# Census overlay claim-rootaws-sentinel (a scrubbed root parent's own disabled shared-file sentinels are not an override in a root child, so the child's scrub stays silent; found by platform-d8's deployment harness at G4: a guard-armed box refused every router update because the candidate's version printed the ALERT into the guarded updater's combined output), loaded LAST, after claim-empty-cohort-fix2. RULED (platform-1e, 2026-10-20): accepted. Envelope only: ScrubEnvironment has no classified root-read unit; no row changes and the seal stands.
@coverage	internal/rootaws	ad641674b84d17a9f6a7b1acb4cf88b68cc2a882812a28c8f622d4fd9616b470
# Also (CI fix, same ruling): hostInstallationPaths names the raw instance directory through layout.RawInstanceDir, a new exported accessor beside layout's rawInstanceDir, so the raw-directory guard holds; internal/host and internal/layout envelopes re-pinned here, and hostInstallationPaths's 9B8 digest re-pinned at its class (key-site, lit:instances).
@coverage	internal/layout	cbb195397ab6f0018704e745b30e57df56d49289de87a1132d2f7ba426cf006b
# Also (harness G4, parent side, same ruling): hostfloor's guarded run returns the image's stdout only through runImage (new), so stderr progress or an alert cannot corrupt the version or plan an updater parses; Disk.Run's exec site moved into runImage at its class, and Disk.Run's row is retired.
# (Merged with main 54ae7fb: the Disk.Run removal and the runImage row now live in main's overlay plan14-root-reads-armed-box-updates.tsv, which loads after this one, under the same ruling.)
@coverage	internal/hostfloor	ba748a60d9bd7a55d2d3c4a2fe17fc619c23aa2e813a88b164dff47e04a41a1f
# Also (harness G7, same ruling): journal-migrate's quiesce scan moved into scanQuiesceProcs (new), which skips the migration's own direct children (its service-user registry child) and names any other service-user process it refuses; procParent (new) reads a /proc stat's ppid. Classes carried from quiesceLegacyClaimJournals.
@coverage	internal/host	514745d2c20f8a38953bdfc8d22cb5f8d4001681baeacdc73f313ed9dbfa3c86
internal/host/claimjournal_migration_linux.go	quiesceLegacyClaimJournals	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-claim-rootaws-sentinel;basis=the /proc scan moved into scanQuiesceProcs; masks and stops as before	file:ReadFile@226,file:ReadFile@327	cbf95218a0314ac8cc50f8957e3e5d142e2bc7f8c76aac0fd9a36eac5e37f013
internal/host/claimjournal_migration_linux.go	scanQuiesceProcs	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-claim-rootaws-sentinel;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=lists /proc and stats each pid; refuses any service-uid process except the migration's own direct children (ppid from procParent); fails closed on an unreadable stat	file:ReadDir@78,file:Stat@271	10a651585d64dc7138549bdc586d6a1597c6df77afba5be3db180488d9fca16e
internal/host/claimjournal_migration_linux.go	procParent	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-claim-rootaws-sentinel;identity=the same, uid 0;basis=reads one /proc/<pid>/stat and parses the ppid after the last ')'; a malformed file is an error the scan refuses on	file:ReadFile@61	ad2c1fc49ec52ca978aeef9b33c015fd125b37df56586778bbf477af4720f130