sage: row 176 brief: activate --tester-port N writes the flag into the pointer's Console flags, a rollback or an activate to a copy whose Console lacks it drops it, tester-port-target refuses before anything stops; tests and three mutants; row 175 F1 (TOOLS.md step 2) rides along

docs/plans/2026-10-19_console-tester-listener.md

@@ -78,8 +78,27 @@ them as tester reads in `packages/bus/src/broker.mjs`:
 
 - `--tester-port N` joins FLAGS, with the same checks as serve's, rendered into ExecStart. `render`, `install` and
   `status` show it.
-- `scripts/stack-release.sh` carries the pointer's Console flags as an array (`P_CONSOLE`, :96, :704, :708). Check it
-  carries `--tester-port` through a re-pin and a rollback unchanged, and add the test.
+- `scripts/stack-release.sh` (amended 2026-10-20, sage-1107; line numbers at 716ddcf1e). The pointer holds the
+  Console flags (`P_CONSOLE`, :101). `activate`, `rollback` and `pm-on` install the Console with them (:774, :914),
+  and `flags_drift` (:601) refuses `unit-flags-drift` when the unit differs. So a `--tester-port` added by hand with
+  `webui-service.sh install` makes the next run refuse, and nothing today writes a new flag into the pointer. A
+  rollback to a copy whose `serve` doesn't know the flag would also fail to start that Console. The change:
+  - `activate ID BUSINESS ... --tester-port N` adds `--tester-port N` to the Console flags it installs and writes to
+    the pointer, or replaces the value already there. It takes the same checks as `webui-service.sh` (exit 4 on a bad
+    value). It refuses `tester-port-target` before anything stops when the target copy's own Console doesn't take
+    the flag. Read the target copy (`$COPIES/<id>/packages/webui/src/cli.mjs` or its `webui-service.sh`), never
+    REPO. Without `--tester-port`, `activate` keeps the pointer's flags as today.
+  - `activate` without `--tester-port` and `rollback` to a target whose Console doesn't take the flag drop
+    `--tester-port N` from the flags they install and write. Both say so in `--plan` (a line naming the dropped
+    flag) and in the steps log. Rolling back to a copy from before this row is the case this covers.
+  - Between two copies that both take it, a re-pin and a rollback keep it unchanged. `pm-on` keeps the pointer's
+    flags as today.
+  - `--plan` prints the Console flags it will install, so the window's W3 can check them.
+  - Update the usage text and the `docs/TOOLS.md` stack-release section.
+- Row 175's follow-up F1 (Filbert, #1673 comment 29279), doc-only: the stack-release two-phase step 2 in
+  `docs/TOOLS.md` (:453-455 at 98d29769e, "Until row 175 lands") is stale now that 175 landed as 98d29769e. Reword
+  it: copies from before 98d29769e take the `node <copy>/packages/cli/src/cli.mjs plugins set` form, later ones take
+  `mosaic plugins set`, and the tester can run it with `--tester` (Q173).
 - Update the header comment, `docs/TOOLS.md` and `packages/webui/README.md`.
 
 ### Untouched
@@ -114,7 +133,11 @@ move, stop and tell Sage. Before in-review, grep the tests for each changed path
     `docs/%2e%2e/x.md` refuse. Test that a committed `docs/out.md` symlink pointing outside the repo refuses
     `project-read-content`, and returns none of its target's bytes.
 11. `webui-service.sh render --tester-port 7333` puts it in ExecStart, and refuses 7332, the main port and bad values
-   (exit 4). `stack-release.sh` keeps `--tester-port 7333` across a re-pin and a rollback.
+   (exit 4). In `packages/cli/tests/stack-release.test.mjs`, with copies built in the test: `activate ...
+   --tester-port 7333` puts the flag in the pointer and the unit, and the next `status` shows no flag drift; a
+   second `activate --tester-port 7334` replaces it; a re-pin between two copies that take it keeps it; `rollback`
+   to a copy whose Console lacks the flag drops it and `--plan` names the drop; `activate --tester-port 7333` to such
+   a copy refuses `tester-port-target` with both units still running; `--tester-port 7332` refuses exit 4.
 12. A browser test (the webui browser harness) opens the tester listener, sees the tester banner, changes an
     instance's route, and the change lands as tester.
 
@@ -128,10 +151,14 @@ Mutants, each killed by some gate test (mos-0862):
 - `credentials` dropped from the tester reads, or `project.file.save` let through for a tester
 - the credentials result passes `#secretCheck` but carries the fixture's file path
 - `blob()` accepts mode 120000
+- `activate --tester-port` installs the flag but leaves the pointer's flags unchanged
+- `rollback` keeps `--tester-port` for a target whose Console lacks it
+- the `tester-port-target` check reads REPO instead of the target copy
 
 ## Gate
 
 Dewey approves the candidate manifest. Bus, cli, webui and business suites and every `scripts/test-*.sh` green on
-Sage's gate. The merged window adds `--tester-port 7333` to the Console unit after a store backup, and the window's
+Sage's gate. The merged window adds `--tester-port 7333` on its activate (`activate NEW mosaic-stack
+--pm-after-harness --migrate --tester-port 7333`), after that run's own store backup, and the window's
 browser check runs against http://127.0.0.1:7333/. Before it does, the window reads the tunnel's forward spec and
 stops unless it still forwards 7332 only.