Media drive events, night 2026-10-14: 15 §10 (event x app, measured), K4-K8 evidence, rows R-1044..R-1049, narrowed R-1022/1023/1024/1026/1028/1037/1038, night report

- 15-media-library.md §10: what the box does on each drive event, per app, with the measured call; the guards
  that ARE needed and the ones that are NOT (K1: nothing lost while a drive is gone).
- Evidence K4 (dead-drive check: mountinfo `shutdown`, stat unreliable), K5 (restart), K6 (unclaimed Plex),
  K7 (old Sonarr/Radarr repair on the bench), K8 (hub received the drive-return events and mailed none), K9 (files identical).
- nightly-rotation.md runs scripts/https_only_check.py first every night; scripts/CHANGELOG.md entry.
- STATUS, CONTEXT (decisions 244-246), REPORT-night-2026-10-14.md.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 2026-10-14 (night) — https_only_check.py: the box-walk check for „https only” (R-1033)
+
+- New `scripts/https_only_check.py`. Reads each box's public names from the box (traefik labels + dynamic files, the
+  script sent on stdin so the Go template's `$` survives ssh + pct), adds `felhom.<domain>` and one name that exists
+  nowhere, and asks `http://<name>/r1033-check?q=1` with no redirect following: 301/308 to the same https URL or the box
+  is convicted. A browser-like User-Agent (Cloudflare 403s Python's default — measured on the first run).
+- Controls every run: NEGATIVE — a local stub answering 200 must be convicted, or the run stops (exit 2); POSITIVE — the
+  first box's dashboard name must pass. Exit 0 / 1 / 2. Not a push gate (it needs the network and SSH). First run:
+  29 names on Tester 1, demo-hp, demo-felhom all OK
+  (`documentation/audits/https-only-2026-10-14/1B-4-box-walk-check.txt`).
+
 ## 2026-10-14 — build-hub.sh v1.24.0: refuses a stale or dirty tree (R-1021)
 
 - Fetches, then REFUSES (exit 1, naming the leftovers' home and the own-clone route) unless the tree is clean, the