fix(upgrade): refuse legacy library --send before units stop (#385)

scripts/stack-upgrade.sh

@@ -121,8 +121,12 @@ logl "start rc=0 argv:$(printf ' %q' "$0" "${ARGV[@]}")"
 
 # I2's file: one case2-unit.sh argument per line, owned by root with no group or other write. Sets
 # ARGS (the lines), S_USER, S_HOME, BUSINESS, NODE and ARGS_COPY, and the paths derived from them.
+# #385 R2-F1: base case2-unit.sh required --send for the library profile (its default, and the last
+# --profile wins, as there), and the current one refuses it. A2 would stop both units, and A4 and
+# render-old would both fail on the same args, so a library file holding --send after -- refuses
+# here, before anything stops. The file is never rewritten; the operator removes the line.
 read_args() {
-    local f="$ETC/$INSTANCE.args" st i copies=0 v
+    local f="$ETC/$INSTANCE.args" st i copies=0 v profile=library
     [ -f "$f" ] && [ ! -L "$f" ] || refuse args-unreadable "no regular file $f"
     st="$(stat -c '%u %a' "$f")" || refuse args-unreadable "cannot stat $f"
     [ "${st% *}" = "$(id -u)" ] && (( (8#${st#* } & 8#022) == 0 )) || refuse args-unreadable "$f must be $(id -un)'s with no group or other write (it is uid ${st% *}, mode ${st#* })"
@@ -137,12 +141,19 @@ read_args() {
                 case "${ARGS[i]}" in
                     --user) S_USER="$v" ;; --home) S_HOME="$v" ;; --business) BUSINESS="$v" ;; --node) NODE="$v" ;;
                     --copy) ARGS_COPY="$v"; copies=$((copies + 1)) ;;
+                    --profile) profile="$v" ;;
                 esac
                 i=$((i + 1)) ;;
             *) refuse args-unreadable "$f has ${ARGS[i]} before --, which case2-unit.sh does not take" ;;
         esac
     done
     [ "$copies" = 1 ] || refuse args-unreadable "$f needs exactly one --copy before --, not $copies"
+    if [ "$profile" = library ]; then
+        for ((i = i + 1; i < ${#ARGS[@]}; i++)); do
+            [ "${ARGS[i]}" != --send ] ||
+                refuse args-unreadable "$f has --send after --, which case2-unit.sh refuses for the library profile: remove the --send line, then rerun; the library Console is read-only until #412 (#385)"
+        done
+    fi
     [[ "$S_USER" =~ ^[a-z_][a-z0-9_-]*$ ]] && [[ "$S_HOME" =~ ^/[A-Za-z0-9/._+-]+$ ]] && [[ "$BUSINESS" =~ ^[a-z0-9][a-z0-9-]*$ ]] &&
         [[ "$NODE" =~ ^/[A-Za-z0-9/._+-]+$ ]] && [[ "$ARGS_COPY" =~ ^[0-9a-f]{40}$ ]] ||
         refuse args-unreadable "$f lacks a plain --user, --home, --business, --node or --copy"