resizing Azure VM - moved to D2asv5

There was a request to bump up the capacity of a Moodle instance for an in-person workshop on 12th and 13th. 

Used Chrome on Android to log in to the Azure portal, shut down the instance and size it higher (D2asv4 8 GB to D4asv5 16 GB).

When down-sizing it back, found that D2asv5 (<$41 per month) was cheaper than the original D2asv4 (<$46 per month). So, used D2asv5 8 GB instead.

app for automating sending of SMS / WhatsApp messages

This is what it does:

1. take the phone number from the clipboard

2. check if that number has an associated whatsapp account

3. If whatsapp account exists, create a preformatted whatsapp message to that whatsapp account - i.e. opens Whatsapp with the draft message, which the user can then send

4. creates an SMS draft too, in the default SMS app, which we can send if required.

Created with Claude in just one prompt - what I wanted initially, and the sequence of prompts, is at

https://github.com/hn-88/WAorSMS/blob/main/Prompt.md

and the one issue with the generated code and fix are at

https://github.com/hn-88/WAorSMS/issues/1

repeated Cloudflare "human check"

One of our content admins wrote,

For the past week (or so), each time we go to our website, and even click on a sub-page, etc, Cloudflare makes us check that we are human (not a bot). See screenshot attached. 

Do you experience this as well, or is it just me?

It is a bit annoying to do it for EVERY page. Is there a way to do it randomly, or at least once (so it knows this IP address is fine), etc.?

Another admin mentioned that 

I remember (another) website team making some changes to the Cloudflare settings following the phishing attacks and bot injection issues we faced on the (other) website. I believe the human verification check you are seeing could be related to those security measures.  

And I added,

I think one way to avoid getting the bot-check "every time" would be to keep a tab open with a page from our domain - then the session would remain open for around 10 minutes, and any other page in our domain you open within those 10 minutes will not ask you for a bot-check. If you are doing some content editing work which takes more than 10 minutes, if you navigate to another page in the open tab within 10 minutes or refresh that page within 10 minutes, you can avoid the bot-checks.

logo update for sign-in with Google screen

One of our CMS admins mentioned that the 'Sign in with Google' screen still displays the old logo, and that it needed to be replace with the new logo of the organization.

The process according to Claude was,

1. Go to Google Cloud Console → select your project.
   
   
2. Navigate to APIs & Services → OAuth consent screen (in newer UI it may be under APIs & Services → Branding).
   
   
3. Under the App information section, you'll see an App logo field — upload your logo there (square image, recommended 120x120px, max 1MB, JPG/PNG/BMP).
   
   
4. Save changes. 

I had to find the account under which the project had been created from our old emails - there is no way to easily find the email id under which the project was created from the project id which is present in the php code. But Claude says that the Super Admin for Google Workspace can give themselves the permissions in order to get this info, but I did not try it. Private URL for my reference, https://claude.ai/chat/5e521ed1-ec1a-4301-8c89-f7a21939b6e1

Claude's review of swayam plus integration local plugin for Moodle

Created a wiki page at https://github.com/hn-88/swayamplus-sso-api-integration/wiki

and populated it with Claude's comments during its review of code for this plugin which had been generated by Gemini in a single prompt.

Private URL for my reference, https://claude.ai/chat/12096022-e224-4e6b-9e01-40149a93cef7

Google Maps Street View video

Private URL for my reference - https://claude.ai/chat/859a7468-53e7-4e90-96ce-deca9ab6f363

Claude was happy to write code for me when I prompted, "If it is feasible, please write a google apps project which will work with google street view, capturing street view images between two points which the user chooses, and exporting the images as a video journey between the two places on the map similar to what is seen by a dashcam on a car. If not feasible, please suggest alternatives."

