# Claim activation tools overlay, loaded LAST. RULED by the Plan 14 controller 2026-10-17 as census-ruling-activation-tools: every row marked PROPOSED is ACCEPTED as written. That rests on the tools authority review, re-checks 1-6, and whole-branch review 5 plus the final re-check ('MERGE: approve' at 43ff0259). The automated offline-window rows were removed (census-ruling-activation-tools-removal). The marker text is kept because frozen and restated rows fingerprint their basis. @coverage . 2145f21807743eb683387a61738d6bb16d9c41d7d69a9071dbac765ccd9ec2d6 @coverage internal/claimactivation 625d82dce14bae92f619077ca92a8c9066a9446545dfcc96a6f818e89e20d4c2 @coverage internal/host 6673bed5fb74d6225f52a97683e7efd7cb13f97f032490c940c0cc258b1565d9 @coverage internal/hostfence 552570510fb62d2a8822a3f24fa76aeb1437c0a9516966dc5ce15ef58e3fb4c6 internal/claimactivation/runner.go Runner.Run authority F,G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=trusted operator phases bind expected signed roster revision, exact deployment and actors; verify each write; dry-run overlay never calls backing Put file:Read@310,file:Read@5986,file:Read@6318 683059aedf27656d4b49c88102089b2bb2f2ce7fcc108ff8545e52a86a0f8385 internal/claimactivation/runner.go checkedStore.Delete authority F,G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=trusted operator phases bind expected signed roster revision, exact deployment and actors; verify each write; dry-run overlay never calls backing Put 6bc9103a30cfd53cea59d611ccacb7dcc0ca0ea620b403497ef543f5bdaa0217 internal/claimactivation/runner.go checkedStore.Get authority F,G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=trusted operator phases bind expected signed roster revision, exact deployment and actors; verify each write; dry-run overlay never calls backing Put 366fec104118e7bce2b71ede13e7c8c72314d99fd32f773967e31018b0f0fbd6 internal/claimactivation/runner.go checkedStore.Put authority F,G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=trusted operator phases bind expected signed roster revision, exact deployment and actors; verify each write; dry-run overlay never calls backing Put file:Read@1357 26c6e1f7cb2a057ef8b19deb30bc18fd62fe08f81ff48fd4022bdfc3dd22d6b0 internal/host/activation_command.go RunSystemClaims authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=dispatches explicit operator arguments to the platform command implementation and exits on error; wrapper adds no authority checks cc8289fbcb3f34d8d43cd912a6a43ace727ed7289c6c32c5d35c8d00e6194cf3 @removed internal/host/activation_command_linux.go activationProcessesDrained G,J4 census-ruling-activation-tools-removal internal/host/activation_command_linux.go runSystemClaims authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=explicit command validates per-command arguments, protected input files and signed roster revisions or matching signing key before invoking phased writes, reporting or installers; dry-run propagates without writes; install-control requires offline migration preflight file:Read@1518 b71131cace86703746375d4525b91e69c35a4702021e8a003545cb2d78eefd0b internal/host/activation_command_other.go runSystemClaims authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=non-Linux command returns the activation refusal without executing any installer or signed phase fcf45d665275c2ac99ff9bfc37302217bb6134b34ff74c3b17f50d1348760151 internal/host/activation_console.go activationConsoleEnvironment authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=checks roster, local enrollment, compute binding and existing environment before deriving the exact console runtime environment; rejects conflicting keys and scope 9d1144ac45e5849f43872d12ac6389c620ad07f0b2e69575a1353bfaf218b9fd internal/host/activation_install.go activationEnvironment authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=parses environment assignments, rejecting invalid or duplicate keys, unsupported quoting, escapes and embedded controls 289ff3c1267e613afd102f83f68592bfd99dafc3d6b7eaba05e630e6b2e7be3e internal/host/activation_install.go activationUnitSettings authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=requires claims enabled and local region, defaults data and opt roots, and rejects nonabsolute, unclean or root directory paths data-literal@253,data-literal@427 5e540dae93fb146cc116d647677b7ca4d6fc6bc1ae0efb609b05fa907eba1fce internal/host/activation_install_linux.go activationDir authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=requires root caller and absolute clean path; traverses root-owned non-writable directories by no-follow descriptors and fsyncs permitted directory creation file:Fstat@1016,file:Fstat@398,file:Open@189,file:Openat@566,file:Openat@814 78d11f56b448ba6e5ba8dfb021cae1c286dcbaceb379dbfdd4bf6a0236efdd46 internal/host/activation_install_linux.go activationLock authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=opens protected activation lock at checked directory, requires root-owned mode 0600 and takes exclusive nonblocking flock file:Fstat@224 f51423c16e9f9ca1226a02178155cedfae7e38cfb450524899841295e01d219f internal/host/activation_install_linux.go activationRead authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=opens checked parent directory and delegates bounded protected file reading by basename fee48092f7a26b0de5409052d63e6aa48ff830b66edf01a035be514a0470f22f internal/host/activation_install_linux.go activationReadAt authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=opens file relative to checked directory, verifies root ownership, non-writable mode and requested private permissions, and limits input to 64 KiB file:Fstat@234,file:ReadAll@440 5caf00466afd942308bdcb33b469b212f97bfcdcde3e1fc4847824b1859d29af internal/host/activation_install_linux.go installActivationConsole authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=checks protected