Traefik v3.7.17 (GHSA-xv5x-242w-7hf7); R-1347 a restore forgets the update-held flag; R-1348 a failed put-back at start-up mails; R-1339, R-1351, R-1323 truthful start-up lines and one lock over FileBrowser's compose. Commit only.

controller/cmd/controller/main.go

@@ -682,6 +682,7 @@ func main() {
 		backupMgr.SetVersionCheck(stackMgr.PinNotRunning)
 		// R-671 (v0.272.0): a restore that lifts an update hold removes the undo copies that hold kept.
 		backupMgr.SetUndoCopyRemover(stackMgr.RemoveUndoCopies)
+		backupMgr.SetUpdateHeldForgetter(stackMgr.ForgetUpdateHeld) // R-1347
 	}
 	if n := stackMgr.ResumeInterruptedUpdates(ctx); n > 0 {
 		logger.Printf("[WARN] [update] resumed %d interrupted update(s)", n)
@@ -1556,7 +1557,7 @@ func main() {
 		// R-1340: the text is built from the HOLD RECORD the writer persisted just before this call (holdmail.go) — its
 		// reason, which restore, which branch, which put-back step failed, whether it was a database replay — never the
 		// option-C database story for every cause.
-		backupMgr.SetRestoreHoldNotify(func(stack string, replayErr, rollbackErr error) {
+		holdNotify := func(stack string, replayErr, rollbackErr error) {
 			h := heldHoldFromNotify(sett.GetRestoreHold, stack, replayErr, rollbackErr)
 			msg, leg, reason := heldStoppedOperatorText(h)
 			runKind := "offsite-reconstitute"
@@ -1566,7 +1567,11 @@ func main() {
 			d := notify.BackupRunFailuresDetails{RunKind: runKind, Failed: 1, Attempted: 1}
 			d.Apps = append(d.Apps, notify.RunFailureDetail{App: stack, Leg: leg, Reason: reason})
 			notifier.NotifyBackupRunFailures(msg, d)
-		})
+		}
+		backupMgr.SetRestoreHoldNotify(holdNotify)
+		// R-1348: the hold an interrupted put-back wrote at START-UP (Recover, before any notifier existed) or on a resume.
+		// The same sentence (R-1340, MixedCauseInterruptedPutBack), the same mail.
+		appStopGuard.SetHeldNotify(func(stack string) { holdNotify(stack, nil, nil) })
 		// R-893 option A (D20 = A): a failed off-site restore that was PUT BACK — the live volumes and definition poured
 		// back and the app started. The same operator-tier event as the hold above (no new event type), its own leg.
 		// D47 follow-up: a unit of an earlier install was set aside whole — the operator sees it (its own leg).

controller/cmd/controller/r1347_r1348_wiring_test.go

@@ -0,0 +1,19 @@
+package main
+
+import "testing"
+
+// R-1347 and R-1348: each seam is CALLED from main.go (an AST walk) — a seam built and never wired is the project's
+// oldest shape.
+func TestR1347_UpdateHeldForgetterIsWiredAtStartup(t *testing.T) {
+	lines, _, _ := slice4CallLines(t)
+	if len(lines["SetUpdateHeldForgetter"]) == 0 {
+		t.Fatal("main.go never calls SetUpdateHeldForgetter — a restored app would stay unwatched until the controller restarts")
+	}
+}
+
+func TestR1348_HeldNotifyIsWiredAtStartup(t *testing.T) {
+	lines, _, _ := slice4CallLines(t)
+	if len(lines["SetHeldNotify"]) == 0 {
+		t.Fatal("main.go never calls SetHeldNotify — a failed put-back at start-up would mail nobody")
+	}
+}