CHANGELOG + comment: correct the file-browser claim (the start-up mount sync already moved it); 9202 gaps measured

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -13,11 +13,14 @@
   `gtstef/filebrowser:1.3.3-stable → 1.5.6-stable` (release notes read: nothing we use is removed — filebrowser drops
   `source.config.disableIndexing` and adds auth rate limiting; traefik 3.7 tightens StripPrefix, BasicAuth and `Host(*)`,
   none of which we configure; cloudflared deprecates `--transport-loglevel`, which we do not pass).
-- **A release now moves a running file browser.** traefik and cloudflared were already recreated when their rendered
-  file changed (the image line is in it). The file browser was not: its bring-up skipped a running container and its
-  compose is rewritten only when storage changes, so a raised pin never reached an installed box. A running file
-  browser whose compose names another image now gets ONLY the `image:` line replaced (the mounts stay) and is
-  recreated once. `TestReconcileFileBrowserImage_MovesOnlyTheImage`, red-proved.
+- **How a release moves the three containers** (measured on 9202, 2026-10-04): traefik and cloudflared are recreated by
+  the base-infra bring-up when their rendered file changes (the image line is in it); the file browser is recreated by
+  the web server's START-UP mount sync (`internal/web/server.go:302-304`), which renders the new image. On 9202 the
+  0.291.0 start moved traefik (silent ≤ 1.9 s) and the file browser (≤ 1.5 s). **Correction, same day:** an earlier
+  line here said a raised file-browser pin "never reached an installed box" — wrong; the search for the sync's callers
+  missed the constructor. The added `reconcileFileBrowserImage` (a running file browser whose compose names another
+  image gets ONLY its `image:` line replaced and is recreated) is therefore a second net, not the only route.
+  `TestReconcileFileBrowserImage_MovesOnlyTheImage`, red-proved.
 - **`scripts/check-infra-pins.py`** — the monthly re-test's infrastructure half: newest upstream release per pin, in the
   same channel; BEHIND exits 1 (report only).