plans: Console service follow-ups brief from row 75 review (N1-N5)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-10-11_console-service-followups.md

@@ -0,0 +1,68 @@
+# Console service follow-ups from row 75's review (2026-10-11)
+
+Status: written by Sage, lead. It follows `docs/plans/BRIEF-TEMPLATE.md`.
+Filbert approved row 75 round 1 (comment 27430 on #1569) with five
+non-blocking notes. Sage placed them in one row after the cutover, so the
+service lands on the 10-12 date.
+
+## Console service hardening
+
+### Problem
+
+`scripts/webui-service.sh` (row 75) works as briefed, but the review
+found five gaps:
+
+- N1: `install` doesn't refuse while the unit is active. The unit's next
+  `Restart=on-failure` then runs the new ExecStart without Jason starting
+  it. Any process under Jason's user can already change the code the unit
+  runs. Q95 accepted that limit for the PoC, so N1 opens no new gap. But
+  replacing the running unit should still be Jason's act, as starting it
+  is.
+- N2: the unit's paths come from the checkout the script runs from, so an
+  install from a worktree points the unit at the worktree. No doc says to
+  install from the canonical checkout.
+- N3: `uninstall --no-reload` skips the active check, as `bus-service.sh`
+  does, while the docs say uninstall always refuses while active.
+- N4: if `systemctl --user list-units` fails, the script exits 1 with no
+  message.
+- N5: the `--allow-user` value has no check that it starts with a letter
+  or digit.
+
+### Owner and reviewer
+
+Owner: Rocko. Reviewer: Filbert. Rocko has no Gitea token; Sage runs the
+review request as jarvis.
+
+### Files owned
+
+- `scripts/webui-service.sh`
+- `packages/webui/tests/service.test.mjs`
+- `docs/TOOLS.md`, the script's entry only
+- `agents/rocko/work/queue-<row>/`
+
+### What ships
+
+- `install` refuses while the unit is active, and its message says Jason
+  stops it first. A test uses a stand-in `systemctl`.
+- `install` refuses when the script isn't in the canonical checkout,
+  meaning the repository root has a `.git` directory, not a worktree's
+  `.git` file. `--allow-worktree` overrides the refusal for tests. The
+  TOOLS.md entry says to install from the canonical checkout.
+- `uninstall` checks for an active unit even with `--no-reload`, or the
+  docs say exactly when it doesn't. Rocko picks one and the test shows
+  it.
+- A failed state read prints one line to stderr naming the failed
+  `systemctl` call.
+- `--allow-user` and the other values must start with a letter or digit.
+  Tests cover the two leading-character checks that the row 75 mutants
+  left untested.
+
+### Out of scope
+
+Starting, stopping or enabling the unit. Any `src/` change. The bus
+service script.
+
+### Gate
+
+Filbert approves on the row's issue naming the candidate manifest. The
+webui node suite and every `scripts/test-*.sh` green on Sage's gate rerun.