brief: F27, case2-unit.sh and case1-accept.sh move to --tester-socket, chained after row 196 (#1758)

Mos ruling mos-1198 item 4. Owner Gander, reviewer Duckworth, gate owner Sage.

docs/plans/2026-10-21_tester-socket-scripts.md

@@ -0,0 +1,54 @@
+# Brief: case2-unit.sh and case1-accept.sh move to --tester-socket (F27)
+
+Sage, 2026-10-21, for Mos's ruling mos-1198 item 4. Owner Gander, reviewer Duckworth, gate owner Sage.
+Chained directly after row 196: it starts on row 196's landing and rebases onto it. Until this row lands, no
+Case 1 or Case 2 host (.53, .54) takes a stack copy that carries row 196.
+
+## Why
+
+Row 196 retires the Console's `--tester-port`. `packages/webui/src/cli.mjs:30` refuses it with
+"--tester-port retired; activate explicitly with --tester-socket". Two root scripts still produce or require
+the old flag, so a unit they render won't start on a copy that carries 196:
+
+- `scripts/case2-unit.sh` takes `--tester-port N` for the factory profile (:163, :193-194, :204) and renders
+  `cli.mjs serve $FLAGS` into the Console unit's ExecStart (:356).
+- `scripts/case1-accept.sh` reads `--tester-port` from the saved installer args (:65), refuses args that
+  lack it (:88), and checks the tester port in P10 tester-port-squat (:430, :432).
+
+Gander's static audit on row 196 r5 lists every caller and test: `agents/gander/work/queue-196/r5/
+TESTER-PORT-AUDIT.md` and `tester-port-occurrences.json` at 91e3696ef.
+
+## What this row does
+
+1. `case2-unit.sh`: the factory profile takes `--tester-socket` and renders it into the Console ExecStart.
+   `--tester-port` is refused with stack-release.sh's migration wording (`scripts/stack-release.sh:808`,
+   "retires tester TCP; use --tester-socket"), naming this script in place of the target copy. The
+   library profile still refuses any tester flag.
+2. The socket path must work under the unit's hardening (ProtectHome, PrivateTmp, ReadWritePaths, :340-343).
+   Use the path row 196 derives (`<dataRoot>/console/tester.sock`) and the parent checks stack-release.sh
+   makes (:815). Say in DESIGN.md how the rendered unit reaches it.
+3. `case1-accept.sh`: accept the socket form in the saved args, and refuse args that carry `--tester-port`
+   with the same wording. P10 checks what the socket form needs in place of a port squat check. Say what
+   it checks and what each outcome line reads.
+4. Tests: `packages/cli/tests/case2-unit.test.mjs` and `case1-accept.test.mjs` move their fixtures to the
+   socket form, and each gains a refusal test for `--tester-port`. Fakes only, as they use now.
+5. Leave the deliberate legacy paths alone: `scripts/webui-service.sh`, `scripts/stack-release.sh`,
+   `scripts/instance.sh`, their tests, `stack-release-fixture.mjs`, `case1-hostcheck.test.mjs` and the
+   negative calls in `tester-cli.test.mjs`. If one of them needs a change, stop and ask.
+
+## Static check
+
+The check covers scripts as well as tests (mos-1198 item 4). After this row, `git grep -n -- --tester-port
+scripts packages` returns only the legacy paths in step 5 and the refusals this row adds. BUILD.md lists
+each remaining hit and why it stays.
+
+## Boundaries
+
+- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, a slot file, .53 or .54.
+- This row doesn't run case1-accept.sh or case2-unit.sh on a host. That is a window with Jason.
+
+## Gate
+
+Duckworth approves DESIGN.md, then the manifest. On Sage's slot: the cli suite whole, the webui suite whole,
+and every `scripts/test-*.sh`, green. The mutants named in DESIGN.md are killed, at least one per refusal.
+The static check above holds on the candidate.