But the code requires a project with billing enabled, apparently it does not work with the demo api key provided at https://developers.google.com/maps/demo-key

So, pivoted to making screenshots of the google.com/maps page open in street-view instead - tested using SikuliX IDE 2.0.5 from https://github.com/oculix-org/SikuliX1/releases/download/v2.0.5/sikulixide-2.0.5-linux.jar

Points to note - the delay needs to be more than 5 seconds for me, the images load quite slowly. Alt+Shift+C to abort the SikuliX task.

ffmpeg -framerate 1 -i frame_%04d.png -vf "scale=trunc(iw/2)*2:trunc(ih/2)*2,minterpolate=fps=10:mi_mode=blend" -c:v libx264 -pix_fmt yuv420p journey.mp4

for frame blending, but a timelapse style with more frames per second would probably be needed for longer journeys. The scaling is because the libx264 codec needs even numbered pixel counts for width and height, which may not be guaranteed when choosing a rectangle onscreen.

https://github.com/hn-88/repeated-screen-capture

debugging and testing local Moodle plugin with Claude

Private URL for my reference - https://claude.ai/chat/12096022-e224-4e6b-9e01-40149a93cef7

Used Claude to debug (add missing version.php, and many other omissions) the local plugin for swayamplus api integration generated by Gemini - github repo at https://github.com/hn-88/swayamplus-sso-api-integration. Also added some features like retry logic and test url generation.

The readme file has some info about how ngrok was used for testing with a mock python server - https://github.com/hn-88/swayamplus-sso-api-integration/tree/main/test-python-api-server

Some points to note:

1. The plugin uses the "Manual enrolment" enrolment method, which is enabled by default on all courses - we can see the enabled methods by going to the relevant course > Participants > Enrolled users (dropdown) > Enrolment methods. 
   
   
2. Guest access should probably be removed from the same place as above, in case enabled earlier.
   
   
3. Currently the classes/privacy/provider.php is not implemented, so the mdl_local_swayamplus_enrol table is not updated by deleting rows if / when users are deleted.
   
   
4. If the user is already present on our system, they are directly enrolled in the course.
   
   
5. If the user is new to our system, the user is dropped into the profile completion and agreement to terms and conditions workflows. Following that, the user is actually enrolled in the course automatically, but dropped into their Profile page. According to Claude, we can add a large link to "My Courses" in the Profile page as follows: 
   1. Go to any page where you can add a block sitewide — the Front Page is the standard choice. Turn editing on.
   2. Add a block → HTML.
   3. Give it a title (e.g. "Continue learning") and content — something like a large, bold link:

      <p style="text-align:center;">  
      <a href="https://ourdomain.org/my/courses.php"     
      style="font-size:1.4em; font-weight:bold; 
      display:inline-block; padding:10px 20px;">
      → Go to My Courses  </a></p>
      

   4. On that block's own settings (gear icon → Configure), under "Where this block appears" → Page contexts, set it to "Display throughout the entire site." Save.
   5. Now navigate to any user's profile page — your own is fine. The block should appear there too (since you just made it sitewide). Open that same block's settings again, and this time change "Display on page types" to "Only user profile pages." Save.

   
   

network problems were due to overheating SFP module

On two consecutive days, internet at the Planetarium went down at around 9 am, working fine before that. The network folks tried sending light down the fiber, it was fine. But the SFP module in the media converter at our end was very hot. They swapped out the media converter, and the network started working again. 

avidemux on Mac - default settings are fine

Verified that with the default settings on Avidemux 2.8.2 compiled for ARM on Mac,

MPEG4 ASP (xvid4) video and AC3 lav audio work for playout on the DVD player, 1920x1080.

For 4K - 3840x2160 - the Videotoolbox HEVC default settings are 2000 bitrate and 4000 max bitrate, which can be increased to 5000 bitrate and 8000 max bitrate to be on par with the settings in python-ffmpeg-warp.

investigating lack of referrals

The Moodle plugin in this previous post was not reporting any referrals for the month of August. Investigating, found that

1. In the new site (swayamplus.education.gov.in redirected from swayam-plus.swayam2.ac.in) login is via email sent to our email id, and my previous email registration doesn't seem to work. Maybe because I had unsubscribed from course alerts?
   
   
2. After logging in with a fresh email, found that swayamplus is no longer adding a referer id to the course URL. There is no &ref=ABC123 part in the URL.

Since they are not sending referral IDs, we cannot report what they don't send!

Moodle server error alert - due to .jpeg extension

One of our Moodle admins reported that

trying to add a content update. I keep getting this error: "servererror,moodle". What could be the problem?

