PLAN: the KVM tab is per machine

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLAN.md

@@ -344,10 +344,15 @@ something long in one, switch away and back, refresh — it's all still there.
   does not need to, since one with focus receives them directly. Fullscreen plus
   `navigator.keyboard.lock()` is what takes Escape, Tab and Ctrl-W back from the browser;
   that is Chromium-only, and the tab says which version you are getting rather than
-  pretending. The list is **hub-side** on purpose — a KVM earns its keep when the machine is
-  down, which is when that machine's own Ham Lab cannot answer — and a KVM need not belong to
-  a machine Ham Lab manages at all. Not done: holding the device's own login on the hub, so
-  its page does not ask for a second password.
+  pretending.
+  **One KVM per machine, and the tab follows the machine switcher** (corrected the same day:
+  the first cut was a hub-side list you pointed at machines, which had it backwards). Switch
+  to `grid` and you get grid's; adding a second for a machine replaces the first. The
+  addresses are still kept **on the hub** rather than on each machine, because a KVM earns
+  its keep exactly when the machine is down and its own Ham Lab cannot answer — the hub
+  proxies the device either way — and a KVM need not belong to a machine Ham Lab manages at
+  all. Not done: holding the device's own login on the hub, so its page does not ask for a
+  second password.
 - **Skins** — 13 since 2026-09-19 (`themes.ts`: a palette is one `mk(…)` line): Dark,
   Light, Cyberpunk, Retro, **HUD** (hairlines of cyan on near-black, corner ticks, thin
   type), Nord, Gruvbox, Catppuccin + Latte, Dracula, Tokyo Night, Solarized Dark + Light;