Traefik v3.7.17 (GHSA-xv5x-242w-7hf7); R-1347 a restore forgets the update-held flag; R-1348 a failed put-back at start-up mails; R-1339, R-1351, R-1323 truthful start-up lines and one lock over FileBrowser's compose. Commit only.

controller/internal/stacks/infra.go

@@ -254,8 +254,28 @@ func changedInfraFiles(dir string, files map[string]infra.FileSpec) []string {
 	return changed
 }
 
+// LockFileBrowserStack takes the lock over every `docker compose` on FileBrowser's stack at a boot (R-1351): this file's
+// ensureFileBrowser and web.syncFileBrowserMounts. Returns the unlock. Lock order: infraMu (the base stack) before this;
+// the web sync takes only this one, and starts the gate (infraMu) in a goroutine. Pinned by TestR1351_* and
+// TestR1351_TheWebSyncTakesTheLockBeforeCompose (internal/web).
+func (m *Manager) LockFileBrowserStack() (unlock func()) {
+	m.fbStackMu.Lock()
+	return m.fbStackMu.Unlock
+}
+
+// WithFileBrowserStack runs fn under LockFileBrowserStack.
+func (m *Manager) WithFileBrowserStack(fn func()) {
+	defer m.LockFileBrowserStack()()
+	fn()
+}
+
 func (m *Manager) ensureFileBrowser(dir string) error {
-	if containerRunning("filebrowser") {
+	defer m.LockFileBrowserStack()()
+	running := containerRunning
+	if m.fbRunningFn != nil {
+		running = func(string) bool { return m.fbRunningFn() }
+	}
+	if running("filebrowser") {
 		return m.reconcileFileBrowserImage(dir)
 	}
 	composePath := filepath.Join(dir, "docker-compose.yml")
@@ -263,6 +283,9 @@ func (m *Manager) ensureFileBrowser(dir string) error {
 		// Already provisioned but not running — bring it up WITHOUT regenerating, so the storage
 		// mounts that web.SyncFileBrowserMounts manages are preserved. Just `compose up -d`.
 		m.logger.Printf("[INFO] [infra] filebrowser compose exists — starting without regenerating")
+		if m.fbComposeUpFn != nil {
+			return m.fbComposeUpFn(dir)
+		}
 		return m.composeUp(dir)
 	}
 	m.logger.Printf("[INFO] [infra] deploying filebrowser → %s", dir)