incident: /var/log full from plexstreams polling a dead address

plexstreams was configured for http://192.168.31.2:32400, on the macvlan
shim subnet created in go for a Pi-hole that AdGuard replaced. Plex runs with
host networking on 192.168.10.20:32400. Each failed poll logged three PHP
warnings; 99,926 polls filled a 48 MB phplog, 99.95% of it those warnings.

Logging had been dead box-wide for six days: the last entry was written when
the filesystem filled, not when the errors stopped, so syslog for 28 Oct to
3 Nov is incomplete.

Config repointed and backed up, logs truncated rather than deleted so writers
holding them open reclaim space immediately. syslog left intact.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/CHANGELOG.md

@@ -13,6 +13,12 @@
 - **[SERVICE]** Exit node advertised from Unraid as a fallback to the hAP, and approved in the Tailscale admin console the same day. The tailnet now has two exit nodes: `mikrotik-tailscale` (100.74.219.35, primary) and `xtrm-unraid` (100.100.208.69, fallback). Neither has been exercised in anger from the Mac — without `--exit-node-allow-lan-access` an exit node cuts the client's own LAN access.
 - Detail, including the root-only `AllowTcpForwarding` behaviour in Unraid's stock sshd config, in `docs/09-TAILSCALE-VPN.md`.
 
+### Incident: /var/log full, plexstreams polling a dead address
+- **[INCIDENT]** `/var/log` found at 100% of its 128 MB tmpfs. The plexstreams plugin was configured for `http://192.168.31.2:32400` — the dead macvlan shim subnet created in `go` for a Pi-hole that AdGuard replaced. Plex runs with host networking and answers on `192.168.10.20:32400`. Every failed poll logged three PHP warnings from `simplexml_load_string()`; 99,926 polls between 10 Oct and 28 Oct produced 299,778 lines, 99.95% of a 48 MB `phplog`.
+- **[INCIDENT]** Logging across the box had been silently dead for six days — the last entry is 28 Oct 07:12, written when the filesystem filled, not when the errors stopped. Treat `syslog` for 2026-10-28 to 11-03 as incomplete.
+- **[SERVICE]** Fixed: `HOST`/`hostbox` repointed to `192.168.10.20:32400` with a matching alias, config backed up. Logs truncated rather than deleted (`syslog` left intact). `/var/log` 100% -> 35%, verified clean over four poll cycles. Detail in `docs/incidents/2026-11-03-var-log-full-plexstreams.md`.
+- Also seen in that log and **not** addressed: `appdata.backup` exhausting PHP's 256 MB limit 18 times, and a cosmetic `zfs.master` null-offset warning x130.
+
 ### Network: Tailscale SSH ACL set to accept
 - **[NETWORK]** Tailnet SSH policy changed from Tailscale's default `action: "check"` to `accept` for `autogroup:member` -> `autogroup:self`. Before the change the control plane minted ~12 h per-device grants and prompted for browser re-auth when they lapsed, which would stall any unattended connection. Effective policy is now a single rule: accept for all 10 tailnet nodes, no expiry, with local and remote port forwarding and agent forwarding allowed.
 - **[NETWORK]** Verified unattended with `BatchMode=yes`: a plain command over Tailscale SSH, a `-L` port forward (HTTP 302 from the Unraid web UI) and the Herdr fallback leg all ran without a prompt.