diff --git a/CHANGELOG.md b/CHANGELOG.md
index c8d8635e..12415e3e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,6 @@
-## Unreleased (2026-10-29, attended) — D62: restore copies kept 30 days, listed, and deletable by hand; D63: a test-build fault switch for the H4/H5 live proofs; commit only, rides the next release
+## v0.347.0 (2026-10-29) — D62: restore copies kept 30 days, listed, deletable by hand; R-1256: four restore edges, all proven live (D63); R-1254 controller half; R-528: the host's OOM count; an unknown app is a 404 — built from the commit carrying this heading; rc.1 = `e3fce09` on scratch 9202
+
+### 2026-10-29 (attended) — D62 and D63
 
 **MinAgent: 0.158.1** (unchanged). Needs hub ≥ the release carrying `restore_copy_deleted` (felhom.eu `19afefab`): an
 older hub answers that one event 400 and the record is lost (the delete itself is unaffected).
@@ -22,12 +24,13 @@ older hub answers that one event 400 and the record is lost (the delete itself i
   is a no-op that reads nothing; `TestD63_TheReleaseBuildHasNoFaultSwitch` pins that, and that build.sh and the
   Dockerfile pass no build tag (red-proofed both ways).
 
-## Unreleased (2026-10-28 night) — four restore edges (felhom.eu R-1256, review round 2 HUNT-1 H4/H5/H6/H8); commit only, rides the next release
+### 2026-10-28 night — four restore edges (felhom.eu R-1256, review round 2 HUNT-1 H4/H5/H6/H8)
 
 **MinAgent: 0.158.1** (unchanged). Each edge: a test seen failing first, then the fix; live proof on 9202 in the felhom.eu
 night report (`audits/night-2026-10-28/`). **Live 2026-10-29 on 9202:** H5's busy volume (not written into, the live data
-put back, no hold) and H8 (the 03:29 sweep removed the two old copies, kept the young one). H4, H5's failed stop and H6:
-tests only — the attended live proof (or a revert of those two branches) is owed.
+put back, no hold) and H8 (the 03:29 sweep removed the two old copies, kept the young one). **Live 2026-10-29 on Tester 1
+(D63, a `-tags faultinject` test build):** H4 (the live definition written back before the start) and H5's failed stop
+(nothing put back, the copy kept, the app held). H6: tests only (the old code refused at the early check too).
 
 - **H4 — `internal/backup/offbox_reconstitute.go`:** an off-site restore whose definition write (or database-password
   write) fails no longer starts the app at once. The writer writes the compose BEFORE the app's settings, so the stack