v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/README.md

@@ -873,6 +873,14 @@ sends no mail; the app page says „Automatikus frissítés %s-kor — sikeres."
 One summary line per night (`[update-leg] update leg (after-offsite): done=… undone=… held=… failed=…
 skipped=… [skipped: app=reason, …]`) in the log and in the hub report's `update_leg`. After `done`/`undone` the
 app's steps-left and badge are fresh at once (R-678). `stacks.update_window` is removed (it was never read).
+**A security-fix step (v0.341.0, `09` §3 decision 255, D39 = B).** The leg also takes a ladder entry with
+`"verdict": "security_fix"` — an urgent upstream fix proven on the box (scratch 9202, the guarded Update) whose bench run
+is optional, with its public notice (`security`: CVE/GHSA ids, the advisory, the first fixed version). Every other rule
+above holds for it unchanged and in the same order (held, stopped by the household, `needs_person`, the failed step,
+`files_may_change`, W+5h). The leg logs `[update-leg] <app>: security fix <ids> taken (<from> → <to>)`, the hub
+report's step carries `security: [ids]`, and the summary line ends `[security fix <app>: <ids> <outcome>]`. A
+controller before 0.341.0 skips such a step at night (`not_proven`); a person's press takes it on every controller
+with ladders (the press never read the verdict).
 
 **Leftovers (v0.272.0).** The backup page says in plain words when a whole-box backup was skipped because it
 cannot fit (the agent's numbers; R-685). A restore that lifts an update hold removes that hold's undo copies