stack/docs/plans/2026-10-12_console-service-send.md

Console service: the unit script takes --send (2026-10-12)

Status: written by Sage, lead. It follows docs/plans/BRIEF-TEMPLATE.md. Issue #1576. A cutover row (lead decisions 94, 95 and 101), so the decision 94 hold doesn't apply.

The unit script takes --send

Problem

scripts/webui-service.sh (row 75, #1569) renders and installs the Console's systemd user unit. It takes the preview set (--public-host, --auth-header, --allow-user) but not --send, and packages/webui/README.md says so: "The script takes no --send, so a unit it installs is read-only." Row 76 (#1570, c45b948d) added --send to serve, and the cutover needs it: Jason's Q95 yes is for sending a human message to a role from the Console. Today the only way to get a sending unit is to hand-edit the installed file, which nothing reviews and the next install overwrites.

Owner and reviewer

• Owner: Dewey.
• Reviewers: Darkwing and Filbert. The flag widens what the installed service can do, so it gets two reviewers like row 76.

Files owned

• scripts/webui-service.sh
• packages/webui/tests/service.test.mjs
• packages/webui/README.md, only the paragraph that starts "To run the Console as a systemd user unit" and the --send paragraph under "Message a role" if it needs a pointer to the unit
• docs/TOOLS.md, the "Console service" section only
• agents/dewey/work/queue-<row>/

What ships

• render and install take --send. It is accepted only with all three preview flags. Without them the script refuses before writing anything, with exit 1 and a message naming the preview flags, the way serve refuses (--send needs the preview mode ...).
• With --send, the rendered ExecStart ends with --send after the preview flags. Nothing else in the unit changes.
• Without --send, render output is byte-identical to the base for every flag combination the current tests cover.
• uninstall and status don't change. status may print whether the installed unit sends, if that's a small change; otherwise leave it.
• The README paragraph and TOOLS.md say the script takes --send only with the preview set, and that the Console then needs the system config at start (--send needs the bus configured).
• The start wording (added 2026-10-12, lead decision 102). The script's header comment and its install message, the TOOLS.md "Console service" section and the README service paragraph say that an agent starting the Console works around the human proof, and that Jason starts it. Each should now say Jason or Mos starts and restarts it under decision 102, which accepts that sends then enter the trail as Jason. Any other agent starting it still works around the human proof. The script still has no start, stop or restart verb.
• Tests: render --send with the preview set; --send alone; --send with one or two preview flags; install --send into a test --dir with --no-reload; a no---send render compared byte for byte with the base. Mutants that drop the preview requirement or the ExecStart append survive on the base and are killed on the candidate.

Out of scope

• Starting, restarting or enabling the unit. Jason or Mos does that (decisions 94 and 102). No test starts a real user unit.
• The script checking the system config or the bus. The Console's own start check covers it.
• The allowed-user switch from username to uid (decision 101). That is an operator reinstall with this script after the cutover, not code.
• Row 77's service hardening notes (#1571).

Gate

Darkwing and Filbert each approve on #1576 naming the candidate manifest. The webui node suite and every scripts/test-*.sh green on Sage's gate rerun. Round 1 is wanted by 2026-10-12T15:00Z so it can land before the cutover at about 21:30Z.