v0.291.0: decision 78 (R-726) — a returning household's first night sets the orphaned copy aside; R-838 — traefik v3.7.13, cloudflared 2026.9.3, filebrowser 1.5.6-stable, a release now moves a running file browser, check-infra-pins.py

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,26 @@
+## v0.291.0 — a returning household's first night makes an off-site copy (decision 78, R-726); the built-in images raised and a release now moves them (R-838) (2026-10-04)
+
+**MinAgent: 0.131.0** (unchanged). No new household string.
+
+- **R-726 — decision 78.** A CLAIMED box whose off-site repository is orphaned and that has NEVER made an off-site copy
+  itself (`LastSuccess` empty — a returning household's new box, night one) now sets the old copy aside by itself and
+  starts a new one, exactly as an unclaimed box already did. Nothing is deleted; the moved copy is recorded
+  (`OrphanedRenamedTo`) and can be put back. A claimed box that HAS made copies still shows the orphan card and waits
+  for the household (its key changing is a real fault). Tests `TestR726_ReturningHouseholdFirstNightSetsAside`,
+  `TestR726_NotOrphanedChangesNothing`; `TestOffbox_OrphanDetection_Claimed` now pins the "has made copies" case.
+  Red-proved both ways.
+- **R-838 — the infrastructure images.** `traefik:v3.6.7 → v3.7.13`, `cloudflare/cloudflared:2026.6.0 → 2026.9.3`,
+  `gtstef/filebrowser:1.3.3-stable → 1.5.6-stable` (release notes read: nothing we use is removed — filebrowser drops
+  `source.config.disableIndexing` and adds auth rate limiting; traefik 3.7 tightens StripPrefix, BasicAuth and `Host(*)`,
+  none of which we configure; cloudflared deprecates `--transport-loglevel`, which we do not pass).
+- **A release now moves a running file browser.** traefik and cloudflared were already recreated when their rendered
+  file changed (the image line is in it). The file browser was not: its bring-up skipped a running container and its
+  compose is rewritten only when storage changes, so a raised pin never reached an installed box. A running file
+  browser whose compose names another image now gets ONLY the `image:` line replaced (the mounts stay) and is
+  recreated once. `TestReconcileFileBrowserImage_MovesOnlyTheImage`, red-proved.
+- **`scripts/check-infra-pins.py`** — the monthly re-test's infrastructure half: newest upstream release per pin, in the
+  same channel; BEHIND exits 1 (report only).
+
 ## v0.290.0 — the clean-up guard lets an honest window through (R-824); a due set-aside deletion goes to the hub (decision 74, R-823) (2026-10-04)
 
 **MinAgent: 0.131.0** (unchanged). **Needs hub v0.128.0** (`abandon-request` / `-status` / `-cancel`; the window cap of