I asked for the URL, and what he had been trying to do. Apparently, the issue was with adding image files with .jpeg extension in a rich-text box. When I renamed the files to .jpg and added them to the box, there was no error. 

creating m3u playlists with Claude

Tried out creating new playlists for playout in Kodi atop LibreElec on Raspberry Pi 4, using Claude instead of manually copy-pasting filenames. Perhaps a time saving of half-an-hour or so? Private URL for my reference at https://claude.ai/chat/cf6e6881-2424-4a24-a1a7-ed38bc9b4942

Uploaded a playlist and prompted

Just like this playlist, please create a playlist called U055newname.m3u where the items #EXTINF:0,1.mp4
 /var/media/1.mp4
 #EXTINF:0,2.mp4
 /var/media/2.mp4
 #EXTINF:0,3.mp4
 /var/media/3.mp4
 are replaced by the files

/var/media/4.mp4
 /var/media/5.mp4
 /var/media/6.mp4
 /var/media/7.mp4

and the appropriate EXTINF lines.

Claude did catch some typos I had made, and double-checked some files, like

Note the last item keeps its .mp4 extension (matching what you specified: only.mp4), unlike the ENG version which was .avi. Let me know if that should also be .avi.

Also asked Claude to create a python script with the prompt

Now, please write a python script to check each m3u file in the current directory if it has all these items as the first few items of the playlist,

(lines of playlist pasted here)

(for playlists which have TEL in the name)

and if any items are missing, to add them in this order.

Similarly, for m3u files with 3lang or ENG in the name, 

(lines of playlist pasted here)

and for playlists with HIN in the name, 

(lines of playlist pasted here)

which worked well - I have uploaded to the private repo upstairs-Kodi-playlists

dotnet api timeouts and action taken

The developers on one of our apps noted that 

The API is intermittently failing, and we are seeing a CORS error in the browser Network tab.

Claude noted that the CORS error is misleading, and it is probably because of a backend API timeout. 

this is almost never an actual CORS policy misconfiguration — it's the browser's error message for "the actual response didn't carry an Access-Control-Allow-Origin header," which happens whenever the request fails or errors out before your CORS middleware gets a chance to run. Since it's intermittent, that's your biggest clue.

Since a lot of bot traffic was seen looking for Wordpress files, they requested blocking those bots which look for non-existent Wordpress files.

Taking Gemini's advice, 

1. Disabled php on the api server, since it's not required by our services - 

sudo a2dismod php8.3

sudo systemctl restart apache2

2. Added one more firewall rule to Cloudflare, the URL being like

ourdomain.org/security/security-rules

(http.host contains "ourdomainname" and http.request.uri.path contains "wp-") or (http.host contains "ourdomainname" and http.request.uri.path contains ".php")

then Block

All of your Google Play apps have been successfully registered

There was an email from Google saying that Android apps in the Play store (and outside) need to be registered, and we need to register keys if we are signing outside the Play Store.

One of our apps was being signed outside the Play Store, so in the URL

play.google.com/console/u/6/developers/android-developer-verification

clicking the arrow against that app, it asks us to add the public key.

To find the public key,

https://support.google.com/googleplay/android-developer/answer/16641489

where I'm using this method in a github action,

      - name: Extract SHA-256 fingerprint only

        run: |

          BUILD_TOOLS="$ANDROID_HOME/build-tools/34.0.0"

          "$BUILD_TOOLS/apksigner" verify --print-certs app-release.apk \

            | grep -i "SHA-256"

I clicked on Add Key and added the digest, at first it showed Pending verification, in 10 minutes it showed verified.

Here is part of Gemini's reply on why this key is needed - 

To ensure your app functions flawlessly whether it is downloaded from the Play Store, sideloaded by a QA tester, or downloaded directly from your website, your backend services (Firebase, Google Cloud, etc.) should always have both fingerprints registered:

1. The Google Play App Signing SHA-256 (found in Play Console -> Release > Setup > App Integrity).
2. Your Local Keystore SHA-256 (the one generated from yourkey.keystore).

major changes needed for Moodle app

I asked Gemini 3.1 Pro Preview via aistudio.google.com -

Does the Moodle Android App at https://github.com/moodlehq/moodleapp support optimization using R8?

