# Census overlay claim-step6-artifacts-fix1 (fix round 1 after Astra's review: controller rulings F1, F3 and F4; F2 accepted as a trial gap), loaded LAST, after claim-step6-artifacts. RULED by platform-1e 2026-10-18 as census-ruling-claim-step6-artifacts-fix1: every row ACCEPTED as proposed (2 changed, 3 new, 1 removed), with the 9B8 entry putAttempts.Put as nonrecord; the seal stands; docs/superpowers/notes/census-proposal-claim-step6-artifacts.md, section "Fix round 1".
# F1 internal/release ArtifactBuild now runs release.CheckELFBounds (new, elfbounds.go: fixed-offset header reads only, no read site) before buildinfo.Read. F3 claimactivation sumsNameRelease (no read site) binds the signed sums to the tag through its two debs. F4 internal/host: claims run reserves --out before the phase runs (reserveActivationOutputAt), writes and reads it back through the held descriptor (activationOutput.finish), and removes it only while the entry is still its own file (activationOutput.ours); writeActivationOutputAt is gone (@remove: its checks moved into reserveActivationOutputAt and activationOutput.finish).
# The seal stands: no accepted-legacy row. No box agent, update, recovery or edge path reaches any changed unit.
@coverage	internal/claimactivation	ee00b6e03fe3a0148a2b1e2835f21852f9a3498cec00f34bcbb3895b0519f45e
@coverage	internal/host	8105036aeaefbe18f9236cf798d39cb90c8db6a910e86b6312ce1e2feeec0858
@coverage	internal/release	158c6cc42d90632619f4c8c41b47238c3cbdc2170f58c3a8fb7c7a12d2032783
@remove	internal/host/activation_artifacts_linux.go	writeActivationOutputAt
internal/release/program.go	ArtifactBuild	authority	G,J4	rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host (publish-identity);basis=release.CheckELFBounds first: ELF64 little-endian EM_AARCH64, at most 256 sections and 64 segments, every table and range inside the file, no overlap, no SHF_COMPRESSED; then build info of bytes already hashed against a signed manifest; one plain -X version.Build flag or nothing; reads the recorded flag, not the linked value (F2 trial gap); no box path calls it	file:Read@96	e89aeb9befc84a21f8f43d4c13e03f7246f00bf464813aa326083c9e6a3b1984
internal/host/activation_command_linux.go	runSystemClaims	authority	G,J4	rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0;basis=as census-ruling-claim-step6-artifacts; run reserves --out for sign-policy and publish-identity by exclusive create before the phase can write, and runs the phase on a store that records write attempts	file:Read@1602	0d740c974987081d35a3ce3b8cc71d2584ad28f591d47b65c105766598421eef
internal/host/activation_artifacts_linux.go	reserveActivationOutputAt	authority	G,J4	rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host;basis=checked root-owned parent; refuses any existing entry without following it; exclusive 0600 create held open, owner checked, directory synced; dry-run only checks the path is free	file:Fstat@659,file:Fstatat@236	0c47fca349ad833e49f479a448437a66377a18ee3f4952fee17946261abc2235
internal/host/activation_artifacts_linux.go	activationOutput.finish	authority	G,J4	rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host;basis=writes the phase's exact bytes through the held descriptor, syncs, reads them back through it, requires mode 0600, one link and the entry still its own file, syncs the directory	file:Fstat@402,file:ReadAt@293	24d118853d45c9db4e8223db6f6dae810714415bdaf90c9442a7e50f96eebef9
internal/host/activation_artifacts_linux.go	activationOutput.ours	authority	G,J4	rev3=census-ruling-claim-step6-artifacts-fix1;identity=explicit operator CLI uid 0 on the trusted signing host;basis=compares the directory entry, not followed, with the held file's device and inode; abandon removes only a match	file:Fstatat@69	a3056d2b0d2b2090c723aec8beb7633ed0a3418a078c9721e52e0c37730173da