# Brief: case2-unit.sh and case1-accept.sh move to --tester-socket (F27)

Sage, 2026-10-21, for Mos's ruling mos-1198 item 4. Owner Gander, reviewer Duckworth, gate owner Sage.
Chained directly after row 196: it starts on row 196's landing and rebases onto it. Until this row lands, no
Case 1 or Case 2 host (.53, .54) takes a stack copy that carries row 196.

## Why

Row 196 retires the Console's `--tester-port`. `packages/webui/src/cli.mjs:30` refuses it with
"--tester-port retired; activate explicitly with --tester-socket". Two root scripts still produce or require
the old flag, so a unit they render won't start on a copy that carries 196:

- `scripts/case2-unit.sh` takes `--tester-port N` for the factory profile (:163, :193-194, :204) and renders
  `cli.mjs serve $FLAGS` into the Console unit's ExecStart (:356).
- `scripts/case1-accept.sh` reads `--tester-port` from the saved installer args (:65), refuses args that
  lack it (:88), and checks the tester port in P10 tester-port-squat (:430, :432).

Gander's static audit on row 196 r5 lists every caller and test: `agents/gander/work/queue-196/r5/
TESTER-PORT-AUDIT.md` and `tester-port-occurrences.json` at 91e3696ef.

## What this row does

1. `case2-unit.sh`: the factory profile takes `--tester-socket` and renders it into the Console ExecStart.
   `--tester-port` is refused with stack-release.sh's migration wording (`scripts/stack-release.sh:808`,
   "retires tester TCP; use --tester-socket"), naming this script in place of the target copy. The
   library profile still refuses any tester flag.
2. The socket path must work under the unit's hardening (ProtectHome, PrivateTmp, ReadWritePaths, :340-343).
   Use the path row 196 derives (`<dataRoot>/console/tester.sock`) and the parent checks stack-release.sh
   makes (:815). Say in DESIGN.md how the rendered unit reaches it.
3. `case1-accept.sh`: accept the socket form in the saved args, and refuse args that carry `--tester-port`
   with the same wording. P10 checks what the socket form needs in place of a port squat check. Say what
   it checks and what each outcome line reads.
4. Tests: `packages/cli/tests/case2-unit.test.mjs` and `case1-accept.test.mjs` move their fixtures to the
   socket form, and each gains a refusal test for `--tester-port`. Fakes only, as they use now.
5. Leave the deliberate legacy paths alone: `scripts/webui-service.sh`, `scripts/stack-release.sh`,
   `scripts/instance.sh`, their tests, `stack-release-fixture.mjs`, `case1-hostcheck.test.mjs` and the
   negative calls in `tester-cli.test.mjs`. If one of them needs a change, stop and ask.

## Static check

The check covers scripts as well as tests (mos-1198 item 4). After this row, `git grep -n -- --tester-port
scripts packages` returns only the legacy paths in step 5 and the refusals this row adds. BUILD.md lists
each remaining hit and why it stays.

## Boundaries

- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, a slot file, .53 or .54.
- This row doesn't run case1-accept.sh or case2-unit.sh on a host. That is a window with Jason.

## Gate

Duckworth approves DESIGN.md, then the manifest. On Sage's slot: the cli suite whole, the webui suite whole,
and every `scripts/test-*.sh`, green. The mutants named in DESIGN.md are killed, at least one per refusal.
The static check above holds on the candidate.