Gemini said, in short, "The short answer is no, not out of the box. The Moodle App is optimized using Angular/JS minification tools (Terser/Webpack) rather than Android's native R8. You should not enable R8 in the Moodle App's Android build configuration, as it will likely break the bridge between the app's JavaScript and native Android plugins."

Then, I asked, 

Then how can this app (and other similar cordova apps) meet the upcoming quality requirements in https://android-developers.googleblog.com/2026/08/app-quality-memory-optimization-secure-onboarding.html ? The play store quality check tool seems to mandate R8 optimization.

Gemini's answer is pasted below.

The recent Google Play announcement from August 2026 (enforcing new memory and

code optimization standards by February 2027) definitely changes the landscape

for hybrid frameworks like Cordova, Capacitor, and Ionic, which power apps like

Moodle.

According to the new Google Play requirements, apps must have a minimum of 25%

coverage across optimization, shrinking, and obfuscation for their native DEX

code using R8 (or a similar tool), and they must stay below strict memory/bitmap

thresholds.

Here is how the Moodle app, and Cordova apps in general, can meet these upcoming

requirements without breaking their architecture:

1. Hitting the 25% R8 DEX Coverage Rule

While blindly enabling R8 (minifyEnabled true) breaks the Cordova JS-to-Native

bridge, it can be enabled safely if properly configured. To meet the 25%

threshold, Cordova apps do not need to obfuscate their entire codebase; they

just need to shrink enough of it.

  - Targeting Heavy Dependencies: In a standard Cordova app, the actual Cordova

    wrapper code and plugins make up a very small percentage of the compiled

    .dex (native Android) file. The vast majority of the native code comes from

    heavy dependencies like AndroidX libraries, Google Play Services, Firebase,

    and other third-party native SDKs.

  - Targeted ProGuard/R8 Rules: Developers will need to enable minifyEnabled

    true but use a highly specific proguard-rules.pro file. They will use

    aggressive -keep rules to protect the Cordova framework (-keep class

    org.apache.cordova.** { *; }) and plugin reflection methods so the app

    doesn't crash.

  - By allowing R8 to shrink and dead-code-eliminate the massive AndroidX and

    Google Play Services libraries while leaving the Cordova bridge alone,

    hybrid apps can easily surpass the 25% optimization threshold required by

    Google Play.

2. Meeting the Dynamic Memory & Bitmap Thresholds

The new requirements aren't just about R8; they strictly monitor dynamic memory

and background bitmap usage. This is actually the bigger challenge for Cordova

apps because they run inside an Android WebView, which is notoriously

memory-heavy.

To prevent the Play Store from penalizing or down-ranking the app, hybrid apps

will have to aggressively optimize their web layers:

  - Background DOM Management: The Moodle Angular app will need to actively

    destroy heavy DOM elements (like large course lists or forums) when the app

    goes into the background, replacing them with placeholders to free up RAM.

  - Bitmap/Image Eviction: The WebView caches images heavily. When the user

    navigates away from an image-heavy course, the app must ensure the WebView

    releases those bitmaps from memory rather than keeping them cached in

    non-visible states.

  - Garbage Collection: Relying more heavily on WeakReferences in JavaScript and

    ensuring Angular observables are cleanly unsubscribed to prevent memory

    leaks in the Node/V8 engine powering the WebView.

3. Implementing the "Zero-Tap Sign-In" (Device Migration)

The blog post also mandates the adoption of the Android Restore Credentials API

for seamless device migration. For the Moodle app, this means updating the

native Android authentication plugins to hook into Android's Credential Manager

API. Instead of relying solely on standard web cookies or isolated local

storage, the app's native layer will need to back up the user's secure token so

that if a student buys a new phone, Moodle logs them in automatically.

The Path Forward for Moodle (and Cordova)

Because the enforcement deadline is February 2027, framework maintainers have

several months to react. You can expect the following to happen across the

ecosystem:

1.  Upstream Updates: The Apache Cordova and Ionic Capacitor teams will likely

    push updates to their Android build templates that include safe, boilerplate

    proguard-rules.pro files out of the box.

