fix(upgrade): refuse legacy library --send before units stop (#385)

docs/SESSIONS.md

@@ -1881,3 +1881,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-26 | Sage | Mos1909/1915/1917 real postlanding reviews | Boyd/Dewey/Filbert/Gladstone real authored candidate52ba verdictfiles independently byte/hash-verified, allAPPROVE scoped; Dewey656broaderPARTIAL retained. Formal330R1/331R4 requests failedpre-send/no comments or approvals; no borrowed/copied/mintedkeys. LegacyhelperGETname jason.woltje is NOT ownJarvis, ownslotabsent; rows tracking-open/#436, files cited via normalqueue. NewFilbertNEW-330-01 filedtask665 exactreadback, notlandingreopen/gate. Repair646-648/652-656 remainOPEN untilactualcomments;1917 conditionalbacklog routing retained. #662scope1338posted;660PR405REVISE/notready. Product1968inputs unchanged; no source/helper/test/gate edits/runs; peerjournal prefixes preserved.
 2026-10-29T03:27:31Z | Codex Daybreak Blue xhigh implementation sub-agent | #385 OIDC-only Console writes, branch work/vikunja-19-385-q284-complete at exact base 09a847edaa25b609bac7728ff83f224708a29399 | Source/test/docs preparation complete for review; focused refusal 5/5 and selected service 4/4 pass, broader real-OIDC writer tests blocked by absent pinned oauth4webapi@3.8.8; no install/commit/push/PR/queue move or overall-green claim.
 2026-10-29T05:49:53Z | Codex Daybreak Blue xhigh implementation sub-agent | Mos2255 #385 review repair R2 on work/vikunja-19-385-q284-complete at unchanged HEAD 9936a1be1a37fdb30ba53cf2f14b7897225c3e4a/base 09a847edaa25b609bac7728ff83f224708a29399 | Corrects the 03:27:31Z historical blocker: pinned oauth4webapi3.8.8 fixture is now present without install and original prep is committed. F1/F2/F3 repaired in uncommitted source/tests/docs; F4/F7 disclosed only, F6 append conflicts preserved. Three focused test files only: intentional RED captured, GREEN controls plus T53 12/12, T55 8/8, T57 13/13 and T58 11/11 pass. No root/native/live/full-suite/CI, commit/push/PR/API/merge, frozen packet or live-pin action.
+2026-11-02T18:03:53Z | Claude Opus 5.5 implementation sub-agent (lead T3 c5c1e8ba) | #385 PR 1836 repair R3 on work/vikunja-19-385-q284-complete at ab2bc23c7 | R2-F1 fixed: stack-upgrade refuses a library args file holding `--send` after `--` before any unit stops, for upgrade and rollback; R2-I1 component case and R2-I2 TOOLS.md precision added, R2-I3 noted. RED 0/1 then GREEN 2/2; stack-upgrade 23/23, stack-release 225/225, case2-unit 48/48. One local commit; no push, PR, Vikunja, Gitea or live action.

docs/TOOLS.md

@@ -494,7 +494,9 @@ every table in COUNTED.
 pointer's, and takes the Console flags from the rollback set of the activation that turned it on.
 --no-sso drops the pointer's --send, and so does a rollback to a Console without --sso.
 An inherited legacy --send beside header-preview flags is dropped during planning because preview is
-read-only; it never reaches the service installer.
+read-only; it never reaches the service installer. The drop alone is not a change: an activate of the
+pointer's own copy refuses already-active unless another flag changes the Console (check_target's
+list), so on a legacy pointer pass --no-send there.
 ```
 
 This is an operator plan, not an action agents run. Both reviews and the

docs/guides/host-run-sheet.md

@@ -385,7 +385,21 @@ but omits `--send`. That Console is read-only until Case 2 gains real OIDC in #4
 explicitly refuses `--send`. Proxy preview and proof-protected reads remain available. The `factory`
 profile and its private tester socket are unchanged.
 
-Precheck line: none. `stack-upgrade.sh` refuses `args-unreadable` on any of these rules.
+A library host installed before #385 has a `--send` line after `--`, because the earlier
+`case2-unit.sh` required it. `stack-upgrade.sh upgrade` and `rollback` read the args file before
+anything stops, and when the profile is `library` (no `--profile` line, or the last one says
+`library`) and `--send` appears after `--`, they refuse `args-unreadable` with both units still
+running. The script never rewrites the file. To migrate, as root:
+
+1. Open `/etc/mosaic-stack/dev.args` and delete the one line that reads `--send`. Change nothing else.
+2. Check it: `stat -c '%U %a' /etc/mosaic-stack/dev.args` still gives `root` and a mode with no group or
+   other write, and `grep -cx -- --send /etc/mosaic-stack/dev.args` prints `0`.
+3. Rerun the same `stack-upgrade.sh` command.
+
+The Console stays read-only after the upgrade, until #412 (#385).
+
+Precheck line: none. `stack-upgrade.sh` refuses `args-unreadable` on any of these rules, before it stops
+a unit.
 
 ## 8. Enrollment, once per host