Traefik v3.7.17 (GHSA-xv5x-242w-7hf7); R-1347 a restore forgets the update-held flag; R-1348 a failed put-back at start-up mails; R-1339, R-1351, R-1323 truthful start-up lines and one lock over FileBrowser's compose. Commit only.

controller/internal/backup/update_guard.go

@@ -674,6 +674,12 @@ func (m *Manager) clearUpdateHoldAfterRestore(stackName string) {
 		return
 	}
 	m.logger.Printf("[INFO] [backup] %s: restore completed — the update hold (set %s) is CLEARED", stackName, h.At)
+	// R-1347: the hold store and the stack manager's in-memory flag go together, as in the operator's clear (D64 = B, R-1343).
+	// Left set, the crash-loop watcher would not watch the restored app and the night leg would skip it until the next
+	// controller restart. A running update is not touched (ForgetUpdateHeld refuses it). Pinned by TestR1347_*.
+	if m.updateHeldForgetter != nil && m.updateHeldForgetter(stackName) {
+		m.logger.Printf("[INFO] [backup] %s: the restored app is watched and updated again — its update-held flag is forgotten (R-1347)", stackName)
+	}
 	// R-671 (v0.272.0): the undo copies the hold kept describe the state this restore just replaced. They
 	// were kept so the hold's data stayed recoverable; once the app is restored whole they are dead weight
 	// (measured 2026-09-24 on 9202: three nextcloud copies, ~0.9 GiB, outlived the hold and nothing named
@@ -691,6 +697,12 @@ func (m *Manager) SetUndoCopyRemover(fn func(stackName string) int) {
 	m.undoCopyRemover = fn
 }
 
+// SetUpdateHeldForgetter wires R-1347's seam: stacks.Manager.ForgetUpdateHeld. INIT-ONLY, main.go — pinned by
+// TestR1347_UpdateHeldForgetterIsWiredAtStartup (an AST walk). The backup package cannot import stacks.
+func (m *Manager) SetUpdateHeldForgetter(fn func(stackName string) bool) {
+	m.updateHeldForgetter = fn
+}
+
 // UpdateHeldStacks is the set of apps held stopped after a failed update (R-660, v0.268.0) — the
 // FOURTH way the product stops an app on purpose, and until v0.268.0 the one `classifyRunStates` did
 // not know: each hold's `app_update_held` was followed ~11 s later by an `app_start_failed` for the