2.  Plugin Consumer Rules: Native plugin authors will increasingly embed

    consumerProguardFiles in their Gradle setups. This tells R8 exactly what to

    preserve automatically, taking the burden off the app developer.

3.  Moodle HQ Patches: For the Moodle app specifically, Moodle HQ will update

    their build pipeline before the 2027 deadline. If you are compiling your own

    custom version of the Moodle app, you should wait for Moodle HQ to release

    their compliant ProGuard configurations rather than trying to force R8 on

    your own today.

recovering h5p activites after mod_hvp bug on Moodle

This was noticed on July 24th - lots of pages on our Moodle instances were showing "The version of the H5P library H5P.Column used in this content is not valid. Content contains H5P.Column 1.18, but it should be H5P.Column 1.22."

At that time, I replied that, according to Gemini, this is a known H5P bug - https://github.com/h5p/moodle-mod_hvp/issues/632 - and the H5P core development team is actively working on a fix (Pull Request #633) - https://github.com/h5p/moodle-mod_hvp/pull/633

Gemini private URL for my reference - https://aistudio.google.com/prompts/1Ddl2aYqln8Y8wTIPtlLXG_8Fipeay_5F

Unfortunately, the next version of mod_hvp Moodle plugin was released, but it only had code to prevent such errors in future, but it did not automatically fix the existing problems.

So, took the help of Gemini again, and took steps to fix our Moodle instances. Private URL for my reference - https://aistudio.google.com/prompts/1LJYJaO3R8mjgpsd3w67TDlACd3Ni8JhL

Workflow was:

0. First download a "good copy" of the database backup - Since the buggy mod_hvp was released after Feb 2026, my choice was the backup of 22 Feb 2026. Unfortunately, this backup was 500+ MB as a .sql.gz file, where the logstore_standard_log table had not yet been cleaned up. Setting up this database on my local machine took 4+ hours for the database import. Private URL for my reference - https://chatgpt.com/c/6a8d13c5-1988-83ee-816b-082af1f2a874

sudo apt install mysql-client (was already installed)
sudo apt install mysql-server

systemctl status mysql

sudo mysql

CREATE DATABASE restore_test CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
quit;

zcat your_backup.sql.gz | sudo restore_test

(this took 4+ hours - should probably have done the gunzip separately? Also, 11+ GB database at /var/ from a 9+ GB sql file - sudo du -sb /var/lib/mysql/restore_test)

sudo mysql

CREATE USER 'myuser'@'localhost' IDENTIFIED BY 'your_password_here';

GRANT ALL PRIVILEGES ON restore_test.* TO 'myuser'@'localhost';

FLUSH PRIVILEGES;

Then to fix "Public Key Retrieval is not allowed" error in DBeaver, right-click to edit the connection, 

Go to Driver Properties.

Modify the properties,

allowPublicKeyRetrieval to true

useSSL to false

Then, by using a different port in a tunnel to the remote database, we can copy and paste data with DBeaver.

1. Fix the main library reference (e.g., Column or Interactive Book containers):

UPDATE vv_hvp h

JOIN vv_hvp_libraries old_lib ON old_lib.id = h.main_library_id

JOIN vv_hvp_libraries new_lib ON new_lib.machine_name = old_lib.machine_name

  AND new_lib.major_version = 1 AND new_lib.minor_version = 22

SET h.main_library_id = new_lib.id, h.filtered = NULL

WHERE old_lib.machine_name = 'H5P.Column'

  AND old_lib.major_version = 1 AND old_lib.minor_version = 18;

Updated rows 0

2.  Fix nested library references

UPDATE vv_hvp 

SET json_content = REPLACE(json_content, 'H5P.Column 1.18', 'H5P.Column 1.22'),

    filtered = NULL

WHERE json_content LIKE '%H5P.Column 1.18%';

UPDATE vv_hvp 

SET json_content = REPLACE(json_content, 'H5P.InteractiveVideo 1.27', 'H5P.InteractiveVideo 1.28'),

    filtered = NULL

WHERE json_content LIKE '%H5P.InteractiveVideo 1.27%';

Updated rows 7

3. Recovering "Wiped" Activities (Data Loss)

SELECT id, name, course FROM vv_hvp WHERE json_content LIKE '%"content":{"params":{}}}%';

37 rows on our instance.

