stack/docs/plans/2026-10-21_tester-socket-scripts.md

Brief: case2-unit.sh and case1-accept.sh move to --tester-socket (F27)

Sage, 2026-10-21, for Mos's ruling mos-1198 item 4. Owner Gander, reviewer Duckworth, gate owner Sage. Chained directly after row 196: it starts on row 196's landing and rebases onto it. Until this row lands, no Case 1 or Case 2 host (.53, .54) takes a stack copy that carries row 196.

Why

Row 196 retires the Console's --tester-port. packages/webui/src/cli.mjs:30 refuses it with "--tester-port retired; activate explicitly with --tester-socket". Two root scripts still produce or require the old flag, so a unit they render won't start on a copy that carries 196:

• scripts/case2-unit.sh takes --tester-port N for the factory profile (:163, :193-194, :204) and renders cli.mjs serve $FLAGS into the Console unit's ExecStart (:356).
• scripts/case1-accept.sh reads --tester-port from the saved installer args (:65), refuses args that lack it (:88), and checks the tester port in P10 tester-port-squat (:430, :432).

Gander's static audit on row 196 r5 lists every caller and test: agents/gander/work/queue-196/r5/ TESTER-PORT-AUDIT.md and tester-port-occurrences.json at 91e3696ef.

What this row does

1. case2-unit.sh: the factory profile takes --tester-socket and renders it into the Console ExecStart. --tester-port is refused with stack-release.sh's migration wording (scripts/stack-release.sh:808, "retires tester TCP; use --tester-socket"), naming this script in place of the target copy. The library profile still refuses any tester flag.
2. The socket path must work under the unit's hardening (ProtectHome, PrivateTmp, ReadWritePaths, :340-343). Use the path row 196 derives (<dataRoot>/console/tester.sock) and the parent checks stack-release.sh makes (:815). Say in DESIGN.md how the rendered unit reaches it.
3. case1-accept.sh: accept the socket form in the saved args, and refuse args that carry --tester-port with the same wording. P10 checks what the socket form needs in place of a port squat check. Say what it checks and what each outcome line reads.
4. Tests: packages/cli/tests/case2-unit.test.mjs and case1-accept.test.mjs move their fixtures to the socket form, and each gains a refusal test for --tester-port. Fakes only, as they use now.
5. Leave the deliberate legacy paths alone: scripts/webui-service.sh, scripts/stack-release.sh, scripts/instance.sh, their tests, stack-release-fixture.mjs, case1-hostcheck.test.mjs and the negative calls in tester-cli.test.mjs. If one of them needs a change, stop and ask.

Static check

The check covers scripts as well as tests (mos-1198 item 4). After this row, git grep -n -- --tester-port scripts packages returns only the legacy paths in step 5 and the refusals this row adds. BUILD.md lists each remaining hit and why it stays.

Boundaries

• No test touches ~/.mosaic-dev, ~/.config/mosaic-dev, the live units, a slot file, .53 or .54.
• This row doesn't run case1-accept.sh or case2-unit.sh on a host. That is a window with Jason.

Gate

Duckworth approves DESIGN.md, then the manifest. On Sage's slot: the cli suite whole, the webui suite whole, and every scripts/test-*.sh, green. The mutants named in DESIGN.md are killed, at least one per refusal. The static check above holds on the candidate.