Virtualization plan: capability-gated per machine, never policy-gated; Install or report

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

PLAN.md

@@ -20,6 +20,7 @@ stub tab or a roadmap item.
 | Repo | Gitea `mitchell/hamlab`, private, `main` | Created 2026-09-17. |
 | Guest logins | A **guest** is an account like any other, with `guest: true` and an expiry: `login`, sessions and prefs need no special case, and **it may do everything an account may do**. The expiry is the whole feature — checked on every request and swept once a minute — with revoking as the manual version of it. | Built 2026-09-27. A read-only version was built first and **cut the same day**: Mitchell hands these to people he trusts and revokes them otherwise, so a console with half its tabs missing was solving a problem he doesn't have. Consequences, stated once and accepted: a guest has the Terminal tab, which is a root-capable shell on every host, and can make an account or token of its own that outlives the guest login. The one thing a guest is not is *an account*: it is left out of the Users list, out of "the last account can't be removed", and out of the single account an empty user name resolves to. |
 | Machines | **A view shows one machine: the one in the switcher.** No hub-side page lists or aggregates what its nodes are doing. To see or change anything on another machine, switch to it. | Mitchell, 2026-09-25, cutting a fleet-wide updates list out of the Docker tab. The switcher is the only place a machine is chosen, so there is exactly one answer to "which machine am I looking at" — a page that quietly reaches across breaks that, and it is never obvious which machine an action would land on. The hub still *proxies* for a node, and hub-only admin (Machines, Users, Settings, Alerts) is unaffected. |
+| Capability, not policy | **A tab offers what the selected machine can do, detected live — never what a rule says should run there.** Where the software is missing but installable, Ham Lab installs it; where it cannot be installed or the hardware lacks it, the tab says so in a sentence and offers what does work. Every action lands on the machine in the switcher. | Mitchell, 2026-10-09, after the Virtualization plan's first draft excluded the Mac mini and `hamtv` on the strength of `hamlet/CLAUDE.md`'s deployment rules: *"I want the option to do it anywhere I want, unless the hardware / software literally doesn't support it. Ham Lab needs to be built in a general-purpose way that can run on any Linux system."* Those rules bind the agent's unasked deployments, not the product. |
 
 ## Layout
 
@@ -786,11 +787,13 @@ what it has moved.
     free.
 
 - **A Virtualization tab** — asked for 2026-09-23; **scoped 2026-10-09 in `VIRTUALIZATION.md`**,
-  not started. Incus 6.0 LTS on `grid` (the only sensible VM host), containers and VMs in one
-  list with console/shell through the terminal machinery, snapshots, exports, and the old
-  Proxmox estate on `tank` as a later import. That file has the host probe, the decisions
-  (NVMe pool, `192.168.200.0/24` bridge because the LAN is a /8, the Docker `FORWARD` fix,
-  ARC cap) and the phased build.
+  not started. Incus 6.0 LTS as the engine; the tab detects per machine whether Incus is
+  running, installable, or unavailable, and whether KVM is there, and acts on the machine in
+  the switcher — never a default host. Containers and VMs in one list, console/shell through
+  the terminal machinery, snapshots, exports, and the old Proxmox estate on `tank` as a later
+  import. That file has the probe of every host, the per-machine layout Ham Lab computes
+  (pool driver, a bridge subnet that avoids the LAN's /8 and Docker's pools, the Docker
+  `FORWARD` fix) and the phased build.
 
 
 ## Open questions