R-1300 CLOSED: controller 0.345.1 (cloudflared 2026.10.3) on every box; R-1301 filed (N100 host clock, chrony fails at boot); 01: cloudflared follows Cloudflare's security notices

documentation/architecture/01-topology-and-trust.md

@@ -281,6 +281,13 @@ app. Controller down → the gated app answers an error, never the app. Measured
   tunnel. Since controller v0.286.0 it sits ALONE on the `felhom-tunnel` network at the fixed address `172.16.253.2`
   (traefik at `.3`), so traefik can believe forwarded headers from it and from nothing else (§5). Geo-restriction WAF
   is **hub-enforced** (the hub holds the CF API token; the controller only reports geo desired-state).
+  **Version and rule (2026-10-26, R-1300):** the image is `cloudflare/cloudflared:2026.10.3` since controller v0.345.1
+  (`infra.CloudflaredImage`). **cloudflared follows Cloudflare's security notices** — a notice is a patch release of
+  the controller, and a controller update recreates the container on the new image by itself
+  (`TestEnsureCloudflared_ANewImageRecreatesTheTunnel`). **Never turn off a certificate check to make an update
+  work.** The one check that is off today is the route's own: `*.<domain>` → `https://traefik` with `noTLSVerify`
+  (R-510; traefik shows its self-signed default certificate on a leg that never leaves the guest) — a recorded
+  exception, not a pattern to copy.
 - **[DESIGN] The website's content comes from Gitea IN-CLUSTER** (2026-10-19). The `felhom-webpage` pod pulls
   `website/` (from `main`) and `scripts/` (from the `installer-v…` tag, R-110) with four git-syncs that read
   `http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git` — plain HTTP, safe only because it never

documentation/architecture/11-os-updates.md

@@ -91,7 +91,7 @@ boxes installed. Nobody keeps a hand-written list.
 - **The Proxmox MAJOR upgrade** (PVE 9 → 10). It is a later step of its own, drilled first (R-808 item 5).
 - **`cloudflared` and the other infrastructure images** (traefik, filebrowser). **[FACT] (C8)** They are containers in
   the guest, pinned in the controller (`internal/infra/infra.go:26`: `cloudflare/cloudflared:2026.6.0`, since
-  2026-06-11 — *`2026.9.3` today, corrected 2026-10-24*) and baked into the golden; upstream was `2026.9.3` on 2026-10-04. They move only by a controller release
+  2026-06-11 — *`2026.9.3` from 2026-10-24; `2026.10.3` since controller v0.345.1, 2026-10-26 — Cloudflare's eMudhra notice, R-1300*) and baked into the golden; upstream was `2026.9.3` on 2026-10-04. They move only by a controller release
   — the app-image question (`09`), not an OS package. The gap is R-838.
 
 ---