v0.345.1: SECURITY — cloudflared 2026.10.3 (Cloudflare's eMudhra notice, 2026-10-20)

Built from v0.345.0 (6bfb784) + this commit only. infra.CloudflaredImage 2026.9.3 -> 2026.10.3;
TestEnsureCloudflared_ANewImageRecreatesTheTunnel pins that an image-only change recreates the
running tunnel (red-proved). MinAgent 0.158.1 unchanged.

CHANGELOG.md

@@ -1,3 +1,22 @@
+## v0.345.1 (2026-10-26) — SECURITY: cloudflared 2026.10.3 (Cloudflare's eMudhra notice) — built from v0.345.0 + this one commit (R-1300)
+
+**MinAgent: 0.158.1** (unchanged). Nothing else from `main` is in this build: it is the v0.345.0 commit (`6bfb784`) plus
+this commit only, tagged `v0.345.1`; the same change is on `main`.
+
+- **Security:** `infra.CloudflaredImage` `cloudflare/cloudflared:2026.9.3` → `2026.10.3` (Docker Hub index digest
+  `sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39`). Cloudflare's notice of 2026-10-20:
+  cloudflared before 2026.10.2 trusts eight eMudhra (emSign) intermediate CAs whose private keys were weak and are
+  recoverable — anyone holding them could pose as any website to cloudflared. The fix is the image's trust store
+  (2026.10.2 rebuilt on a new distroless base; 2026.10.3 a newer base and Go).
+- How a box takes it: after the controller update, `EnsureBaseStack` → `ensureCloudflared` sees the rendered compose
+  differ (the `image:` line) and runs `compose up -d`, which recreates cloudflared on the new image; the tunnel
+  reconnects in seconds. New test `TestEnsureCloudflared_ANewImageRecreatesTheTunnel` (an image-only change recreates;
+  the same render again does not), red-proved with the change check removed.
+- Origin check (read only, before the update): every tunnel's remote route is `*.<domain>` → `https://traefik` with
+  `noTLSVerify: true` (the day-0 recipe, R-510); traefik answers with its self-signed `TRAEFIK DEFAULT CERT` — no
+  eMudhra chain, so the new trust store refuses nothing on the origin leg. felhom.eu
+  `documentation/audits/cloudflared-2026.10.3-2026-10-26/`.
+
 ## v0.345.0 (2026-10-26) — the 50 % rule owns qBittorrent's NORMAL limit only (R-1292) — attended release run (afternoon)
 
 Live before the release: Tester 1 on `0.345.0-rc.1` with a throwaway qBittorrent, alternative speed ON (the household's