4. Fixing one of the data-missing json-content fields - 

SELECT json_content FROM vv_hvp WHERE id = 30851 (from the backup)

to find the current libraries, look for H5P string in the json, 

and add to the ones below.

SELECT machine_name, major_version, minor_version

FROM vv_hvp_libraries

WHERE machine_name IN (

    'H5P.Video', 

    'H5P.MultiChoice', 

    'H5P.AdvancedText',

    'H5P.InteractiveVideo',

'H5P.Column',

'H5P.Image',

'H5P.CoursePresentation'

)

ORDER BY machine_name, major_version DESC, minor_version DESC;

Only had to find/replace CoursePresentation version, others had current versions. Then pasted the "corrected" json content in the same field of the live database.

5. Run a find/replace on the entire live database - starting first with one course,

UPDATE vv_hvp 

SET json_content = REPLACE(json_content, 'H5P.Column 1.18', 'H5P.Column 1.22'),

    filtered = NULL

WHERE course = 606 

  AND json_content LIKE '%H5P.Column 1.18%';

Updated rows 42.

Update main library id just in case.

UPDATE vv_hvp h

JOIN vv_hvp_libraries old_lib ON old_lib.id = h.main_library_id

JOIN vv_hvp_libraries new_lib ON new_lib.machine_name = old_lib.machine_name

SET h.main_library_id = new_lib.id, 

    h.filtered = NULL

WHERE h.course = 606

  AND old_lib.machine_name = 'H5P.Column'

  AND old_lib.major_version = 1 

  AND old_lib.minor_version = 18

  AND new_lib.major_version = 1 

  AND new_lib.minor_version = 22;

Updated rows 0.

Then, did for all courses,

UPDATE vv_hvp 

SET json_content = REPLACE(json_content, 'H5P.Column 1.18', 'H5P.Column 1.22'),

    filtered = NULL

WHERE json_content LIKE '%H5P.Column 1.18%';

Updated 221.

Then asked Gemini if this can be automated for data recovery for the 30+ instances of data loss - private URL for my reference -
 https://aistudio.google.com/prompts/14Bv6L5AfaOglFuUY_VJZ6F7A1cchR-FQ

That resulted in the python scripts at https://github.com/hn-88/fix-hvp/

which seem to have fixed all the data-loss in this instance.

Then, a new problem was reported on another Moodle instance - youtube videos were playing with audio only, and black screen. Putting that in a separate post here.

Moodle H5P Interactive video playing only audio with black screen

It was reported that all the H5P Interactive video activities on one of our Moodle instances were only playing audio, no video visible, black screen instead. My initial reaction was that this seemed to be another symptom of the mod_hvp bug which had prevented activities from being updated as per the previous post. But the fix in this case was slightly different.

Private URL of chat with Gemini for my reference - https://aistudio.google.com/prompts/1sowy1kk_uVUetNXh2Og3WBgVcfGQ-lQy

The query

SELECT machine_name, major_version, minor_version

FROM vv_hvp_libraries

WHERE machine_name IN (

'H5P.Video',

'H5P.MultiChoice',

'H5P.AdvancedText',

'H5P.InteractiveVideo',

'H5P.Column',

'H5P.Image',

'H5P.CoursePresentation',

'H5P.Summary'

)

 had this response.

H5P.AdvancedText 1 1

H5P.Column 1 13

H5P.Column 1 17

H5P.Column 1 18

H5P.CoursePresentation 1 22

H5P.CoursePresentation 1 24

H5P.CoursePresentation 1 25

H5P.CoursePresentation 1 26

H5P.Image 1 1

H5P.InteractiveVideo 1 22

H5P.InteractiveVideo 1 24

H5P.InteractiveVideo 1 26

H5P.InteractiveVideo 1 27

H5P.MultiChoice 1 14

H5P.MultiChoice 1 16

H5P.Summary 1 10

H5P.Video 1 5

H5P.Video 1 6

Gemini said, If you replace 'H5P.Column 1.18' with 'H5P.Column 1.22', Moodle's H5P renderer will look for H5P.Column 1.22 in vv_hvp_libraries, fail to find it, and throw a fatal error. H5P.Column 1.22 is not installed on this instance. 

