row 196: human boundary on peer credentials, interpreter receipt and the Console tester socket (#1694)

Candidate 527b9a1e6 (gander/row196-r6-prd19, base f48725cfc), the 39 manifest paths of CANDIDATE.sha256 537d30aef70b6cd1 at ec1e7fad8. Duckworth approved round 1 outside B1/B2 (rev 2973, comment 30145) and round 2 merge-scoped (rev 2986, comment 30156). Gate gander-0066 on grant sage-2145: 2334 pass, 0 fail, 1 skip; mutants 38/38 killed. BUILD-LOG lines and Duckworth's C1 DEFERRED entry follow as a doc-only append.

docs/TOOLS.md

@@ -465,7 +465,7 @@ reports checkout or copy identity and refactor drift, and writes nothing.
 
 ```
 scripts/stack-release.sh adopt BUSINESS
-scripts/stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-port N]
+scripts/stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-socket | --tester-port N (legacy copies)]
     [--proof-header NAME --proof-file PATH | --no-proof | --sso] [--no-send] [--timeout S] [--plan]
 scripts/stack-release.sh pm-on BUSINESS [--timeout S]
 scripts/stack-release.sh rollback BUSINESS [--restore ACTIVATION [--events N]] [--timeout S] [--plan]
@@ -562,7 +562,8 @@ refuses `capture-failed` before it stops anything. Adopt uses the same rule.
 The Console's row 178 proof pair gets into the pointer only through `activate`
 (row 187). `--proof-header NAME --proof-file PATH` puts the pair in the
 pointer's Console flags and the unit after the preview flags and before `--send`
-and `--tester-port`, where `webui-service.sh` renders it, replacing any pair
+and the tester flag (`--tester-socket`, or `--tester-port` for legacy copies),
+where `webui-service.sh` renders it, replacing any pair
 already there. `--no-proof` drops it. Either may name the live copy, which a
 plain activate refuses with `already-active`, so the proof goes on or off
 without changing copies; `--no-proof` with no pair in the pointer still refuses
@@ -692,6 +693,12 @@ backup's checks it prints `BACKUP_STORE <activation id> schema <version>`.
 it never picks another port. `--timeout` (default 60 seconds) bounds the
 gate and each stop.
 
+A copy marked for the private tester receives `--tester-socket` during rehearsal;
+a legacy copy receives no tester flag. The socket is under the rehearsal's
+scratch dataRoot, at `data/console/tester.sock`. That path is longer than the live
+one. A long dataRoot can pass activation's pathname preflight and still make the
+rehearsal Console refuse its socket path; the rehearsal then fails closed.
+
 Before it makes anything, it checks the pointer, the copy (present,
 reachable from refactor, a readable schema, a bus host with `--no-launch`),
 the port and the backup's `SHA256SUMS`. Then it makes
@@ -1264,36 +1271,46 @@ not claim an assistant answer; an uncertain receipt is never retried. Read the
 current list/history before trying again. Activation still needs Mos's separate
 window; changing these files does not authorize a live Console action.
 
-### Console tester listener (`serve --tester-port N`, row 176)
+### Console tester listener (`serve --tester-socket`, row 196)
 
-`node packages/webui/src/cli.mjs serve --tester-port N` adds a second listener
-bound only to `127.0.0.1:N`. N must be an integer in 1024..65535, different
-from `--port` and never 7332 (the tunnel's forwarded port). It requires the
-bus configuration. It calls only the tester shim; the main listener keeps its
-existing human transport and rejects every `x-mosaic-tester` request.
-The tester listener rejects the main preview auth header and only accepts its
-own loopback Host/port. Its Settings banner identifies the tester. Its instance,
-route and name editors use the tester's three writes; settings, document saves,
-assistant stop, role messages and chat writes stay refused. Writes require the
-exact `http://127.0.0.1:N` Origin, same-origin Fetch Metadata, JSON and the existing
-bounded strict bodies. `tester-off` and `tester-required` answer HTTP 403.
+`node packages/webui/src/cli.mjs serve --tester-socket` adds private HTTP at
+`<dataRoot>/console/tester.sock` (0600) under console/ (0700). The path must fit
+107 bytes. Unsafe ownership, modes, symlinks and pre-existing entries refuse.
+The main Console remains on its configured TCP port. New copies refuse --tester-port.
 
-`scripts/webui-service.sh render|install --tester-port N` carries the flag into
-ExecStart, and status names its URL. Bad tester ports exit 4. Install remains a
-unit write for the authorized operator, with no start/restart verb.
+The tester's fixed Host is mosaic-tester.invalid and its Origin is
+http://mosaic-tester.invalid. No DNS is used. POST also needs same-origin Fetch
+Metadata and bounded JSON. The endpoint uses only TESTER_CLI. It admits the
+existing instance, route, name and tester-chat writes, never owner settings,
+document saves, assistant stop or role messages. bus.tester stays Jason's switch.
+Authorization, login/session cookies and configured proxy headers refuse.
 
-`stack-release.sh activate ID BUSINESS --tester-port N` replaces or adds this
-Console flag in both the installed unit and the pointer. It checks the target
-copy's own Console before stopping anything; an explicit unsupported request
-refuses `tester-port-target`. A port outside 1024 to 65535, 7332 or the
-Console's `--port` is a usage error (exit 4). Under `--plan` both are listed
-with the plan's other refusals instead, the bad port as `tester-port-invalid`,
-and the plan exits 3. Without an explicit flag, activate and rollback
-keep it between supporting copies, or drop it when the target predates support.
-The plan prints the final Console flags and any dropped `--tester-port N`;
-the steps log records a drop too. `pm-on` keeps the pointer's Console flags.
-These operations retain their existing Mos/Jason window authority. Nothing in
-this row forwards the tester port through the tunnel or changes live units.
+```sh
+node packages/cli/src/tester-http.mjs GET /api/bus/agents
+printf '%s' '{"name":"fixture"}' | node packages/cli/src/tester-http.mjs POST /api/chat/projects
+```
+
+The helper loads the selected instance config and reports HTTP status/text/body
+as JSON, exiting 2 for refusal. It never retries writes. Direct browser access
+is removed with Mos's acceptance (mos-1015). A future authenticated browser relay
+behind SSO is a separate row. No TCP compatibility bridge is provided.
+
+`webui-service.sh render|install --tester-socket` checks target support and carries
+the flag into ExecStart. `stack-release.sh activate ID BUSINESS --tester-socket`
+explicitly replaces an inherited --tester-port pair in both unit and pointer.
+Without explicit conversion a new target refuses tester-transport-migration before
+stopping anything. Unsupported targets refuse tester-socket-target. Rollback drops
+unsupported socket enablement, visibly in plan/steps, without enabling TCP. Legacy
+flags remain supported by the release tool for legacy target copies only. Failed
+activation recovery can restore the previous TCP unit and its old limits.
+
+Activation of a new copy preflights the pinned root-owned system Python ELF,
+records its resolved path/version/identity/hash and checks the bus's fresh startup
+receipt. Restarts revalidate and append actual interpreter identity to
+`<dataRoot>/bus/peercred-starts.jsonl`, without comparing an old activation hash.
+After an OS interpreter update, the next authorized re-pin uses a different reviewed
+copy and refreshes activation evidence. Do not bypass already-active or use a PATH shim.
+All live operations keep their existing window authority.
 
 Console proxy proof (row 178, #1676): `serve`, `webui-service.sh render` and
 `install` accept `--proof-header NAME --proof-file PATH` together, under preview