# Census overlay claim-step6-artifacts-fix2 (fix round 2 after Astra's re-review: controller rulings F1 and F5), loaded LAST, after claim-step6-artifacts-fix1. RULED by platform-1e 2026-10-18 as census-ruling-claim-step6-artifacts-fix2: every row ACCEPTED as proposed (reserveOutput new, reserveActivationOutputAt removed, internal/host and internal/release envelopes re-pinned); the 9B8 inventory and the seal are unchanged; docs/superpowers/notes/census-proposal-claim-step6-artifacts.md, section "Fix round 2".
# F1 internal/release CheckELFBounds (no read site) also caps the section-name table at 64 KiB, every name offset inside it and every name at 256 bytes up to its NUL, before ArtifactBuild calls buildinfo.Read (ArtifactBuild's digest is unchanged). F5 internal/host: a reserved --out file is never removed; activationOutput.abandon is gone, and every failure keeps the file and asks for a new --out path (outputKept, no read site). reserveActivationOutputAt is now a wrapper with no read site; its reads moved unchanged into reserveOutput, which also names the full path in its errors.
# The seal stands: no accepted-legacy row. No box agent, update, recovery or edge path reaches any changed unit. The 9B8 inventory is unchanged.
@coverage	internal/host	fd2371702b42080690d2b8c0442695bec53bcb34d8842e487007d7825d5fbf7b
@coverage	internal/release	f4b2953a76bf7cb0b50abfe6a7022181e127f1018710b41159349c6a8dd0f5bf
@remove	internal/host/activation_artifacts_linux.go	reserveActivationOutputAt
internal/host/activation_artifacts_linux.go	reserveOutput	authority	G,J4	rev3=census-ruling-claim-step6-artifacts-fix2;identity=explicit operator CLI uid 0 on the trusted signing host;basis=checked root-owned parent; refuses any existing entry without following it; exclusive 0600 create held open, owner checked, directory synced; never removes what it created: a failure after the create keeps the file and the error asks for a new --out path; dry-run only checks the path is free	file:Fstat@653,file:Fstatat@230	45021760106ca7a1a2216e160a770e407e91b1f42c67fc47bb2076283ba034f5