v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

CHANGELOG.md

@@ -1,3 +1,25 @@
+## v0.341.0 (2026-10-23) — the night update takes a security-fix step (D39 = B, `09` §3 decision 255, R-1239)
+
+**MinAgent: 0.158.1** (unchanged). No hub dependency (the hub report's `update_leg.steps[].security` is a new optional
+field; the hub stores the report as it comes). Task: the D39 = B day brief (attended).
+
+- **`legCandidate`** takes a ladder step whose verdict is `proven` OR `security_fix` (`stacks.LadderVerdictSecurityFix`) —
+  an urgent upstream fix proven on the box (scratch 9202, the guarded Update), its bench run optional, its public notice in
+  the entry's `security` block (CVE/GHSA ids, the advisory, the first fixed version; `stacks.LadderSecurity`). Every other
+  guard is unchanged and runs in the same order: held, stopped by the household, current/ahead/unorderable, unpinned, no
+  ladder, older than the ladder, `needs_person`, the failed step (R-680), `files_may_change` without a whole copy, W+5h.
+- The leg logs `[update-leg] <app>: security fix <ids> taken (<from> → <to>)` when it presses such a step (beside the
+  usual `step pressed`); the summary step carries `security: [ids]` (hub report) and the summary line ends
+  `[security fix <app>: <ids> <outcome>]`. A skipped security step logs its reason like any skip.
+- `LadderEntry.Security` is `omitempty`, so `LadderPrint` (R-680's fingerprint) of every existing entry is unchanged.
+- **Unchanged:** a person's press (it never read the verdict — on 0.340.0 a hand press took the step; proven on 9202),
+  the guarded update, the badge.
+- Tests (`internal/stacks/unattended_security_test.go`, the real leg over the real guarded update): taken and named;
+  `needs_person` skipped; held skipped; stopped by the household skipped; an unknown verdict still `not_proven`; `proven`
+  unchanged with no security names. Red-proofs: the OLD line turns the first two red; „a security_fix returns before the
+  guards" turns needs_person/held/stopped red; „any verdict but unrecorded is taken" turns the unknown-verdict test red;
+  „log every step as a security fix" turns the proven test red.
+
 ## v0.340.0 (2026-10-23) — the night copy in a capped container that never outlives the controller (R-1214 + the stray-copy fix), Immich's model cache out of backups (R-49, D21 = B), no import over a stopped app (R-1187 c), the catch-up's checks (R-1189 d, C5)
 
 **MinAgent: 0.158.1** (unchanged). No hub dependency. Task: the 2026-10-23 day brief (release run, operator go). Soaked