Traefik v3.7.17 (GHSA-xv5x-242w-7hf7); R-1347 a restore forgets the update-held flag; R-1348 a failed put-back at start-up mails; R-1339, R-1351, R-1323 truthful start-up lines and one lock over FileBrowser's compose. Commit only.

controller/internal/stacks/filebrowser_gate.go

@@ -109,7 +109,7 @@ func (m *Manager) ensureFileBrowserPublic() {
 	}
 	if m.fbNetOn(target, traefikNetwork) {
 		if err := m.fbNetDisconnect(target, traefikNetwork); err != nil {
-			m.logger.Printf("[WARN] [infra] filebrowser: could not leave %s — every app can still reach it (R-1281): %v", traefikNetwork, err)
+			m.reportFileBrowserNotLeft(target, err)
 		} else {
 			m.logger.Printf("[INFO] [infra] filebrowser: left %s — no app container reaches it any more (R-1281)", traefikNetwork)
 		}
@@ -117,6 +117,27 @@ func (m *Manager) ensureFileBrowserPublic() {
 	m.ensureOfficeOnFilesNetwork()
 }
 
+// reportFileBrowserNotLeft says what a failed leave means (R-1323). „No such container" means the CHECKED container was
+// replaced between the check and the leave (the image moved at start, a mounts sync): the line then reads the CURRENT
+// container's networks and says the truth. A false „every app can still reach it" teaches the reader to ignore the real
+// one, which stays: any other failure, a current container on the app network, or one that cannot be read. The new
+// container is checked and published by the next round. Pinned by TestR1323_*.
+func (m *Manager) reportFileBrowserNotLeft(target string, err error) {
+	if !strings.Contains(err.Error(), "No such container") {
+		m.logger.Printf("[WARN] [infra] filebrowser: could not leave %s — every app can still reach it (R-1281): %v", traefikNetwork, err)
+		return
+	}
+	cur := strings.Fields(m.fbStartedAt())
+	switch {
+	case len(cur) == 0:
+		m.logger.Printf("[WARN] [infra] filebrowser: the checked container %s is gone and the current one cannot be read — whether every app can reach it is not known (R-1281, R-1323)", target)
+	case m.fbNetOn(cur[0], traefikNetwork):
+		m.logger.Printf("[WARN] [infra] filebrowser: could not leave %s — every app can still reach it (R-1281): the checked container %s was replaced, and the current one %s IS on it", traefikNetwork, target, cur[0])
+	default:
+		m.logger.Printf("[INFO] [infra] filebrowser: the checked container %s was replaced before it left %s; the current one %s is not on %s (R-1323)", target, traefikNetwork, cur[0], traefikNetwork)
+	}
+}
+
 // traefikContainer is traefik's container (infra/templates/traefik-compose.yml.tmpl container_name).
 const traefikContainer = "traefik"