felhom.eu/REPORT-plex-2026-10-23.md

REPORT — Plex to the fixed version in the catalog and on the demo/test boxes (2026-10-23 day, Plex2Shell)

Plain words first.

• The catalog now gives Plex 1.43.5.11029-6bf8af3f0 (catalog 6cc317d, pushed without the update test, on your ruling).
• One box ran Plex: demo-hp. It showed no sign of the attack. CC pressed Update; it runs the new Plex now.
• You have one decision (D39): may a security fix reach the boxes at night without the full update test?

Per box

Box	Plex before → after	Signs check	Box walk
demo-hp 9201	1.41.4.9463-630c9f557 → 1.43.5.11029-6bf8af3f0	clean (NOT-A-FINDING; logs reach back only to 00:32 UTC today — CPU history and files cover 10-16 → 10-22)	green: all containers healthy, 0 errors, 0 warnings since the press
demo-hp 9202, demo-felhom 9201, tester-1 9201	no Plex	—	—
Tester4	hub host DOWN, VM gone	—	—
Tester 2	no host on the hub	—	—

Detail and evidence: documentation/audits/plex-demo-boxes-2026-10-23/README.md.

Records

• Register 184 → 186: opened R-1238 (P2, Plex has no test record or fixture), R-1239 (P2, a fast lane for security fixes — the operator's decision); closed none.
• CONTEXT.md: the 10:56 ruling. STATUS.md: decide row D39. No „broken" line: Part 2 was finished before the records were written, so the line the brief asked for would have been added and removed in the same commit. The „Updated" paragraph was left as the day session wrote it (it is that session's summary; this run adds one decide row only).
• Architecture read: 09-update-architecture.md §3 decisions 13 and 52; 13-threat-model.md (Plex row); runbooks/target-selection.md. Decision 13 is unchanged; no poster fact changed (none of the three poster actions).
• --no-verify was used ONCE, for catalog 6cc317d, on the ruling. The check-test-record-move.py refusal is verbatim in app-catalog-felhom.eu/REPORT.md.

Fixed without a row

• The memory index (.claude-memory/MEMORY.md, outside git) had grown to 201 lines / 25 735 bytes at 11:09 (another session), over the 200 / 25 600 ceiling, so instructions_gate failed and so did two script suites that run it. Lines 71–72 (two memories about the deleted credentials file, both superseded by sec) became one line: 200 lines, 25 590 bytes. repo_gates.py --fast then OK. The index sits right at the ceiling; the next added line trips it again.

Teardown

Machine: Plex stays on the new version; helper scripts removed from guest and host. Host: nothing provisioned. Hub: reads only.