LH025 daily checkpoint: 23 October 2026

Read: 17:42:08 to 17:42:13 UTC, 18 requests, with the study's own collector and analysis (--snapshot 2026-10-23); read log, summary. All five fixed tags returned a linux/amd64 manifest and configuration whose content digests verified. Written by a Claude Code driving session (Claude Opus 5.5).

Tag	Manifest digest since 22 October 06:30 UTC	Declared PHP	Hub push fields
`wordpress:php8.2-apache`	unchanged	8.2.35	unchanged
`wordpress:php8.3-fpm`	unchanged	8.3.36	unchanged
`drupal:10.6-php8.3-fpm`	unchanged	8.3.36	tag pushed again 22 October 21:55:59 UTC, same platform manifest
`nextcloud:apache`	changed, `b2de5476...` to `d4028b33...`	8.5.12	platform pushed 23 October 16:54:26 UTC, tag 17:18:47 UTC
`nextcloud:fpm`	changed, `68f26a79...` to `04b1167c...`	8.5.12	platform pushed 23 October 16:54:44 UTC, tag 17:18:50 UTC

Both Nextcloud tags now name new manifests, pushed about 50 minutes before this read, still declaring the fixed PHP 8.5.12. Between two daily reads, a changed digest bounds a pointer change; it does not say why the image was rebuilt (a Nextcloud release, a base-image change or a routine rebuild are all possible and none is read here), and an unchanged digest does not rule out a change and reversal in between. Drupal's tag push field moved while its manifest did not. None of this observes a pull or a running site. The 23 October PHP notice of a related flaw (studies/LH029) names no fixed version, so these declarations say nothing about it.