demo-hp local tier refused again: space freed; decision 285 + 56 amended (old infra/rc images); R-1366, R-1367 filed; R-548 note

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -716,6 +716,11 @@ R-636's louder repeated alarm.
     image back (`:289`). After a good swap that image is "the one before" the running one — so „the one before it" here
     and R-745's „rolls back to the RUNNING image" name the same image, seen before and after the swap. The controller
     never hands the agent an older roll-back target.
+    *Amended 2026-11-09 (operator, „go with A" — decision 285's session):* a test build (`X.Y.Z-rc.N`) is a version below
+    its release, so an old one is deleted like an old release; one above the running version or between the previous
+    and the running one stays; with no swap record the previous is the highest RELEASE below the running one (a test
+    build only when no release is there). Measured cause: 25 old test builds (2.2 GB) on demo-hp's guest, all left
+    alone because every `-rc` tag was. Controller v0.351.0, `TestControllerRetention_OldTestBuildsGo`.
 
 ### 2026-10-01 — decided by CC unattended, operator may reverse
 
@@ -1225,6 +1230,16 @@ Wanderer's Meilisearch went 256 → 384 MB and was measured again (it sizes itse
      „a person — on the box, or the operator on the hub". Built as the controller's `clear_hold` operator action
      (`04` §6.1), cleared by the running controller (R-1343). *Operator, 2026-10-29 12:10.*
 
+### 2026-11-09 (attended) — old infrastructure images are deleted like old controller images
+
+285. **A box keeps, per pinned infrastructure image (traefik, cloudflared, FileBrowser, Samba), the pin, every newer
+     version, the previous pin and every image a container uses; older and untagged images of that repository are
+     deleted** by exact name/ID, never forced or pruned, not while an app pulls (R-863) or the controller swaps itself —
+     decision 56's shape. *Operator, 2026-11-09 („go with A": the product fixes for demo-hp's full local backup tier,
+     R-548).* **Why:** nothing deleted them; each pin is 65–195 MB and moves every few weeks on every customer box, and every
+     image rides the whole-guest copy (mp0 holds Docker's data). **Cost:** a hand roll-back two pins back pulls the image
+     again. Controller v0.351.0, `internal/stacks/infra_image_retention.go`, `TestInfraRetention_*`.
+
 ### 2026-10-28 (day, attended) — RomM kept; the runtime cache fills itself in CI
 
 277. **D61 = keep RomM offered** (R-1330) while no RomM release carries Node ≥ 24.22.1; the first one that does is taken