# Census overlay claim-prev-rehearsal (claim trial: arm an updater-installed box; controller ruling R1, plus platform-00's binding additions), loaded LAST, after claim-step6-artifacts-fix2. RULED by platform-1e 2026-10-18 as census-ruling-claim-prev-rehearsal: every row ACCEPTED as proposed (readChannelPolicy and channelInstall.refreshPrev new, internal/host envelope re-pinned; 2b's rows unchanged, no 9B8 entry, the seal stands); docs/superpowers/notes/census-proposal-claim-prev-rehearsal.md.
# carlos system install-channel --policy FILE (internal/host installchannel.go). Without --policy nothing changes: channelInstall.run keeps its digest and class (F,J4, census-ruling-region-ha-2b), and slotState, var openat2 and removeBeneath are unchanged and stay 2b's rows. install and checkFloor have no read site of their own (envelope only): with --policy the signed armed policy's verified floor stands in for the published one, and a published floor, or either half of one, must be the policy's bytes.
# Two new root-read units, both reached only through install-channel --policy, run as uid 0 at the box's root shell: readChannelPolicy reads the operator-staged policy file and refuses it before anything else unless it is an armed policy (its signature is verified once the release key is known); channelInstall.refreshPrev, the one admission of an updated box at the channel head, Lstats carlos.prev to refuse a symlink or a non-regular file before the updater's own notePrev refreshes it from carlos.
# The seal stands: no accepted-legacy row. No box agent, update, recovery or edge path reaches either new unit. The 9B8 inventory is unchanged: install-channel writes only local files.
@coverage	internal/host	422bed5ca44ec32c8eab923ad6b96c7a39c50829c4a3346f004fb2383b3dad9e
internal/host/installchannel.go	readChannelPolicy	authority	F,J4	rev3=census-ruling-claim-prev-rehearsal;identity=uid 0 at the box's attended root shell (carlos system install-channel --policy);basis=reads the operator-staged --policy file once, before the apply lock or any store read; refuses an unreadable file or one that is not an armed policy; the bytes are used only after channelPolicy verifies the root-signed moves-protocol authorization for this deployment's bucket under CARLOS_RELEASE_PUBKEY, and a published floor must equal them byte for byte	file:ReadFile@67	631724a2f53e641e7b5d4d42c927e8687472000f2ad506fa9ee64f0bb146e77f
internal/host/installchannel.go	channelInstall.refreshPrev	authority	F,J4	rev3=census-ruling-claim-prev-rehearsal;identity=uid 0 at the box's attended root shell (carlos system install-channel --policy);basis=under the apply lock, after the armed-guard, other-release and floor refusals: carlos must hash, through slotState's O_NOFOLLOW descriptor, to the channel release's signed artifact sha256; its one read site Lstats carlos.prev to refuse a symlink or anything but a regular file; carlos.prev is then refreshed from carlos by the updater's notePrev and both slots are re-hashed before the identity is kept; nothing is fetched or executed and applied.json and seen.json are not written	file:Lstat@907	d0848383f68009331536d067c1cade578186514edb351645a7a3ad2e250a7bf5