felhom.eu/REPORT-plex-2026-10-23.md

# REPORT — Plex to the fixed version in the catalog and on the demo/test boxes (2026-10-23 day, Plex2Shell)

**Plain words first.**
- The catalog now gives Plex 1.43.5.11029-6bf8af3f0 (catalog `6cc317d`, pushed without the update test, on your ruling).
- One box ran Plex: demo-hp. It showed no sign of the attack. CC pressed Update; it runs the new Plex now.
- You have one decision (D39): may a security fix reach the boxes at night without the full update test?

## Per box

| Box | Plex before → after | Signs check | Box walk |
|---|---|---|---|
| demo-hp 9201 | 1.41.4.9463-630c9f557 → 1.43.5.11029-6bf8af3f0 | clean (NOT-A-FINDING; logs reach back only to 00:32 UTC today — CPU history and files cover 10-16 → 10-22) | green: all containers healthy, 0 errors, 0 warnings since the press |
| demo-hp 9202, demo-felhom 9201, tester-1 9201 | no Plex | — | — |
| Tester4 | hub host DOWN, VM gone | — | — |
| Tester 2 | no host on the hub | — | — |

Detail and evidence: `documentation/audits/plex-demo-boxes-2026-10-23/README.md`.

## Records

- Register 184 → 186: opened R-1238 (P2, Plex has no test record or fixture), R-1239 (P2, a fast lane for security
  fixes — the operator's decision); closed none.
- `CONTEXT.md`: the 10:56 ruling. `STATUS.md`: decide row D39. No „broken" line: Part 2 was finished before the
  records were written, so the line the brief asked for would have been added and removed in the same commit.
  The „Updated" paragraph was left as the day session wrote it (it is that session's summary; this run adds one
  decide row only).
- Architecture read: `09-update-architecture.md` §3 decisions 13 and 52; `13-threat-model.md` (Plex row);
  `runbooks/target-selection.md`. Decision 13 is unchanged; no poster fact changed (none of the three poster actions).
- `--no-verify` was used ONCE, for catalog `6cc317d`, on the ruling. The `check-test-record-move.py` refusal is verbatim
  in `app-catalog-felhom.eu/REPORT.md`.

## Fixed without a row

- The memory index (`.claude-memory/MEMORY.md`, outside git) had grown to 201 lines / 25 735 bytes at 11:09 (another
  session), over the 200 / 25 600 ceiling, so `instructions_gate` failed and so did two script suites that run it.
  Lines 71–72 (two memories about the deleted credentials file, both superseded by `sec`) became one line: 200 lines,
  25 590 bytes. `repo_gates.py --fast` then OK. The index sits right at the ceiling; the next added line trips it again.

## Teardown

Machine: Plex stays on the new version; helper scripts removed from guest and host. Host: nothing provisioned.
Hub: reads only.