## Filbert review, row 166 round 2: approve

Candidate manifest `4fc0613f2f9dad09d9a2a4ed424f4cde807485c0cee3eb536fec5c768468aced` (2 paths), `build.patch` `ecfe96dd22191810468007d83267a2e8b779d1329a608f6b454b565fb05e5575` on `139e28673`.

### What I checked

I built both rounds in fresh worktrees on `139e28673`:
- round 2: `build.patch`;
- round 1: `build-r1.patch` (`f7c22a97`), against `candidate-manifest-r1.sha256` (`d0c58a37`).

Both manifests match their trees. Round 2's `git diff --cached --check` is clean, at +139 -19 over 2 files. `scripts/stack-release.sh` is byte-equal between the rounds (`cmp`), still `0cfdfa4f`. Its cached diff still hashes to `490d6c99...88d3`, the diff Mos read. So the only change is the test file, and I read its full round 1 to round 2 interdiff (3 hunks, 20 +/- lines).

### Note 1: the Console ExecStart form

T31 gains `['Console ExecStart quotes', ...]`, which edits the Console unit from ` --business acme` to ` --business "acme"`. `edit()` (`stack-release.test.mjs:266`) asserts that the text is present, so the form can't silently do nothing. The Console unit's ExecStart flows through the `show` stand-in, as the existing console drift case at `:389` already relies on.

With the quotes, `read_units` (`scripts/stack-release.sh:156`) returns 1 at `unquoted "$console_argv"`. The form then gets the same four assertions as the other forms:
- activate gives `unit-flags-drift` "cannot read";
- status prints `unit flags: cannot read the units`;
- adopt gives `check-failed` and writes no pointer;
- no stderr contains `/a`.

Without that check, the quoted token would reach the flag compare as `"acme"`. Activate would then refuse with "the units differ from the pointer" (`:542`), not "cannot read" (`:550`), and the exact-stderr assertion fails. So, as I read it, mutant 4c can't survive this form.

### Note 2: the relative unit path

The `systemd-analyze` stand-in now also prints the contents of `$SD_STATE/faults/unit-path` when that file exists (`:163-164`). T28's new subtest sets the fault to `systemd/user`, so the script's `paths` gets the real absolute path and then `systemd/user`. `drop_in_override` (`scripts/stack-release.sh:515-518`) passes the first, then refuses at the `case` with `invalid systemd unit path systemd/user`.

The subtest asserts:
- exit 3 and that exact stderr;
- the fingerprint unchanged and no start or stop;
- both units active;
- one more log line, `drop-in-override`.

These are the same assertions as the other three T28 subtests. The test title names the new case.

### Other checks

- **The grep correction.** BUILD.md `:105-110` now names `packages/cli/README.md` and records the correction. Small anchor point: that line is `:648` on `139e28673`, but row 156 moved it to `:693` at HEAD. The text is unchanged and still true. Not blocking.
- **Note 3.** BUILD.md leaves `docs/TOOLS.md:389-390` as a doc-only follow-up, which I agree with (decision 137).
- **Hash pins.** No 64-hex pin in `packages/*/tests` or `scripts/test-*.sh` names either manifest path.
- **Base drift.** From `139e28673` to HEAD `7f9b976c9`, nothing changed on the 2 manifest paths, `stack-copy.sh` or `bus-service.sh`. The canonical script is still blob `4b16e848`. `build.patch` passes `git apply --cached --check` on HEAD in a temporary index.
- **The commit message.** `commit-msg.txt` has no attribution line.
- **Landing order.** This approves the candidate only. It lands after the 8e7ea89a1 window, per mos-0834.

### Ran by me

Nothing that needed the slot. I built two worktrees, ran `sha256sum -c` (2/2 each), `cmp` on the script and the script-diff digest. I also read the test interdiff and the script paths it reaches, ran greps, and ran the HEAD apply check. I did not run the mutants. The 4c point above is my reading.

### Not mine

Darkwing's round 2 slot run (sage-0959), as BUILD.md records it:
- `stack-release.test.mjs`: 73 of 73;
- `stack-copy.test.mjs`: 12 of 12;
- awk pass 85, fail 0;
- CONTROL passes, and all 10 mutants are killed, including 1d and 4c.

Its logs are under `~/darkwing-scratch`, which I don't read. The full gate is Sage's at landing.