# Census overlay adopt-unit-root-pass-315 (amadan #315: a non-root agent hands named-unit routes and their process group to the root pass), loaded LAST, after claim-guard-umask. RULED (platform-1e, 2026-10-20, #280): accepted as proposed.
# adoptHost re-pinned at its class and task: the new hand-off precedes staging and only returns. type passConfig gains a bool. unitServed (new) reads registry routes exactly as processGroup does and classifies with it. carlos adopt (root) never sets RootRestartsUnits, so root reads are unchanged. The seal stands: no accepted-legacy row.
@coverage	internal/release	4aafab144b1b742b27cab13ded61276b5203a64eb94f12203b6b94adddd0ae83
@coverage	internal/host	c589ae17ec476291bd5cd103f10909b55ddcacdc1bddff76800078133766665e
internal/release/adopt.go	adoptHost	authority	B3,E1,E2,E3,E4,J1	E16: root first-registration creation evidence under release exclusion; exact installation identity is required for first-program adoption and is consumed before an attempt. Installed-program history comes from the verified claim launch. Fixtures: TestPlan14FreshInstallRegistration, TestPlan14FreshInstallProgramGate, TestPlan14FreshInstallCanonicalIdentity, TestPlan14FreshInstallLaunchObservation, TestPlan14InstalledLaunchProgramEvidence, TestPlan14FreshInstallProcessCrash, TestPlan14FreshInstallVisibleSync, TestClaimControlUnitInstallers. E22: root generation pins guard existing-tree artifact and manifest writes in adoption and moves-held staging/publication. Held snapshot is read under release exclusion before the leaf held-stage lock; failures remain restrictive for writes. Claims-off source returns no root pins. Fresh wholly absent version trees retain signed staging. Fixtures: TestPlan14GenerationSiblingWrites, TestPlan14GenerationVerifiedSiblingWrites, TestPlan14GenerationHeldStage (production source assembly, both flag values without census, lock order, pin/error/fresh cases). Production completeness remains unavailable; no new completeness grant.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=applies root settings to canonically resolved routes including named units while legacy settings eligibility remains unchanged;rev3=PROPOSED-p3;run=16;basis=P3-R11 approved punctuation edit only; authority and reads unchanged;rev3=census-ruling-315;identity=legacy agent pass uid carlos (RootRestartsUnits; never set on carlos adopt);basis=a non-root agent pass hands a route its named unit serves (unitServed) to root through the stage relay before staging or repointing; root adopt reads unchanged	registry:App@11360,registry:App@11520,registry:App@12549,registry:App@13475,registry:App@15054,registry:App@20213,registry:App@25689,registry:App@3144,registry:App@33448,registry:App@6758,registry:App@8059,registry:App@8253,registry:Hibernate@34309,registry:Host@10484,registry:Host@11240,registry:Host@11273,registry:Host@11373,registry:Host@11533,registry:Host@11635,registry:Host@11667,registry:Host@11732,registry:Host@12182,registry:Host@12315,registry:Host@12762,registry:Host@12871,registry:Host@13073,registry:Host@13565,registry:Host@14351,registry:Host@14826,registry:Host@15040,registry:Host@15382,registry:Host@15972,registry:Host@19703,registry:Host@19811,registry:Host@20181,registry:Host@21001,registry:Host@2105,registry:Host@21159,registry:Host@21621,registry:Host@21673,registry:Host@21820,registry:Host@21907,registry:Host@2294,registry:Host@23013,registry:Host@23257,registry:Host@2375,registry:Host@23917,registry:Host@24302,registry:Host@24443,registry:Host@25657,registry:Host@25784,registry:Host@27126,registry:Host@27776,registry:Host@31009,registry:Host@3157,registry:Host@31627,registry:Host@31952,registry:Host@32026,registry:Host@32273,registry:Host@32424,registry:Host@33620,registry:Host@33787,registry:Host@33894,registry:Host@34122,registry:Host@34265,registry:Host@35010,registry:Host@35136,registry:Host@35224,registry:Host@4469,registry:Host@4583,registry:Host@5546,registry:Host@5651,registry:Host@6870,registry:Host@6918,registry:Host@7035,registry:Host@7067,registry:Host@7945,registry:Host@8113,registry:Host@8239,registry:Host@8358,registry:Host@8836,registry:Host@9223,registry:Host@9449,registry:Host@9545,registry:Host@9636,registry:Kind@554,registry:Unit@32172,registry:Unit@579,whole:Route@10073,whole:Route@10427,whole:Route@11355,whole:Route@11515,whole:Route@12539,whole:Route@13465,whole:Route@15022,whole:Route@15587,whole:Route@15948,whole:Route@17171,whole:Route@17474,whole:Route@17630,whole:Route@19960,whole:Route@20104,whole:Route@20203,whole:Route@2206,whole:Route@22742,whole:Route@23141,whole:Route@25679,whole:Route@30580,whole:Route@3139,whole:Route@33596,whole:Route@3595,whole:Route@4347,whole:Route@6753	219694d85c22b7886a4ebc62be97888bf993af79d5c0df134b95e0480b2db992
internal/release/adopt.go	type passConfig	authority	E2,E3	E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=stores the typed census-only root update provider and per-pass resolved input authority;rev3=census-ruling-315;identity=legacy agent pass uid carlos (RootRestartsUnits; never set on carlos adopt);basis=adds the unitsToRoot bool set by RootRestartsUnits; reads nothing		60131fde0633bcee3db957f9f898b6e9eef96f1a84f2f2f03a7ab0d9b05db6ad
internal/release/rollback.go	unitServed	authority	B3,E1,E3,J1	root-route;kept=B3,E1,E3;scope=protected-decision-only;rev3=census-ruling-315;identity=legacy agent pass uid carlos (RootRestartsUnits; never set on carlos adopt);basis=processGroup membership inverted (same account, app, channel and non-empty upstream as a route naming a unit); only ever narrows the agent pass to a hand-off; a registry list failure hands off; no file read	registry:App@281,registry:App@290,registry:Host@244,registry:Host@254,registry:Unit@265,registry:Unit@70,whole:Route@119,whole:Route@233,whole:Route@316,whole:Route@335,whole:Route@351,whole:Route@379,whole:Route@398	fef7b67b13241535f225f634f776d2822837a734ca6a25ea732ef37d9b7909e9