fix(console): keep preview deployment profiles read-only (#385)

scripts/case2-unit.sh

@@ -24,8 +24,10 @@
 # The library profile takes exactly these serve flags, each once:
 #   --port N (1..1023)  --business ID (the unit's)  --public-host NAME
 # A member that changes uid and cannot be killed refuses inner-cleanup, never success.
-#   --auth-header HEADER  --allow-user ID  --send
+#   --auth-header HEADER  --allow-user ID
 #   --proof-header NAME  --proof-file PATH
+# It is proxy-preview read-only until Case 2 supports --sso (#412); --send
+# is explicitly refused. The proof still protects proxy preview reads.
 # The factory profile takes --port N (1..1023) and --business ID, and an
 # optional bare --tester-socket marker. Retired tester TCP refuses. Only factory takes
 # --pm and --claude.
@@ -343,15 +345,17 @@ serve_flags() {
             --checkout) die "refusing --checkout: Case 2 has no queue panel" ;;
             --board) die "refusing --board: Case 2 runs no control board" ;;
             --sso) die "refusing --sso: the Console signs people in through the proxy, with the preview set and the proof pair (Q175 phase 2 is a follow-up)" ;;
+            --send)
+                [ "$PROFILE" = library ] || die "the factory profile refuses --send: its host has no proxy"
+                die "the library profile is read-only; refusing --send until Case 2 supports --sso (#412)" ;;
             --port|--business) ;;
-            --public-host|--auth-header|--allow-user|--proof-header|--proof-file|--send)
+            --public-host|--auth-header|--allow-user|--proof-header|--proof-file)
                 [ "$PROFILE" = library ] || die "the factory profile refuses $name: its host has no proxy" ;;
             *) die "unknown serve flag: $name" ;;
         esac
         [ -z "${seen[$name]:-}" ] || die "serve flag $name given twice"
         seen[$name]=1
         if [ "$name" = --tester-socket ]; then tester_socket=1; flags="$flags --tester-socket"; i=$((i + 1)); continue; fi
-        if [ "$name" = --send ]; then flags="$flags --send"; i=$((i + 1)); continue; fi
         [ $((i + 1)) -lt "$n" ] || die "serve flag $name needs a value"
         value="${SERVE[$((i + 1))]}"
         case "$name" in
@@ -375,7 +379,7 @@ serve_flags() {
         i=$((i + 2))
     done
     local required=(--port --business)
-    [ "$PROFILE" = factory ] || required+=(--public-host --auth-header --allow-user --send --proof-header --proof-file)
+    [ "$PROFILE" = factory ] || required+=(--public-host --auth-header --allow-user --proof-header --proof-file)
     for name in "${required[@]}"; do
         [ -n "${seen[$name]:-}" ] || die "serve flag $name is required"
     done

scripts/stack-release.sh

@@ -1107,8 +1107,9 @@ const k=Object.hasOwn(d,"console")?"console":Object.hasOwn(d,"federation")?"fede
 }
 
 # Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose
-# it; without the flag the pointer's --send goes on unchanged. Rollback and pm-on never take it, so
-# they carry the pointer as it is. Sets SEND_PLAN (the plan's send: line) and SEND_STEP.
+# it. A legacy pointer's implicit preview --send also drops before the plan reaches the installer,
+# because header preview is read-only (#385). Verified --sso send is still carried. Sets SEND_PLAN
+# (the plan's send: line) and SEND_STEP.
 # Row 273 (mos-1246 F39): under forward auth any same-uid process can send as the signed-in user
 # through the Console's port, so --send turns send on only when the run's Console flags hold --sso,
 # given or carried. --no-sso drops the pointer's --send, and so does a rollback to a Console without
@@ -1165,7 +1166,13 @@ send_for_target() {
             SEND_STEP="--no-send was given and the pointer holds no --send, so there is nothing to drop"
         fi
     elif [ "$had" = 1 ]; then
-        SEND_PLAN="send: carried"
+        if has_flag --sso "${RUN_CONSOLE[@]}"; then
+            SEND_PLAN="send: carried"
+        else
+            RUN_CONSOLE=("${without_send[@]}")
+            SEND_PLAN="send: dropped; header preview is read-only (#385)"
+            SEND_STEP="drop --send; header preview is read-only (#385)"
+        fi
     else
         SEND_PLAN="send: off"
     fi

scripts/webui-service.sh

@@ -142,7 +142,7 @@ parse_flags() {
             --allow-user) [ $# -ge 2 ] || usage; ALLOW_USER="$2"; SERVE_SET=1; shift 2 ;;
             --proof-header) [ $# -ge 2 ] || usage; PROOF_HEADER="$2"; PROOF_SET=1; SERVE_SET=1; shift 2 ;;
             --proof-file) [ $# -ge 2 ] || usage; PROOF_FILE="$2"; PROOF_SET=1; SERVE_SET=1; shift 2 ;;
-            --send) SEND=1; SERVE_SET=1; shift ;;
+            --send) [ "$SEND" = 0 ] || die "--send given twice"; SEND=1; SERVE_SET=1; shift ;;
             --sso) SSO=1; SERVE_SET=1; shift ;;
             *) usage ;;
         esac