plans: C2-13a rulings for gosalyn-0065. G1: default instance only, no --instance, a named instance is a follow-up. G2: library refuses --sso for 10-27, preview set and proof pair stay, --sso waits for Q175 phase 2. Line cites moved to their places after rows 190 and 192 (webui-service.sh, stack-copy.sh, bus-service.sh, serve.mjs), and the Console's WantedBy replaces :41

docs/plans/2026-10-20_case2-rows.md

@@ -800,23 +800,26 @@ Row 195 calls it with those names. `library` refuses `--pm` and `--claude`.
   Row 195 installs claude under a root-owned prefix to match.
 - The copy id must be exactly 40 lowercase hex characters naming a directory that holds
   `scripts/mosaic`, directly under `<home>/.local/share/mosaic-stack/copies`. That is the rule
-  `copy_root` uses (`scripts/stack-copy.sh:6`, `:20`). Anything else refuses before the render.
-- The serve flags. The script copies the checks from `serve_flags` (`scripts/webui-service.sh:146-207`)
+  `copy_root` uses (`scripts/stack-copy.sh:8`, `:22`). Anything else refuses before the render.
+- The serve flags. The script copies the checks from `serve_flags` (`scripts/webui-service.sh:201-264`)
   into its own function, with its own tests. It doesn't source or change that script, because its
-  proof-file check compares the owner to `id -u` (`:201`), which is root here, and its render finds
-  node with `command -v` (`:237`), not `--node` (webby-0036 N3). The library profile takes exactly
+  proof-file check compares the owner to `id -u` (`:257`), which is root here, and its render finds
+  node with `command -v` (`:294`), not `--node` (webby-0036 N3). The library profile takes exactly
   these flags, each once, and refuses any other:
   - `--port N`, with N in 1..1023 (design 9.3).
   - `--business ID`, equal to `--business`.
   - `--public-host NAME`, `--auth-header HEADER` and `--allow-user ID`, checked as
     `webui-service.sh` checks them. Their values come from design 10 step 5.
   - `--send`, because C2-10b's chat needs it.
+  - It refuses `--sso`. For 10-27 the library Console signs people in through the proxy, with the
+    preview set and the proof pair above. `webui-service.sh` refuses `--sso` with either (`:221-225`).
+    Taking `--sso` here waits for Q175 phase 2 (row 200 and its window), as a follow-up (gosalyn-0065 G2).
   - `--proof-header NAME` and `--proof-file PATH`. The proof is required, not optional (design 9.3).
     The file must be a regular file, not a symlink, owned by `<user>`'s uid from `getent passwd`, mode
     0600 or 0400, under `<home>/.config/mosaic-dev/secrets/`. That keeps it out of the data root, where
     a session's run directory is. The script stats it and never opens it.
   - It refuses `--tester-port`. The tester listener takes instance, route, name and chat writes from
-    loopback with no sign-in (`packages/webui/src/serve.mjs:472`, `:532-542`).
+    loopback with no sign-in (`packages/webui/src/serve.mjs:482`, `:552-553`).
   - It refuses `--checkout`. Her host has no canonical checkout, and the queue store refuses a read
     from the copy, so the queue panel isn't part of Case 2 (webby-0036 N4).
   - It refuses `--board`. Case 2 runs no control board, and design 9.3 says why the default stays.
@@ -835,11 +838,11 @@ The render. It renders two system units from the checkout's existing templates a
 - `@PATH@` is the directory of `--node` first, then whichever of `/usr/local/bin`, `/usr/bin` and `/bin`
   it isn't, in that order. The bus's `ExecStart=` is `scripts/mosaic`, which runs `exec node` from
   PATH (`scripts/mosaic:22-40`), so this line picks the bus's node. It differs from
-  `scripts/webui-service.sh:246-248` in one case on purpose. That script leaves the list alone when the
+  `scripts/webui-service.sh:303-305` in one case on purpose. That script leaves the list alone when the
   node's directory is already in it, so with `--node /usr/bin/node` a node in `/usr/local/bin` would
   come first and the bus would run it.
