PLAN.md: the whole-console sweep

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-13 17:56:16 -07:00
parent 285278abdb
commit 134bbc991e
1 changed files with 17 additions and 0 deletions
@@ -793,6 +793,23 @@ something long in one, switch away and back, refresh — it's all still there.
  empty file; the upload toast counted intentions; the viewer called a pipe a binary
  file. Not bugs, left alone: `rm -rf` of a mount point empties it (the console is
  root-capable by design); a folder of ten thousand rows is slow (no virtual list).
 - **Whole-console sweep** — **2026-10-13** (v0.1.0-216), asked for as "a full sweep of
  Ham Lab again, look for any bugs and fix them". Four nets, then reading: the Go race
  detector over the whole suite (clean), staticcheck's development build (the release does
  not know Go 1.26; it found only dead code and one capitalised error string), a
  garbage-in battery over every route safe to poke — 202 routes, bad identifiers, empty
  and malformed bodies, with the destructive ones held back — and a headless Chromium pass
  through all twenty tabs on the hub and on `grid`, collecting exceptions, console errors
  and failed requests (none). By hand: the auth middleware and sessions, token issue, the
  hub→node and KVM proxies, every validation regex before a shell, the cron and cron.d
  writers, config and state atomicity, every WebSocket and SSE loop's exit, the terminal
  manager, the task manager, and every destructive confirmation in the UI. Fixed, all
  small: docker inspect/health of a missing container was a 500 (404 now, a daemon that
  is down 503), `/api/virt/instances/{name}` without Incus was a 502 (409 like its
  siblings), a ZFS snapshot delete with a bad name was a 500 (400; 404 for one that does
  not exist), the task list read a task's Running flag outside its lock (a real data race,
  never seen), the Virtualization export config was written in place rather than
  atomically, and the dead code. Nothing in auth, the proxies or the shell boundaries.
 - **Docker read-only view** — `docker ps`/logs; dockhand stays the source of truth.
 - **Notifications** — push on service failure / SMART warning / UPS event.
 - **Terminal extras** — search, copy-mode, font/theme, split panes, upload via