PLAN.md: the whole-console sweep

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

PLAN.md

@@ -793,6 +793,23 @@ something long in one, switch away and back, refresh — it's all still there.
   empty file; the upload toast counted intentions; the viewer called a pipe a binary
   file. Not bugs, left alone: `rm -rf` of a mount point empties it (the console is
   root-capable by design); a folder of ten thousand rows is slow (no virtual list).
+- **Whole-console sweep** — **2026-10-13** (v0.1.0-216), asked for as "a full sweep of
+  Ham Lab again, look for any bugs and fix them". Four nets, then reading: the Go race
+  detector over the whole suite (clean), staticcheck's development build (the release does
+  not know Go 1.26; it found only dead code and one capitalised error string), a
+  garbage-in battery over every route safe to poke — 202 routes, bad identifiers, empty
+  and malformed bodies, with the destructive ones held back — and a headless Chromium pass
+  through all twenty tabs on the hub and on `grid`, collecting exceptions, console errors
+  and failed requests (none). By hand: the auth middleware and sessions, token issue, the
+  hub→node and KVM proxies, every validation regex before a shell, the cron and cron.d
+  writers, config and state atomicity, every WebSocket and SSE loop's exit, the terminal
+  manager, the task manager, and every destructive confirmation in the UI. Fixed, all
+  small: docker inspect/health of a missing container was a 500 (404 now, a daemon that
+  is down 503), `/api/virt/instances/{name}` without Incus was a 502 (409 like its
+  siblings), a ZFS snapshot delete with a bad name was a 500 (400; 404 for one that does
+  not exist), the task list read a task's Running flag outside its lock (a real data race,
+  never seen), the Virtualization export config was written in place rather than
+  atomically, and the dead code. Nothing in auth, the proxies or the shell boundaries.
 - **Docker read-only view** — `docker ps`/logs; dockhand stays the source of truth.
 - **Notifications** — push on service failure / SMART warning / UPS event.
 - **Terminal extras** — search, copy-mode, font/theme, split panes, upload via