**Filbert review, row 87 round 5: approve.**

Candidate: commit 232e05449 (232e0544995de283b00e175fa7a4b0290db715a4), diff from e5dbcf626 on the design `docs/plans/2026-10-18_containerized-install-design.md` and the rows `docs/plans/2026-10-18_containerized-install-rows.md`. Line numbers are at 232e05449.

No test reads either file (`grep -rlF containerized-install packages/*/tests scripts/test-*.sh` finds nothing), so under decision 137 the items below are doc-only and don't block.

## My round 4 follow-up: answered

The stop timeout now covers both close waits. The host passes `MOSAIC_CLOSE_TIMEOUT_MS` from the constant I6 exports, the entry refuses to start without it, and the core stop timeout is 2 x 20 s + 5 s = 45 s (design.md:165-173). The leftover rule passes it to `docker stop -t` (design.md:233-235). I6 tests a notifier slower than one close timeout and checks `writer.lock` is gone (rows.md:469-471). That is what I asked for. Checked: `CLOSE_TIMEOUT_MS = 20000` at packages/cli/src/host.mjs:30, the two waits at :343 and :347.

## The rest of the round

- **Name keyed on the store** (design.md:153-164). Two data roots with the same business get two names, and I6 tests that stopping one leaves the other running (rows.md:472-474).
- **`{from, pid}` line and `connected`** (design.md:178-197). The rule is one-way and covers the exit line, the client ending and a failed stdin write, and `send`/`kill` return false after. The `connected` checks it relies on are at host.mjs:256, :342 and :346. I6 tests the exit-line and client-exit cases (rows.md:476-477).
- **`host.pids`** (design.md:198-207). Null in containerized mode, with the reason (a container pid passed to `process.kill` hits a host process), and the pid tests stay in local mode. `firstReply` :129, `ended` :148 and `watchChildren` :159-165 match.

## Doc-only, follow-up

1. design.md:161-162 says the engine refuses a second core container for the store, but not what bus start reports when it does. After the leftover rule that should only happen if a container survives `rm -f` or another host races past `host.lock`. Name the refusal (a code or message) so I6's builder doesn't pick one.
2. The name hashes the real path of `<dataRoot>/bus` (design.md:156-157), but the label and the leftover filter use `<dataRoot>/bus` as written (design.md:155, 232, 249-250). With a symlinked data root, two spellings of one store get the same name and different labels, so the leftover rule misses the old container and the run hits item 1. Use the real path in the label too, or say the data root is resolved first.
3. A real path needs `<dataRoot>/bus` to exist. The host creates only `bus-host/` (host.mjs:80, :120); today the broker creates the store (packages/bus/src/store.mjs:126). Say the host creates `<dataRoot>/bus` before it hashes and mounts it.
4. design.md:201-202 says the listed tests "signal a fork by pid". host.test.mjs:612 finds the child by pid and sends it IPC (`children.find((c) => c.pid === host.pids.broker).send(...)`), and :201-204 read `/proc/<pid>` for every `host.pids` entry. Both still need local mode, so the conclusion holds; list :201-204 and say "reach" rather than "signal".

## Not run by me

Nothing executed. This is a read of the diff and the cited lines in host.mjs and host.test.mjs.

Verdict: **approve**, with follow-ups 1 to 4.