different admission rules is deliberate.

Live evidence added: all nine apps already had records by the time 0.234.0 was
ready, so the natural fleet state could no longer exercise the new code - said
plainly rather than papered over. The pre-0.233.0 shape was recreated on demo-hp
by stripping two records; the backfill re-seeded exactly those two with digests
matching independently-read ground truth and left the other seven alone.

The refusal half was deliberately NOT staged live: it needs a degraded app, and
manufacturing one risks the false-customer-email class that already cost 61 mails
(R-330). Unit-tested with a red-proof, and recorded as unproven-live.

R-457: a test that hardcodes a date and asserts an age derived from it is green
only on the day it is written. Mine was, and it went red overnight. Six other
files carry both a date literal and time.Now() - named as candidates, not accused.

documentation/architecture/09-update-architecture.md

@@ -139,6 +139,7 @@ prerequisite for judging how urgent it is.
 | # | slice | status |
 |---|---|---|
 | **1** | **The box records what it actually installed** — `app.yaml.installed_images`, per compose service, ref + digest + first-seen. | **SHIPPED, controller v0.233.0 (2026-09-02)** |
+| **1b** | **Seed the record for apps nobody touches** — a startup backfill, so the label is not restricted to apps that happen to get restarted. | **SHIPPED, controller v0.234.0 (2026-09-03)** |
 | **2** | **One badge says whether the app is current** — „Naprakész" / „Frissítés elérhető — N napja", from `catalog_since`. No version number. | **SHIPPED, controller v0.233.0 + catalog `69761cf` (2026-09-02)** |
 | **3** | **The compose file becomes DERIVED** — stop the syncer overwriting a deployed app's file; the pin in `app.yaml` wins. Needs the operator's ruling on R-438 first. | OPEN — R-447 |
 | **4** | **A guarded update** — verified-backup precondition, abort-on-failure, and the truth at the moment of action rather than 5m16s later (R-443). | OPEN — R-448 |
@@ -180,6 +181,22 @@ Three rules, each with its reason:
 - **It is NOT called from `StartStackServices`** — the R-47 DB-only restore window would overwrite a
   complete record with a partial one.
 
+**Seeded at startup (v0.234.0).** `Manager.BackfillInstalledImages` runs once at boot, beside the
+desired-state backfill and before the boot reconciler, and records what every deployed app is ALREADY
+on. It only READS containers. **This was not a refinement — without it the feature did not reach a
+quiet box at all:** see §8.3, which was written as a known limitation on 2026-09-02 and was a defect
+by the next morning.
+
+Two admission rules, and the second is the design:
+
+- **It never overwrites an existing record.** The bring-up paths own updates; this fills gaps only.
+- **It refuses to seed a PARTIAL observation.** §7.2's comparison reads a service-count mismatch as
+  BEHIND, so a degraded or crash-looping app seeded from its visible containers would render
+  „Frissítés elérhető" over an app that is perfectly current. The bring-up paths may write a partial
+  because they follow a SUCCESSFUL `up -d`, where a gap is real news and is logged; a backfill meets a
+  box in whatever state it is in. **Same field, two writers, two different admission rules — that is
+  deliberate and must not be "made consistent".**
+
 **Nothing reads it to take a decision.** Slice 2 reads it to render a label.
 
 ### 7.2 The label (slice 2)
@@ -209,10 +226,15 @@ Version strings stay in the logs, the API and the hub.
 2. **Nothing enforces `catalog_since`.** A commit that moves an `image:` line and forgets the date
    under-reports how far behind a box is. The gates runner fetches at `--depth 1` and has no parent
    commit to diff against, so the gate needs a deeper fetch — **R-452**.
-3. **The record only appears after the next lifecycle action.** An app that is running and untouched
-   keeps a legacy `app.yaml` and therefore no badge, until someone restarts, updates or redeploys it.
-   That is correct — the alternative is inventing a record from the file §1.2 says has already moved —
-   but it means the fleet view fills in gradually rather than at upgrade.
+3. ~~**The record only appears after the next lifecycle action.**~~ **CLOSED in v0.234.0, and the way
+   it closed is worth keeping.** This was written on 2026-09-02 as an accepted limitation — *"the
+   fleet view fills in gradually"*. The operator looked at demo-felhom the next morning and found
+   OpenGist, up 15 hours, running exactly the catalog pin, showing **nothing at all**. **On a quiet
+   box "gradually" means "never", and a feature that fills itself in on an event nobody triggers is,
+   on the quiet installations, not shipped.** `BackfillInstalledImages` now seeds the absences at
+   startup by reading containers (§7.1). **The residue that stays:** the seed happens at controller
+   START, so a box between upgrade and its next restart still shows nothing — bounded by one restart
+   rather than unbounded.
 4. **The hub does not record image tags at all.** Its report's container payload carries name, state,
    CPU and memory, and no image field (spike §5). So the fleet view of §6 slice 7 needs a hub-side
    change; it is not derivable from what is already reported.