environment and drop-in parents, permits only exact existing content or claims-off predecessor, locks writes, durably writes and reads back both files, then reloads systemd; dry-run writes nothing 3a6bdc41ae970453395ae516ad5183b70af7ec191279ba0431c2a12b913dcad9 internal/host/activation_install_linux.go installActivationControl authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=checks protected environment and local claim settings, refuses masked or symlinked controller unit, locks installation, prepares root retry directory, writes rendered shipped unit and verifies readback before reload; dry-run writes nothing file:ReadFile@616 16e3c76c1d1d06fc429725cfeaee21b17d6a37620da287b40482b12e2f6b20a5 internal/host/activation_install_linux.go installActivationEvidenceKey authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=validates box/key binding, reads or exclusively installs private evidence key under protected directory lock, checks durable readback and expected public key, and signs the exact binding; dry-run does not generate a key 74f311fcb31aec95f5760ae9781186cc44a6f650858349c379e82f3a1fc6fd10 internal/host/activation_install_linux.go installActivationFenceCredentials authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=validates private credential source against exact bucket, region and role; locks protected target, refuses different existing bytes or receipt, writes missing credentials and installation receipt with readback; dry-run writes nothing 9e18de6df5fb9d3e6898967c9ed91e72d19faf5fd6bff7331ee654d76dfe7075 @removed internal/host/activation_offline_linux.go activationOffline.begin G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.checkItem G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.dirs G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.point G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.prepare G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.preview G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.read G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.replace G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.restore G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.save G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.status G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOfflineUnits G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationUnitSnapshot G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go sameActivationFile G,J4 census-ruling-activation-tools-removal internal/hostfence/activation_credentials.go ActivationCredentialReceipt authority F,J4 rev3=PROPOSED-activation-tools;identity=root fence service and explicit installer uid 0;basis=dedicated root fence credentials retain 0400 compatibility; 0600 needs a matching protected installation receipt; absent explicit installation keeps prior refusal 63ffd51457e632687bc44f776fd5c0335748a899e623ff67a0dea31be4ffa7f2 internal/hostfence/activation_credentials.go ValidateActivationCredentials authority F,J4 rev3=PROPOSED-activation-tools;identity=root fence service and explicit installer uid 0;basis=dedicated root fence credentials retain 0400 compatibility; 0600 needs a matching protected installation receipt; absent explicit installation keeps prior refusal 9a08dd0349bd4bd43ef44d6e621876d43e8c151dcb355ef94c9f134776f0f4d9 internal/hostfence/activation_credentials.go VerifyActivationCredentialReceipt authority F,J4 rev3=PROPOSED-activation-tools;identity=root fence service and explicit installer uid 0;basis=dedicated root fence credentials retain 0400 compatibility; 0600 needs a matching protected installation receipt; absent explicit installation keeps prior refusal bd06fbd520d6808a635f8e3a4a8a5b8a389beb1d1374d56848853b1ad6855d84 internal/hostfence/activation_credentials.go activationCredentialReader authority F,J4 rev3=PROPOSED-activation-tools;identity=root fence service and explicit installer uid 0;basis=dedicated root fence credentials retain 0400 compatibility; 0600 needs a matching protected installation receipt; absent explicit installation keeps prior refusal file:ReadAll@480,file:ReadAll@78,file:Stat@372 126e54d8062b988cfd43130bf4bfe74ae753ae6ec507f10a83901690337218aa internal/hostfence/writer.go OpenRootFenceStore authority F,J4 rev3=PROPOSED-activation-tools;identity=root fence service and explicit installer uid 0;basis=dedicated root fence credentials retain 0400 compatibility; 0600 needs a matching protected installation receipt; absent explicit installation keeps prior refusal file:Stat@346 ec25dedc946b9be45336b89962a9b55f940cb24e747c4f3284d8fc3458e27482 system.go runSystem authority B,C,D,F,G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=adds explicit system claims operator dispatch; every existing command branch unchanged cc1e9869168e2032eb13f5c4c8c26e56c0f5c1f4066dc65c42314fbc117d10a7 system.go systemVerb authority B,C,D,F,G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=adds explicit system claims operator dispatch; every existing command branch unchanged 67c544800333987eda7d7f0ee1f97b9a50da2619b7d4c6f34fc87c23a06ff289 internal/host/activation_console_report_linux.go activationConsolePID authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=signed roster and identity, protected guard and configuration, live systemd MainPID plus proc boot/namespace/start/cgroup/executable; exact private box report CAS and readback; no automatic call e8ebb8a006f4b8407e377ddb01e39162e0bbc5d88f656bfc07cc4220828281c2 internal/host/activation_console_report_linux.go activationConsoleProcess authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=signed roster and identity, protected guard and configuration, live systemd MainPID plus proc boot/namespace/start/cgroup/executable; exact private box report CAS and readback; no automatic call file:Fstat@5748,file:Open@5443,file:ReadFile@3554,file:ReadFile@3703,file:ReadFile@4156,file:ReadFile@4369,file:ReadFile@4520,file:Stat@4002,file:Stat@5543,file:Stat@5614 