Primary cause - Outdated H5P.Video Library vs. YouTube Player Changes. Check with

SELECT id, machine_name, major_version, minor_version, patch_version 

FROM vv_hvp_libraries 

WHERE machine_name IN ('H5P.Video', 'H5P.InteractiveVideo')

ORDER BY machine_name, major_version, minor_version;

If H5P.Video 1.6 is below 1.6.67, updating the library will resolve the issue - and gave this thread as the reference,

https://moodle.org/mod/forum/discuss.php?d=482329&parent=1909904

which was discussing the exact same issue.

After some trial and error, the correct solution was:

1. In the Moodle server's config.php, add this line near the bottom before require_once(...)
$CFG->mod_hvp_dev = 1;

2. Download link: https://hub-api.h5p.org/v1/content-types/H5P.InteractiveVideo (save the file as InteractiveVideo.h5p)
3. Go to https://your-moodle-domain/mod/hvp/library_list.php

(Or navigate via UI: Site Administration > Plugins > Activity modules > H5P > H5P Libraries)
and upload the saved InteractiveVideo.h5p in the Upload Libraries box.
4. Verify that the new version is installed with the query 

SELECT id, machine_name, major_version, minor_version, patch_version 

FROM vv_hvp_libraries 

WHERE machine_name = 'H5P.Video';
5. Now in mod/hvp/library_list.php we see Interactive Video (1.27.9) listed, and also a green button at the right to "Upgrade library content". Click on the upgrade library content button to automatically fix all the interactive videos on the site. The page goes to 100% with AJAX updating in less than 30 seconds.
6. Purge caches (sudo php admin/cli/purge_caches.php on CLI ) and test one of the videos to see if it is OK
7. Restore the config.php by commenting out the mod_hvp_dev line we added.

tests of mid-tones brightness reduction on planetarium dome

Tried out reduction of mid-tones using Blender, for reducing the washed-out over-exposed look due to dome reflections. 

For individual textures in a 3D scene, add a RGB Curves node after the texture in Shader Editor. In Blender VSE (Video Sequence Editor), we can add via "Add" menu, choose "Effect Strip," and select "Color" followed by "RGB Curves."

On the M4 Mac Mini, 3840x2160 renders were proceeding at nearly 10 fps from Blender VSE. The output of that was probably not playable smoothly on Raspberry Pi, so ran it through Avidemux with Videotoolbox (GPU assisted) HEVC codec, the default bitrates of 2000 kbps avg and 4000 kbps max are quite low, but quality is fine for simple scenes.

NAVK preferred the previous version of "Unseen Earth" in which I probably either put a mask over the bright parts or left as is - when I reduce mid-tones again, the scene becomes too dark for him. Probably I can redo the overexposed parts of "The Search" with this technique.

Cloudflare Origin Server Certificate for Wordpress instance on Hostinger

After chatting with Hostinger support, the following is the reply.
"Yes. Your WordPress instances on Premium Web Hosting support custom SSL certificates on their virtual hosts"

(Copy-pasting from an email exchange).

So, we could install the cloudflare origin server certificate as per the procedure at https://www.hostinger.com/support/1583785-how-to-install-a-custom-ssl-in-hostinger/ 

Doing this has both Pros and Cons. 

 The pro is that then we can be sure of the certificate being valid for Cloudflare - unlike the letsencrypt certificate currently present, which would need updating every three months. 

 The con is that once the cloudflare origin server certificate is installed, you can only access the wordpress site through cloudflare (or you would get a scary "certificate not trusted" message) and you would be limited by cloudflare's file upload and timeout limits.

(The team opted to not use Cloudflare Origin Certificates.)

removed defunct DNS records

After an email the previous day to verify that none of these services need to be kept, deleted a handful of defunct DNS records from a couple of our domains. One was an MX record which was not active since the migration to Google Workspace in 2019.