docs: auto rollbacks, bare image as latest and registry request scope (#9)

CLAUDE.md

@@ -74,12 +74,21 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
   GET as a pull; the client never falls back to GET, and a test asserts this.
 - **`image_versions` uses `''` instead of NULL** for a missing tag or digest, so
   `UNIQUE (repo, tag, digest)` deduplicates. The webhook records `(repo, tag, '')`; that
-  row is hidden from `RecentVersions` once a row with the same tag and a digest exists.
+  row is hidden from `RecentVersions` when a row with the same tag and a digest was first
+  seen at or after it.
 - **The UI picks a version by `image_versions.id`, never by a ref from the form**, and the row
   must belong to the service's `image_repo`. A digest-pinned or tagless pick needs agent
   protocol 3 (`protocol.MinPinnedRefVersion`); `Hub.Route` takes the minimum version.
-- **Rolling back a service that follows no tag afterwards:** a pick of `repo@digest` makes the
-  service follow no tag, so it is no longer polled.
+- **Picking a tagless version (`repo@digest`) leaves the service following no tag:** it is no
+  longer polled and the plain Update button is refused.
+- **The poller starts one auto job per digest** (`services.last_auto_digest`, set only when a
+  job row was created; `ErrJobActive` and `NotUpdatableError` leave it so the next cycle
+  retries). It also skips a digest that `desired_ref` (`ref@digest`) already names, and
+  re-reads the service before `Start`. That is why a rollback of an auto service holds until
+  a new digest appears. The webhook does not set it, so a webhook-started update can be
+  followed by a poll job after a rollback.
+- **A bare image's running version is recorded with tag `latest`** (like `jobs.FollowedRef`);
+  `repo@digest` is recorded with tag `''`. Only `sha256:<64 hex>` digests are recorded.
 - **Image matching is case-sensitive.** The tricky case is `localhost:5000/foo:v1` where
   the first colon is a port, not a tag. See `internal/imageref`.
 - **Path safety uses `filepath.Rel` + ".." prefix check**, NOT `strings.HasPrefix`.