felhom.eu/REPORT-media-build-2026-10-15.md

Media build, 2026-10-15 — Plex gate, the 0.312.0/0.313.0 release train, media apps on every drive

What waits on you

1. Vouch golden 0.313.0, then raise the floor to 0.313.0. Hub → Configuration → Day-0 artifacts: golden 0.313.0, agent 0.156.1, min_agent 0.155.0, Save. Then a separate save: global floor 0.313.0, min_agent 0.155.0. (Golden 0.312.0 is baked too; 0.313.0 carries its https fix, so one vouch is enough.)
2. Hub 0.151.0 (a mail when a drive comes back): may I build and deploy it? Say „yes”.
3. One more Plex code (5 min): plex.tv/claim → save the code in ~/.felhom-demohp/plex-claim on DooPlex (chmod 600). The box claims the waiting Plex on demo-hp through its own Plex page at once.
4. Earlier, still open: remove „plex-k6” from your Plex account (plex.tv → Settings → Authorized Devices).

1. Plex — closed to strangers until set up? Code after start?

• Yes, on every controller: the live catalog's Plex has the setup gate (9a23ee5). Proven on demo-hp: a stranger over the internet or the home network gets only the gate; the household gets in.
• Code after start: yes, on controller 0.313.0. The wizard does not ask for it; the Plex page asks once Plex runs; the gate opens only when Plex itself says „claimed”, and „Kész” is refused before that (proven on demo-hp up to the code).
• Two security reviews of my catalog pushes found that older controllers could still open an unclaimed Plex. The code is required again for them. A status probe I tried to cover them opened an unclaimed Plex for about 26 seconds on the test box (Plex answers 401 while it starts). I removed it within minutes. The rest closes when the floor is 0.313.0.

2. https — released?

Golden 0.312.0 and 0.313.0 are baked and published. Not released until your vouch and floor. It runs today on Tester 1, demo-hp and demo-felhom (by hand, 2026-10-14).

3. Media apps on every drive — proven how

Controller 0.313.0 + the media_library marker. On Tester 1, after the move: every stored path, every library item, the watch marks and all 69 files identical. A new drive (Media D) was made ready in every app in one run; two more runs changed nothing. On demo-hp the live catalog linked Sonarr and qBittorrent by itself and Sonarr made a real hardlink. 13 hardlink pairs intact on Tester 1.

4. Drive added / pulled / back / safe removal — what the household sees

• Added or pulled or back: a notice on the storage page and the dashboard: which apps must restart, „Újraindítás most” (it asks again if something is playing) or „Később” (03:30), and per drive „restarted since: yes/no”. One click.
• Pulled: nothing lost; the file browser lets go of the drive. Back: the file browser shows it again at once.
• Safe removal: only that drive's torrents pause, every app lets go before the unmount, the drive stays known. When the disk comes back the box finds it by itself (7 s); after the restart the torrents seed again, no re-check. No household step.

5. Old installs

Sonarr/Radarr from before bc54c01 are repaired by themselves, no file moved (tested with the measured K7 sequence).

6. Prowlarr

Not done. The live catalog needs the full new-app checklist with a bench upgrade test and a box walk (about half a day). Prowlarr stays in the drill catalog; R-1048 stays open. I can do it next.

7. Claims in the prompt that turned out wrong

• A Plex setup_done_probe on /identity cannot work: Plex answers JSON only with an Accept header the probe never sent. And a status probe is unsafe (401 while Plex starts).
• „A small capped test drive” on demo-hp 9201: there is no free block device on demo-hp; the two-drive proof is Tester 1's.
• „ADVERTISE_IP: measure whether the apps find the server without it”: not measured (it needs a Plex app and your account); the template keeps it, per the 2026-10-14 measurement.
• „Agent change only if the controller cannot”: none was needed. But the agent reports a pulled registered disk as „attached”; presence is its backing device.

Found and fixed on the boxes (no row)

qBittorrent 5 logs in with HTTP 204; the drive gate raced a safe removal (false „returned”, then a „disconnected” mail); presence read from the agent's state. Each has a red-proved test.

Decisions recorded

09 §3 247 (bake first; supersedes 7), 248 (Plex through its own token), 249 (HSTS one day). The bake-first rule is in all five rule-file copies, CLAUDE.md, the manual-build and publish-train runbooks, and two memories.

Commits

felhom.eu: e0a5fe96 through 1ddf967b (decisions, Part A, goldens, Part G evidence, docs, register, STATUS). Controller: 331be17, 78c8942, f580d88, a09cab1 (qBittorrent 204), 37ffa3b (safe removal), 372d6e5 (Plex), f327bc5, cac92a4 (v0.313.0). Hub: 12552aca (v0.151.0, not deployed). Catalog: 0c67873, 9a23ee5, 0188430, b6986eb, 674d859 (probe, reverted), 0f1e78b. Drill: 6589376 + Plex copies. Agent: 7d4e564 (rule file). CI green by head_sha: felhom.eu 1838, controller 1836, catalog 1834, agent 1818.

Register

Before 163 · after 153 · opened 1 (R-1050) · closed 11 (R-1041, R-1046, R-1024, R-1026, R-1027, R-1031, R-1032, R-1037, R-1038, R-1044, R-1047). STATUS: 57 lines. unproven.py --summary: unchanged.

Teardown

Machines: demo-hp 9201 — the test Plex (gated, unclaimed, for item 3) stays until the claim, then removed; Sonarr and qBittorrent removed; controller rc.4 by hand. Tester 1: the rig stays (R-1022, Media D added to its list); controller rc.4 by hand. Host: demo-hp VM 341 has the 20 GB Media D disk (scsi5). Drill VM back to virgin. Hub: nothing changed.