- Shipped
- September 23, 2026 at 2:18 AM UTC
- Author
- Kamo
- Commit
- 0ea9a00
ServiceType.HOSTED_COMPUTERS at id 37, TESTING rather than COMPLETED. The stage is carrying weight here rather than describing progress: AppCatalogService resolves `available` as `stage == COMPLETED`, and an unavailable app is skipped by FeatureController's auto-provision loop. Every other COMPLETED app arrives switched on for all 25 organizations the day it ships; this one hands out virtual machines holding real RAM on a two-node cluster, so it has to be granted per organization by an operator who has looked at the capacity. Nothing is lost — the platform Apps & Features screen exists precisely to publish an app independently of its stage, so the row is waiting there under "Not Available". Three rights at 326-328, not 320-322: the local checkout was 30 commits behind and 320 is MANAGE_EMAIL_OPT_OUTS. Read the IDS in that file, never the line order — 318-325 sit hundreds of lines above the constant that looks last. All three are roots and none is a child of another, which is the decision worth recording rather than the count. MANAGE_HOSTED_COMPUTERS gates the settings section; the two ACCESS rights gate WHOSE computer appears in a member's nav menu. Parenting either under MANAGE would be wrong in the expensive direction — an IT lead who needs to open any machine would arrive holding the provisioning screen, and a manager granted a view of their team's computers would be able to resize them. Neither gates a member's OWN computer: that is not a right at all, because making it one allows a computer provisioned for somebody who cannot reach it. HostedComputerTier and HostedComputerState persist by NAME. These tables are new, so there is nothing to protect and no reason to inherit the reorder hazard AssocType and ServiceType have to live with. Two derivations in the tier are load-bearing and both fail QUIETLY without them: - minimumDiskGb() is guest memory + 25. A computer sleeps by writing its RAM into its own swap file, so a disk with no room for the image produces a computer that never sleeps — or writes a partial image and boots clean with the member's session gone. Neither reports anything, so the floor is enforced rather than suggested. - requestedMib() adds KubeVirt's launcher overhead, measured at ~324 MiB on desktop-1 and rounded to 400. Capacity must compare against what the POD requests: a check that omits it says a computer fits and then leaves its pod Pending indefinitely, which is indistinguishable from a computer that never appeared and logs nothing a member can see. **************** is what capacity planning subtracts, and ASLEEP is deliberately not in it — that is the whole feature. KubeVirt's own pause "freezes the process without releasing CPU resources, but memory remains allocated", so asleep here means suspend-to-disk: the VMI and its launcher pod are gone and the memory request is back with the scheduler. Storage is one nullable pair with a third meaning and no boolean. A ceiling above the current disk is "unlimited" as a member experiences it; an absent ceiling means the disk does not grow. There is no `unlimited` flag because a flag set with no ceiling is the configuration that quietly eats a cluster — the rule StorageAutoExpandSweep already enforces for files, for the reason it records. PhiModule.HOSTED_COMPUTERS is BLOCKED_NO_BAA, and the reason is a property of the thing rather than a gap in the paperwork. Every other module is a known surface with known data flows; this is a desktop somebody can install anything on and paste anything into, and Kamo cannot inventory it without watching the screen. The isolation is genuinely strong and that is not what a BAA asks for. Also mapped KAMO_UNIVERSE, CHESS and HOLDEM, which shipped with no PhiModule and left PhiServiceTypeMappingTest red. Not mine, but the test fails on the first gap it finds, so without them it cannot prove HOSTED_COMPUTERS is mapped either. They take GAMES, which their own parent takes. Suite: 3026 tests, and the 4 remaining failures are the same ones pristine origin/main produces — ReportVisibilityTest (PlatformRightType ordinal, untouched here), the two GROWTH_REQUEST_IMAGE storage domain tests, and SystemBugCountContractTest's NoSuchMethod. Verified by running them in a clean worktree at origin/main before changing anything. Tables are in **************** and have been applied to the live database.