VIRTUALIZATION.md: phase 2 deployed as v0.1.0-188 and verified live; what is left

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

VIRTUALIZATION.md

@@ -1,20 +1,20 @@
 # Virtualization tab — plan (2026-10-09; phase 1 built the same day)
 
-**Status:** phase 1 is **deployed to all five machines as v0.1.0-184** (2026-10-09) and
-**Install has run for real on `grid`**: Incus 6.0.4, a zfs pool on a 197 GiB sparse file in
-`~/apps/hamlab/virt/`, `incusbr0` at `172.16.100.1/24`, the two `DOCKER-USER` rules, the
-`incus-admin` group and Ham Lab's restart — one task, 90 seconds, exit 0. Verified
-afterwards: a Debian 13 container and a Debian 13 VM created from the hub, both got a lease,
-DNS and the internet through Docker's `FORWARD DROP`, the VM's agent answered `exec`;
-snapshot create/restore/delete, limits and a snapshot schedule, a shell as a Terminal tab
-through the hub, the catalogue (98 x86_64 container images, 1.1 s then cached), and the
-refusals (bad names, wrong delete confirmation, a size that isn't one). Both test instances
-were deleted again; the two Debian images stay in the store. One bug found and fixed on the
-way: `description` is an instance field, not a config key (v0.1.0-184). Detection on the
-other four: `core`, the Mac mini and `hamtv` show **Install**; `gate` shows **unavailable**
-(OpenWrt's apk has no incus, no KVM). Not built yet from the phase-1 list: the `instance.*`
-sensors and the Alerts default — next session. The write-back for `grid` is in
-`hamlet/docs/hosts.md`, `docker.md` and `gotchas.md`.
+**Status:** phases 1 and 2 are **deployed to all five machines as v0.1.0-188** (2026-10-09).
+Incus runs on `grid` (installed from the tab); the other machines show Install or, on `gate`,
+unavailable. Phase 2 verified live on `grid` through the hub: ISO fetched by URL with its
+sha256 checked, **New VM from ISO** booted Alpine with Secure Boot off, **the VGA console
+drew it in a real browser** (headless Chromium, 1280×800 canvas, keyboard and mouse live),
+a virtiofs mount appeared in a running VM, an export tarball landed in `virt/exports/` and the
+nightly cron line is written, `instance.*` sensors flow and the "VM or container down" alert
+default is in. Two things found and fixed on the way: spice-html5 wants the `binary`
+websocket subprotocol agreed; and it opens one websocket per SPICE channel, so the bridge
+holds **one console operation per VM** and gives each channel its own data websocket on it
+(Incus refuses a second operation as "already connected"). **Left from phase 2:** the LAN
+bridge step (`br0` on the uplink — needs a live test on a machine that can afford to drop
+off the network for a moment, which is a decision, not a build), cloud-init presets beyond
+"Use my SSH keys", and a backup line for `grid`'s `virt/exports/` (see `hamlet/docs/backups.md`).
+`t-alpine` on `grid` is the live example; delete it from the tab when done.
 
 A tab for creating, watching, consoling into and deleting **LXC containers and KVM virtual
 machines**, the way Proxmox does with `pct` and `qm` — **per machine, like every other
@@ -307,7 +307,7 @@ confs), 118 GiB of `vzdump` archives, and three raw VM disks. Latest of each:
 | Phase | What | Effort |
 |---|---|---|
 | **1 — detection, Install, the tab** | `internal/incus` (detection, CLI wrapper, JSON types, `incus monitor` for live state, the preseed builder and subnet picker), `internal/api/virt.go` (routes below), `Virtualization.tsx` (the three page states; list, detail, create dialog, snapshot panel), rail entry `virt`, terminal integration, sensors, and the Library's **Images** shelf (browse and download from `images:`, local store, import, publish). **Tested by clicking Install on `grid` first, then `core`** — two different pool drivers, both with Docker present. Then the Mac for the arm64 path. `gate` for the unavailable state. | 2–3 sessions |
-| **2 — operations** | The Library's **ISO** shelf (directory, upload/URL/path, attach, New VM from ISO) **with the VGA console** (`spice-html5`), snapshot schedules UI, nightly exports with retention and the per-machine export directory, limits editor, bind mounts, the LAN-bridge step, instance alert default, cloud-init presets. | 1–2 sessions |
+| **2 — operations (done 2026-10-09, except the LAN bridge)** | The Library's **ISO** shelf (directory, upload/URL/path, attach, New VM from ISO) **with the VGA console** (`spice-html5`), snapshot schedules UI, nightly exports with retention and the per-machine export directory, limits editor, bind mounts, the LAN-bridge step, instance alert default, cloud-init presets. | 1–2 sessions |
 | **3 — the rest** | Proxmox import (archives become Library images), GPU device for containers, Windows via `distrobuilder repack-windows`, GPU passthrough to a VM with its warning. | as wanted |
 
 ### API sketch