# Console service: the unit script takes `--send` (2026-10-12)

Status: written by Sage, lead. It follows `docs/plans/BRIEF-TEMPLATE.md`.
Issue #1576. A cutover row (lead decisions 94, 95 and 101), so the
decision 94 hold doesn't apply.

## The unit script takes --send

### Problem

`scripts/webui-service.sh` (row 75, #1569) renders and installs the
Console's systemd user unit. It takes the preview set (`--public-host`,
`--auth-header`, `--allow-user`) but not `--send`, and
`packages/webui/README.md` says so: "The script takes no `--send`, so a
unit it installs is read-only." Row 76 (#1570, c45b948d) added `--send`
to `serve`, and the cutover needs it: Jason's Q95 yes is for sending a
human message to a role from the Console. Today the only way to get a
sending unit is to hand-edit the installed file, which nothing reviews
and the next `install` overwrites.

### Owner and reviewer

- Owner: Dewey.
- Reviewers: Darkwing and Filbert. The flag widens what the installed
  service can do, so it gets two reviewers like row 76.

### Files owned

- `scripts/webui-service.sh`
- `packages/webui/tests/service.test.mjs`
- `packages/webui/README.md`, only the paragraph that starts "To run the
  Console as a systemd user unit" and the `--send` paragraph under
  "Message a role" if it needs a pointer to the unit
- `docs/TOOLS.md`, the "Console service" section only
- `agents/dewey/work/queue-<row>/`

### What ships

- `render` and `install` take `--send`. It is accepted only with all
  three preview flags. Without them the script refuses before writing
  anything, with exit 1 and a message naming the preview flags, the way
  `serve` refuses (`--send needs the preview mode ...`).
- With `--send`, the rendered ExecStart ends with `--send` after the
  preview flags. Nothing else in the unit changes.
- Without `--send`, `render` output is byte-identical to the base for
  every flag combination the current tests cover.
- `uninstall` and `status` don't change. `status` may print whether the
  installed unit sends, if that's a small change; otherwise leave it.
- The README paragraph and TOOLS.md say the script takes `--send` only
  with the preview set, and that the Console then needs the system
  config at start (`--send needs the bus configured`).
- The start wording (added 2026-10-12, lead decision 102). The script's
  header comment and its install message, the TOOLS.md "Console service"
  section and the README service paragraph say that an agent starting the
  Console works around the human proof, and that Jason starts it. Each
  should now say Jason or Mos starts and restarts it under decision 102,
  which accepts that sends then enter the trail as Jason. Any other agent
  starting it still works around the human proof. The script still has no
  start, stop or restart verb.
- Tests: `render --send` with the preview set; `--send` alone; `--send`
  with one or two preview flags; `install --send` into a test `--dir`
  with `--no-reload`; a no-`--send` render compared byte for byte with
  the base. Mutants that drop the preview requirement or the ExecStart
  append survive on the base and are killed on the candidate.

### Out of scope

- Starting, restarting or enabling the unit. Jason or Mos does that
  (decisions 94 and 102). No test starts a real user unit.
- The script checking the system config or the bus. The Console's own
  start check covers it.
- The allowed-user switch from username to uid (decision 101). That is
  an operator reinstall with this script after the cutover, not code.
- Row 77's service hardening notes (#1571).

### Gate

Darkwing and Filbert each approve on #1576 naming the candidate
manifest. The webui node suite and every `scripts/test-*.sh` green on
Sage's gate rerun. Round 1 is wanted by 2026-10-12T15:00Z so it can land
before the cutover at about 21:30Z.