plans: decision 102 (Q99, Mos starts the Console unit); row 83 brief carries the start wording (#1576)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -2227,3 +2227,29 @@ which stay with him. Each item names who decided it and what happened.
       the username. The policy binding admits only pk 5, and only admins
       can rename, so the exposure is to an admin, who controls the
       outpost anyway.
+
+102. **Q99 yes: Mos starts and restarts the Console unit (2026-10-12).**
+    Mos asked Jason (sage-0069, recorded in jason-master-restart
+    DECISIONS.md, commit f684a08): "Does your 02:18Z authorization let
+    me start and restart the mosaic-webui unit? It would also cover the
+    other cutover services: tunnel, outpost and Argo sync. One effect:
+    once the Console is up, web sends go into the trail as you
+    (human-cli). The 2026.8.0 upgrade, data deletion and the cutover go
+    stay with you either way." Jason, 03:46Z: "Yes".
+    - This amends decision 94's start line. Mos may start and restart
+      mosaic-webui, and seats route those requests to Mos. Jason still
+      may. No other seat starts, stops or restarts it, and Sage doesn't.
+    - Jason accepts that a Console started by Mos sends into the trail
+      as him (`human-cli`). Decision 62's local-forgery limit is
+      unchanged, and so is decision 95's PoC scope.
+    - The live cutover go stays Jason's. Mos starts the unit for the
+      cutover only after that go.
+    - Row 83 (#1576) carries the wording. `scripts/webui-service.sh`'s
+      header comment and install message, `docs/TOOLS.md` "Console
+      service" and the README service paragraph now say an agent start
+      works around the human proof and that Jason starts it. They
+      should name Jason or Mos under this decision. The script still
+      gets no start verb.
+    - The tradeoff: the human proof now rests on Jason's grant to one
+      named seat, not on his own shell. In exchange, a cutover restart
+      no longer waits for Jason to be at a terminal.

docs/plans/2026-10-12_console-service-send.md

@@ -49,6 +49,14 @@ and the next `install` overwrites.
 - The README paragraph and TOOLS.md say the script takes `--send` only
   with the preview set, and that the Console then needs the system
   config at start (`--send needs the bus configured`).
+- The start wording (added 2026-10-12, lead decision 102). The script's
+  header comment and its install message, the TOOLS.md "Console service"
+  section and the README service paragraph say that an agent starting the
+  Console works around the human proof, and that Jason starts it. Each
+  should now say Jason or Mos starts and restarts it under decision 102,
+  which accepts that sends then enter the trail as Jason. Any other agent
+  starting it still works around the human proof. The script still has no
+  start, stop or restart verb.
 - Tests: `render --send` with the preview set; `--send` alone; `--send`
   with one or two preview flags; `install --send` into a test `--dir`
   with `--no-reload`; a no-`--send` render compared byte for byte with
@@ -57,8 +65,8 @@ and the next `install` overwrites.
 
 ### Out of scope
 
-- Starting, restarting or enabling the unit. Jason does that (decision
+- Starting, restarting or enabling the unit. Jason or Mos does that
-  94). No test starts a real user unit.
+  (decisions 94 and 102). No test starts a real user unit.
 - The script checking the system config or the bus. The Console's own
   start check covers it.
 - The allowed-user switch from username to uid (decision 101). That is