29235a700ba8fece0602b97a216a4db9d0d9471e3d59a2da4e913f443fbfa923 internal/host/activation_console_report_linux.go publishActivationConsoleReport authority G,J4 rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=signed roster and identity, protected guard and configuration, live systemd MainPID plus proc boot/namespace/start/cgroup/executable; exact private box report CAS and readback; no automatic call file:Read@2593,file:Read@296 f33733cab3dfbeede384906fdfb4649305dbaa27f756964df2abccdab8408cbb @removed internal/host/activation_seed_linux.go activationOffline.seed G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go activationSeedDropIns G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go activationSeedPreflight G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go const activationSeedDropIn G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go const activationSeedUnit G,J4 census-ruling-activation-tools-removal @coverage scripts 3ce4672ec33aaabdbadf5dd30e28ff6dda9d012bd55936093f57faf9fcabecab scripts/activation-tools-root-runner.sh external diagnostic G,J4 rev3=PROPOSED-activation-tools;identity=authorized root-runner operator;basis=builds real console and CLI into test-only embedded images; serial designated runner invocation; deletes only owned build artifacts file:external@0 17400986085d3a406062f45c9669f88c833502f7bbde138f300db9d5e8a86a51 @removed internal/host/activation_seed_linux.go activationOffline.seedGuard G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go activationOffline.seedGuardCheck G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go activationOffline.seedGuardReplace G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go activationOffline.seedRemask G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go const activationSeedGuardOriginal G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go const activationSeedGuardReplacement G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_seed_linux.go activationSeedReadAt G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_adoption_linux.go activationAdoptionAllowed G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_adoption_other.go activationAdoptionAllowed G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go var activationEdgeUnit G,J4 census-ruling-activation-tools-removal internal/host/agent.go runAdoptUnderRootRelease authority B3,E1,E2,E3 rev3=PROPOSED-activation-tools;run=27;basis=automated offline transaction removed; retains preceding integrated classification: rev3=PROPOSED-p3;run=24;identity=root claim/adopt/update controller uid 0;basis=selects census participation before adding root history or named recovery; absent census uses main pass options with no recovery pre-list or per-host lookup; trace covers either flag and empty, non-adoptable and ordinary routes whole:Route@11104,whole:Route@18400,whole:Route@18436,whole:Route@8406 3031d8ce5a8d23390dee282dd299856f2c837b7bf1fb15599e4cd74692535294 internal/host/systemunits.go ensureSystemUnits authority F,J4 rev3=PROPOSED-activation-tools;run=27;basis=automated offline transaction removed; retains preceding integrated classification: root-input;kept=F;scope=protected-decision-only file:OpenFile@265,file:ReadFile@2908,file:ReadFile@3041,file:ReadFile@3955,file:Stat@2817 984a691e04c28368d7015285d14952add40ce02ce24aab8d3786e80a99af4053 internal/host/systemapply.go systemApplier.Run authority D,F,J4 rev3=PROPOSED-activation-tools;run=27;basis=automated offline transaction removed; retains preceding integrated classification: root-input;kept=D,F;scope=protected-decision-only PROPOSED E43: root; release-held context and D3 reservation/census verification under release-before-participation exclusion; no-census effects stay on the legacy path. TestPlan14LaunchVerifierToken, TestPlan14LaunchVerifierCallerOrder, TestPlan14LaunchVerifierNoCensus, TestPlan14LaunchVerifierRootRunner. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending. PROPOSED E45: root enforces census-gated release ordering, bounded acquisition and scoped recovery; registry timer primitives preserve supplied identity but producer integration remains pending. file:OpenFile@483 6a5704be83e35979db7f2811b8ea7fd3d4c2c74c9b532f9f94f1d5482cbeb827 @removed internal/host/activation_adoption_linux.go activationTransactionAllowed G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_adoption_other.go activationTransactionAllowed G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_settled_linux.go activationOffline.settled G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_settled_linux.go activationOffline.updateSettled G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.closeDifferences G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.reconcile G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_settled_linux.go activationOffline.updateDir G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_settled_linux.go activationOffline.updateUnitsSettled G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationRecordedState G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_settled_linux.go activationConfiguredUpdateRoot G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationSupportedBaseline G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.baseline G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.hold G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go activationOffline.heldDifferences G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_adoption_linux.go var errActivationRecoveryHeld G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_adoption_other.go var errActivationRecoveryHeld G,J4 census-ruling-activation-tools-removal @removed internal/host/activation_offline_linux.go var activationCanonicalBaseline G,J4 census-ruling-activation-tools-removal