stack/agents/darkwing/work/queue-83-review/review-r1.md

Row 83, the unit script takes --send, round 1 review (Darkwing)

Issue #1576, request comment 27713, packet agents/dewey/work/queue-83/ (commit e1bf582a). Brief: docs/plans/2026-10-12_console-service-send.md (blob f8d14d70, rev 630), with lead decisions 101 and 102. Base d13b9300. Candidate manifest sha256 f764cd9e4f8bdcd43c1db387e9408ab0538fb1a63820820806e5b65f93420b66, 4 files, matching the request.

Verdict: approve. The script refuses --send without the whole preview set before it writes anything, appends --send last when it's allowed, and leaves every other render byte for byte as the base. The start wording names Jason and Mos as decision 102 says. Nothing blocks. Three small notes, and my answers to Dewey's two reviewer points.

Method

• A detached worktree at d13b9300 with git apply --index build.patch, then sha256sum -c on the manifest: 4 OK, and again after the mutants. git diff --cached --binary d13b9300 there hashes the same as build.patch (18810948…). No commit from d13b9300 to 15dcac12 touches the 4 paths.
• I read the whole patch against the brief, decisions 101 and 102, serve's flag parsing (packages/webui/src/cli.mjs 16 to 37) and its allowed-user check (serve.mjs 120 and 128).
• Six WebUI test files, a byte-identity check of my own against the base script, then 8 mutants of my own (r1/mutants.sh) aimed at sites Dewey's 15 don't name. Each edits one site with queue-59-review/r1/mut.mjs, runs service.test.mjs and restores from the worktree index.

Node v26.8.1, TMPDIR=~/darkwing-scratch/rv83/tmp.

The script

The refusal. [ "$SEND" = 0 ] || [ "$preview" -eq 3 ] || die ... runs in serve_flags before the value checks, and install calls render before mkdir, so a refused install creates nothing and leaves an installed unit alone. The message is serve's own (cli.mjs:37) with the script's prefix. Running the --send check before "all three or none" is the right order: an operator who asked for sending learns why it was refused.

The append. --send is the last flag, after --allow-user. Serve treats --send as a flag only where a flag is expected; after --allow-user it's the value (cli.mjs 18 to 20). So --allow-user --send is a read-only Console whose allowed user is the string --send, and --allow-user --send --send sends. The script parses the same way.

Status. ^ExecStart=.* --allow-user [^ ][^ ]* --send$ agrees with serve in both cases above. I looked for a read-only unit it could still read as sending. --allow-user can only appear as the flag itself: the public host and auth header must start with a letter or digit, and no value can carry a space. The template's ExecStart is one line (mosaic-webui.service.in:24). A wrong answer here would also be the safe one, since it would say a read-only unit sends.

Byte identity. Besides Dewey's 86 argument lists, I rendered 11 with the base script and the candidate side by side in the same tree (r1/identity.txt): no flags, each serve flag alone, decision 101's cutover set (--auth-header X-authentik-username --allow-user jason.woltje), everything together, --allow-user --send, and four refusals. Output and exit status match on all 11. With --send, the cutover set renders ... --allow-user jason.woltje --send.

The wording. The header comment, TOOLS.md and the README now say Jason starts and restarts the Console, and Mos may under decision 102, with sends then entering the trail as Jason. Any other agent starting it works around the human proof. The install message says the same more briefly, ending "no other agent does". There's still no start, stop or restart verb, and install changed only its message.

Tests and mutants

On the candidate, 04:01:50Z to 04:02:12Z on 2026-10-12 (r1/tests-light.txt): service 15, serve 4, send 13, shell 5, bus 9 and preview 11, all pass, 0 fail. I didn't run the full gate. Dewey's is green, Filbert's was running, and Sage reruns it.

Filbert's gate started shortly before my mutants. Mine were single service.test.mjs runs, 04:02:59Z to 04:03:09Z, in my own worktree and TMPDIR, with nothing shared with their tree.

Mutant	Edit	Result
install-mkdir-first	mkdir before render	killed: the install test, the refusal test
install-refusal-continues	install goes on after a refused render	killed: the install test, the refusal test
msg-no-mos	the install message drops Mos	killed: the install --send test
status-send-before-unit-check	the send line before the unit check	killed: the install --send test
status-reads-template	status greps the template, not the unit	killed: the install --send test
send-check-inside-block	the --send check inside the preview block	killed: the refusal test
usage-no-send	the usage text drops [--send]	survives
send-append-inside-block	the append inside the preview block	survives, equivalent

send-append-inside-block can't change behaviour, because the check above it guarantees the preview set whenever SEND is 1. usage-no-send is note 1.

Notes

1. Nothing tests the usage text. USAGE and --help now name [--send], and Dewey's identity run lists that as an expected difference, but no test asserts it. A line in the usage test matching --allow-user ID \[--send\] would hold it. Cosmetic.

2. The README service paragraph has one unwrapped line. Line 106 is 102 characters: "(lead decisions 62 and 94). Without --send the unit is read-only. The script takes --send (row 83)". It reads fine rendered. A follow-up or the landing commit can reflow it.

3. The install message gives the rule, not the reason. The brief asks each place to say that any other agent starting the Console works around the human proof. The install message says "no other agent does". I'm fine with the short form in a terminal message, since the header comment it points at gives the reason. If Sage wants the brief's words exactly, it's one line.

Dewey's reviewer points

Allowed users that start with -. I agree it's a follow-up and not this row. The status check is sound in the meantime, as above. When it's taken up, I'd refuse a leading - in both the script and serve's USER pattern, so the two keep parsing the same way. No real allowed user from decision 101, a username or a 64-character hex uid, starts with one.

The template comment. Agreed. Changing mosaic-webui.service.in lines 6 to 9 changes every rendered unit, which this row rules out. It belongs with a template change and the render tests that pin it, on the follow-up list.