Release 2026-11-03 close-out: every box on 0.350.0 with Traefik v3.7.17; golden 0.350.0 + agent 0.172.0 vouched; hub 0.179.0; catalog f4c5c79

Closed: R-1354, R-1347, R-1348, R-1339, R-1351, R-1323, R-1302, R-1352, R-1331, R-1356, R-1359 (235 -> 224). R-548 and R-1361 carry today's readings.

documentation/backlog/CLOSED-ITEMS.md

@@ -30,6 +30,17 @@
 
 | Row | What | Closed | Evidence |
 |---|---|---|---|
+| **R-1354** | **Traefik v3.7.16 on every box had GHSA-xv5x-242w-7hf7: unauthenticated Negotiate/NTLM headers hold a backend transport per connection until memory runs out.** (P2) | CLOSED 2026-11-03 — controller 0.350.0 (Traefik v3.7.17), the global floor since 08:18 CET; every box reports it (Tester 1, demo-hp, demo-felhom, 9202), golden 0.350.0 carries it. **Proven by behaviour on 9202:** v3.7.16 18.7 → 79.0 MiB after 920 connections, not released; v3.7.17 flat near 25 MiB for 25,116 | `audits/release-2026-11-03/` `part1/README.md`, `load-before.txt`, `load-after.txt`; controller `c4b6844`, `5c336d82` |
+| **R-1347** | **A restore that lifts an update hold left the stack manager's „update held" flag set.** (P3) | CLOSED 2026-11-03 — controller 0.350.0. Proven live on the test image of the same code (2026-11-03 night); a plain restore on Tester 1 on the release build ran clean, not the staged fault | `audits/security-2026-11-02/part3/`; `audits/release-2026-11-03/` `part1/restore-tester1.txt`; controller `c4b6844` |
+| **R-1348** | **A restore_mixed hold written at start-up sent no operator mail.** (P3) | CLOSED 2026-11-03 — controller 0.350.0. Proven live on the test image (the event with the R-1340 sentence reached the sink); the release build ran a plain restore, not the staged fault | `audits/security-2026-11-02/part3/r1348-after.txt`; controller `c4b6844`, `3764445` |
+| **R-1339** | **False „drive … not mounted" lines for per-app folders at every start.** (P4) | CLOSED 2026-11-03 — controller 0.350.0: nine false lines → none on the test image; 0 ERROR lines on the three boxes. The row's own fix was not built (it would write `userdata/` into app folders): only the false line goes | `audits/security-2026-11-02/part3/`; controller `c4b6844` |
+| **R-1351** | **FileBrowser's two start paths at boot raced: a false „Conflict" ERROR.** (P4) | CLOSED 2026-11-03 — controller 0.350.0, one lock. **Test proof only:** the race did not fire on six boots of either image, nor on this release's starts (0 ERROR lines). If it is seen again on ≥ 0.350.0, this row reopens | `TestR1351_*`; `audits/security-2026-11-02/part3/`; controller `c4b6844` |
+| **R-1323** | **„No such container" was logged as a false alarm that every app can still reach the file manager.** (P3) | CLOSED 2026-11-03 — controller 0.350.0. **Test proof only:** the file manager's image did not move on these starts | `TestR1323_*`; controller `c4b6844` |
+| **R-1302** | **A fresh install's agent logged ERROR „GRANT WAS MISSING … investigate the loss" at its first start.** (P4) | CLOSED 2026-11-03 — agent 0.172.0, vouched 10:18:10 CET. Staged live on a fresh box: a true first grant logs INFO „granted" and no R-190 line; a loss keeps the ERROR. Seen meanwhile: the appliance path pre-positions the grant, so a plain first start there logs neither; the ERROR was a BYO box's | `audits/release-2026-11-03/` `part3/r1302-live.txt`; agent `50eeccc` |
+| **R-1352** | **The restart mail arrived before the „does not answer" alarm of the same episode.** (P4) | CLOSED 2026-11-03 — hub 0.179.0, live since 09:05 CET. **Test proof only:** no controller stopped answering in the watch | `TestR1352_*`; `audits/release-2026-11-03/` `part4/`; hub `2f7e836f` |
+| **R-1331** | **Paperless-ngx 2.20.15 carried Python Brotli 1.1.0 (CVE-2026-111497).** (P3) | CLOSED 2026-11-03 — the big step 2.20.15 → 3.4.1 is pushed on the operator's yes (bench, 9202, undo proven); offered to every box | `audits/security-2026-11-02/bench/paperless-ngx/`, `walks/paperless-drill/`; catalog `f4c5c79` |
+| **R-1356** | **n8n kept three notices fixed only in 3.0.1 (`GHSA-9p7v` high, `GHSA-mx4r`, `GHSA-2x68`).** (P3) | CLOSED 2026-11-03 — the big step 2.46.4 → 3.0.1 is pushed on the operator's yes (bench, 9202, undo proven); offered to every box | `audits/security-2026-11-02/bench/n8n/`, `walks/n8n3-drill/`; catalog `f4c5c79` |
+| **R-1359** | **Two dependency fixes with no public id: Mealie v3.30.0 (`pillow`), Termix 26.11.0 (`body-parser`).** (P4) | CLOSED 2026-11-03 — normal steps pushed on the operator's yes (bench and 9202 proven) | `audits/security-2026-11-02/bench/{mealie,termix}/`, `walks/{mealie,termix}-drill/`; catalog `f4c5c79` |
 | **R-1334** | **Docker Hub's tag API refuses the watch (HTTP 429).** (P3) | CLOSED 2026-11-03 — the 2026-10-28 fix held: 0 Docker Hub 429 on five real nights and both runners. What looked like its failure was another cause (R-1303's streak): seven pins that can never be read, now a stated GAP, plus read timeouts, now retried. `failures` empty after run 2550 and the 03:40 night run | `audits/security-2026-11-02/part1/DIAGNOSIS.md`; `scripts/security_watch.py` W12, W15; felhom.eu `4afa8c3c` |
 | **R-1310** | **The security watch flags notices that do not apply and misses fixes that do.** (P3) | CLOSED 2026-11-03 — another program's package is not listed (`PACKAGE_NOT_OURS`), every GHSA a release names is its own entry, a word-only line is no ADVISORY (`WORD_ONLY`), `YY.MM.YYYYMMDD` tags are not newer; seerr was already repointed in the catalog. First catch: Traefik's GHSA-xv5x sat under a word-only line | W16, red first, 13 mutants; felhom.eu `4afa8c3c` |
 | **R-1336** | **ActualBudget had no release with the HTTP2Shell fix.** (P3) | CLOSED 2026-11-03 — 26.11.0 carries Node 24.22.1, read from the image; a `security_fix` step 26.9.0 → 26.11.0 proven on 9202, live | catalog `c760fca`; `audits/security-2026-11-02/walks/actualbudget/` |