felhom.eu/documentation/audits/plex-demo-boxes-2026-10-23/README.md

# Plex to the fixed version on the demo/test boxes — 2026-10-23 (Plex2Shell)

Operator ruling 2026-10-23 10:56 (recorded in `CONTEXT.md`): move the catalog's Plex to the newest fixed version at once,
without the test record of `09` §3 decision 13, and put the demo boxes on it. DooPlex and ep0 were not touched; the
incident session handles DooPlex.

## The catalog move

- Catalog `6cc317d`: `plexinc/pms-docker:1.41.4.9463-630c9f557` → `1.43.5.11029-6bf8af3f0` (Docker Hub, pushed
  2026-10-20; manifest list `sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f`, re-resolved at
  start — still the newest plain `X.Y.Z.B-hash` tag; `public`/`beta`/`plexpass` moved on 2026-10-22 but carry no plain
  tag and are excluded). `catalog_since: "2026-10-23"`.
- Gates green: image-pins, catalog-since (range), test-record, image-resolvable (plex), `catalog_gates.py --fast plex`.
  `check-test-record-move.py --range ce33e3b..6cc317d` refused, as expected (verbatim in `app-catalog-felhom.eu/REPORT.md`).
  Pushed with `--no-verify`, that commit only.
- Read back from the box's catalog cache on demo-hp 9201 after one sync: the new tag, `catalog_since: "2026-10-23"`,
  HEAD `6cc317d`. The badge went to „Frissítés elérhető — ma" / „Update available — today" in 4.7 s.

## Which boxes run Plex

Hub `/hosts` (CC token, read only): four hosts — Tester4 (DOWN), demo-felhom, demo-hp, tester-1. The customer
**Tester 2 has 0 hosts**, so the operator's question was not needed. The hub's `/apps` page counts 2 Plex deployments;
the boxes say ONE runs it (a second channel: `docker ps -a` in every running guest):

| Box | Guest | Plex |
|---|---|---|
| demo-hp | 9201 | yes, 1.41.4.9463-630c9f557 |
| demo-hp | 9202 (scratch) | no |
| demo-felhom (N100) | 9201 | no |
| tester-1 (VM 341 on demo-hp) | 9201 | no |
| Tester4 | — | the hub host is DOWN and its VM no longer exists on demo-hp or felhom-pve (`qm list`); nothing to update. The hub's second Plex deployment is most likely this stale host's last report (not proven). |

## demo-hp 9201 — the signs check (before the update, read only) → **NOT-A-FINDING**

Scripts: `demo-hp-9201/signs.sh`, `demo-hp-9201/signs2.sh` (run inside the guest). Outputs, e-mail and token redacted:
`demo-hp-9201/signs-9201-before-update.txt`, `demo-hp-9201/signs2-9201-before-update.txt`.

| Sign | Result | Control |
|---|---|---|
| CPU, last days | whole guest 0.23–0.34 cores average of 7, max 1.04, per day 10-16 → 10-23 (PVE rrd, the HOST's channel). A miner would hold several cores flat. | — |
| Processes in the container | only s6, Plex Media Server, Plex Script Host, Plex Tuner Service | — |
| `xmrig`, `mylovelyminer`, `x12345`, `myawesomeproxy` anywhere in the guest | none | — |
| ELF files under `Codecs` | none (one file, `.device-id`; one empty codec dir from 2026-10-15) | the ELF test says ELF for `/usr/bin/docker`, not for `Preferences.xml` |
| ELF > 10 kB in the config volume newer than 2026-10-15 | none | same |
| Container layer (`docker diff plex`) | 80 entries, all s6 runtime under `/run` | — |
| `TranscoderH264Options` / `…Override` in `Preferences.xml` | absent | the attribute list printed (27 names) |
| Log lines `searchOne`, `/video/:/transcode/universal`, `?x=http…` | 0, 0, 0 | 633 `Request: [` lines in the same log |
| Open connections from the container | plex.tv / Cloudflare 443 and the box's traefik only | — |

**Limit, stated:** Plex keeps 6 rotated logs and restarted several times in the night, so the logs reach back only to
2026-10-23 00:32 UTC — not to 2026-10-16. The 10-16 → 10-22 window is covered by the CPU history and the files only,
not by the logs. The container was recreated at 04:39 UTC, so its layer has no history before that either.

## The update (the product's Update press, `POST /api/stacks/plex/update`)

`demo-hp-9201/update-press.json`: accepted 202; phases safety-dump → pulling → copying → verifying → done in 28.4 s;
no error, no hold. After (`demo-hp-9201/after-update.txt`):

- `/identity`: version `1.43.5.11029-6bf8af3f0`, `claimed: true`, the SAME `machineIdentifier` as before.
- Library: 0 sections before and after (this Plex never had a library; `demo-hp-9201/library-before-update.txt`). The
  server's identity and claim are what carried over.
- Box walk: every container healthy (traefik has no health check, up), none restarting; 0 `[ERROR]` and 0 `[WARN]` lines
  in the controller log since the press (control: 99 `[INFO]` lines in the same window); badge „Naprakész" / „Up to date";
  pinned = installed = catalog = live compose = the running container, all the new tag.

## The guide (Part 3)

The guide's labels were read from the new image's own web client (`WebClient.bundle/.../translations/hu.json`, plex-web
4.162.1; its keys are the English labels): Home/„Kezdőképernyő", Play/„Lejátszás", Scan Library Files/„Könyvtárfájlok
beolvasása", More/„Több", Fix Match/„Találatok pontosítása", Settings/„Beállítások", Manage Library Access/„Könyvtár
hozzáférés kezelése", and the FAQ's Video Quality/„Videó minőség", Original/„Eredeti" — all present, all equal
(`demo-hp-9201/guide-labels-1.43.5.txt`; ASCII-fragment controls: `beolvas` 5, `kezel` 26, `xqzzyw` 0). The box's own
Plex wiring (`POST /api/storage/media/wire`, the household's „connect now") answered `plex: unchanged`, no error, against
the new Plex (`demo-hp-9201/guide-wiring-after-update.txt`). **Not exercised:** the wiring's PUT that adds a new
drive's folder — this box has one drive and no library, so it had nothing to add. `guide.checked_version` moved.

## Teardown

- Machine: Plex stays on the new version (that is the goal). The helper scripts were removed from the guest and host.
- Host: nothing provisioned.
- Hub: nothing changed (reads only).