plans: row 77 follow-up brief, four refusal cases in the service tests

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-10-12_console-pinned-copy.md

@@ -159,3 +159,69 @@ after it, Sage sends Mos the commit, `scripts/webui-service.sh status`
 and `/healthz`. The live unit changes only at Mos's one reinstall:
 `copy` at the landed commit, stop, `install --copy ID` with the uid
 header and value, start, then status, `/healthz` and the anonymous 302.
+
+## Row 77 follow-up: four refusal cases in the service tests
+
+### Problem
+
+Row 77 landed at 0d10cf07. Its reviewers left four cases where a broken
+refusal in `scripts/webui-service.sh` still passes every test. The
+code is right in each case today, but no test holds it there.
+
+- Filbert round 2 N1 (comment 27898): `not-found` is the only
+  `LoadState` the bus check is tested with. A unit at `bad-setting` or
+  `error` that shows an `ExecStart` on the copy would be taken as the
+  bus if the check refused only `not-found`.
+- Filbert round 2 N2 (27898): no test fails a rename without creating
+  the target, so the line `[ -e "$target" ] || die "could not rename …"`
+  can be dropped and every test still passes. A missing copy would then
+  print `exists:` and exit 0. Without `-T`, `mv` also survives, for the
+  same reason.
+- Darkwing round 3 N1 (27979): `status` accepts a copy id without
+  anchors. If `^[0-9a-f]{40}$` loses its anchors, a `WorkingDirectory`
+  whose last part only contains 40 hex characters prints as a copy.
+  This affects only what `status` displays.
+- Darkwing round 3 N2 (27979): the two-unit test checks only that
+  install accepts. No test loads two units with the second one off the
+  copy.
+
+Filbert's round 2 N3 survivors are left out: the `awk` filter, the first
+`path=` only, and `u-w` against `a-w`. They are equivalent under today's
+inputs and need no test.
+
+### Owner and reviewer
+
+- Owner: whoever is assigned on the row.
+- Reviewer: Filbert.
+- Sage runs the gate.
+
+### Files owned
+
+`packages/webui/tests/service.test.mjs` and the stand-ins it uses.
+`scripts/webui-service.sh` is in scope only if a new test shows a real
+defect. The packet then says so, and the reviewer has to agree.
+
+### What ships
+
+- One test per case above. Each fails against the matching mutant and
+  passes on the landed script:
+  - a `bad-setting` unit with a copy path refuses;
+  - a stand-in `mv` that fails without creating the target refuses with
+    "could not rename";
+  - a `WorkingDirectory` of `<copies>/<40 hex>x` doesn't print as a copy;
+  - two loaded units, with the second off the copy, refuse naming the
+    second.
+- A mutant script in the packet. It makes the four edits above plus
+  dropping `-T`, runs each one alone, and shows all five killed.
+
+### Out of scope
+
+Any behaviour change to the service script. The live unit, and the copy
+install and restart (Mos's, decision 109).
+
+### Gate
+
+- Filbert approves on the row's issue, naming the candidate manifest.
+- The webui node suite and every `scripts/test-*.sh` pass on Sage's gate
+  rerun.
+- No Mos notice is needed: the row changes tests only.