 - `@FLAGS@` is the checked serve flags, in the order given.
-- `@PM_FLAGS@` is ` --pm` when `factory` is given `--pm`, as `scripts/bus-service.sh:69-70` renders it,
+- `@PM_FLAGS@` is ` --pm` when `factory` is given `--pm`, as `scripts/bus-service.sh:82` renders it,
   and empty otherwise.
 - `@CLAUDE_ENV@` is the line `Environment=MOSAIC_CLAUDE_BIN=<--claude>` when `factory` is given
   `--claude`, and empty otherwise.
@@ -847,8 +850,9 @@ The render. It renders two system units from the checkout's existing templates a
   render refuses an unknown token, and row 190 landed first, so this row renders both, with tests
   (gosalyn-0057 item 4). Fill them as `scripts/instance.sh:85-107` does: for the default instance
   `dev` the `@CONFIG_ENV@` line is deleted and `@SESSION_ENV@` is the session env path under `%h`, which
-  the `%h` rule below then makes literal. A named instance takes instance.sh's
-  `Environment=MOSAIC_CONFIG=` line. The bus template's `EnvironmentFile=` line is now
+  the `%h` rule below then makes literal. This row renders the default instance only, with the
+  unsuffixed unit names below, and takes no `--instance`. A named instance on a Case 2 host is a
+  follow-up (gosalyn-0065 G1). The bus template's `EnvironmentFile=` line is now
   `mosaic-bus.service.in:25`, `EnvironmentFile=-@SESSION_ENV@`, and the checks below match it there.
 - `%h` becomes the literal `--home`, because in a system unit `%h` is root's home.
 - After the render it refuses any `@[A-Z_]+@` or `%h` left in either unit.
@@ -870,7 +874,7 @@ line restricts namespaces or system calls. A session's bwrap needs a user, PID a
 holds any of them.
 - `[Install]`. Each unit renders `WantedBy=multi-user.target` as its one `WantedBy=` line. In the bus
   unit it replaces `WantedBy=default.target`, not followed by a second line (webby-0036 N1). The
-  Console unit gets the same line (Q189, mos-1122, mos-1123, gosalyn-0064 item 1). That reverses
+  Console unit gets the same line, replacing `WantedBy=default.target` at `mosaic-webui.service.in:41` (Q189, mos-1122, mos-1123, gosalyn-0064 item 1). That reverses
   mos-1097 item 1 and webby-0036 B1's "no `[Install]` on the Console".
 - Root's 2c step enables both units, then starts the bus and then the Console (gosalyn-0064 item 2,
   design ruling after r11 at 8614ba87c). Both come back after a boot on their own. Design 10 step 9 has
@@ -889,7 +893,7 @@ none, and it refuses one. It also refuses:
   webby-0027, defence in depth).
 - on a re-install, an installed pair whose two units name different copy ids (webby-0036 N5). The bus
   accepts only its own `human-cli.mjs` path, so a split pair breaks the human proof
-  (`scripts/webui-service.sh:266-273`).
+  (`scripts/webui-service.sh:324-348`).
 - on a re-install, an installed unit that differs from the render in anything but the copy id. So the
   node path and serve flags must equal the installed ones. The copy id is the one value that may
   change, so a re-pin or a rollback to another copy re-renders both units together (row 195). With
@@ -911,7 +915,7 @@ checks below. C2-13b adds the library checks to the same file. It refuses unless
   `profile-library-business`, so Case 2 can't reach a tester-on check through a wrong flag.
 - The run root is 0700.
 - `XDG_DATA_HOME` is unset or is `<home>/.local/share`. `copy_root` reads the copies dir from it
-  (`scripts/stack-copy.sh:6`), and the unit fixes `<home>/.local/share`, so any other value would put
+  (`scripts/stack-copy.sh:8`), and the unit fixes `<home>/.local/share`, so any other value would put
   the copy where the unit refuses it (webby-0032 N2).
 - `node --version` is 24 or later, because every package's `engines` field says `>=24` (row 195: .53
   has v22.22.2).