v0.346.1: SECURITY — traefik v3.7.16, the file manager 1.5.8-stable, cloudflared 2026.10.4 (felhom.eu R-1304, R-1305); test TestEnsureTraefik_ANewImageRecreatesTraefik (red first)

Built from the v0.346.0 release commit b1b9be3 + this one commit. MinAgent 0.158.1 (unchanged).

REPORT-box-programs-0.346.1.md

@@ -0,0 +1,19 @@
+# REPORT — controller v0.346.1: traefik v3.7.16, the file manager 1.5.8-stable, cloudflared 2026.10.4 (security), 2026-10-27 (attended)
+
+> A sibling of `REPORT.md`, not an overwrite: the release session of the same day (v0.346.0) owns `REPORT.md`.
+
+## In plain words
+
+- **What:** three box programs had public security notices: traefik (12 notices, none reaching our config), the file
+  manager (a TOTP re-enrolment and an upload-share flaw; 1.5.7 is skipped, it broke TOTP sign-ins) and cloudflared
+  (debug endpoints on its metrics server, not reachable from outside). Controller **0.346.1** = the released 0.346.0
+  (`b1b9be3`) + only the three new pins.
+- **How a box takes them:** the reconcile at start recreates each container on its new image (traefik pinned by the new
+  test `TestEnsureTraefik_ANewImageRecreatesTraefik`, red-proved).
+
+## Gates
+
+`controller_gates.py` (full) green; `go test ./...` green (41 packages); `go build`, `go vet` green.
+
+Evidence and the box proofs: felhom.eu `documentation/audits/security-app-updates-2026-10-27/part5/`. Register:
+felhom.eu R-1304 (traefik), R-1305 (file manager).