# Census overlay claim-step6-artifacts (claim trial step 6 artefacts, approved by Paul 2026-10-18; owner platform-1e as the host claim's owner), loaded LAST, after box-publish-record. RULED by platform-1e 2026-10-18 as census-ruling-claim-step6-artifacts: every row ACCEPTED as proposed, both censuses; the seal stays fc584e11 and no 9B8 entry is needed; the proposal and the executing identity of each unit are docs/superpowers/notes/census-proposal-claim-step6-artifacts.md.
# R1 sign-policy (internal/claimactivation artifacts.go Runner.signPolicy): signs the armed hostfloor.Policy with hostfloor.ArmedPolicy, the signer hostfloor.Publish now shares (Authorize); writes nothing to the bucket; reads the floor pair only to refuse a different or half-published floor.
# R2 publish-identity (Runner.publishIdentity, identityRelease, consoleArtifact, readConsole): router sha256 from the vendor-signed SHA256SUMS.txt (publicrelease.VerifySums, no network); console sha256 from the console channel's root-verified pointer digest and its manifest (C2), the artefact read back, hashed and its version.Build stamp (release.ArtifactBuild) required to equal the tag; signed by release.SignSystemIdentity and published create-only through the existing release.PublishSystemIdentity and the runner's checkedStore (Put unchanged). Its file goes to claims run --out (writeActivationOutputAt, C4).
# R3 install-console (internal/host activation_artifacts_linux.go): root box installer copying a verified console into /opt/carlos/system/console/console and .prev (C3); it does not touch console.service.
# guard-arm (RunSystemGuardArm): its policy and identity parse moved, unchanged, into guardArmInputs so tests feed it the phases' files; the read sites are the same files in a new order.
# No box agent, update, recovery or edge path reaches any new unit: each is reached only from carlos system claims run, install-console or guard-arm, run by hand. Ruling 6: no effect on a claims-off or no-census box.
@coverage	internal/claimactivation	1a5ad17d5eb220f8603f8bfb7c034299af9de808e1152b339865c55bd5ff12ac
@coverage	internal/host	ce32b61817fba3f5c709c9e6e7e4951679f840a4b274ab97599b4d7359deff53
@coverage	internal/hostfloor	84f6f8b3de790df8f8db3fda540f6b86eb757a8ea322c6d5b5e5aaaef94ccaa0
@coverage	internal/publicrelease	77b1f61a7bf9c89468993db1a638b91b58ff1419ea3883ea62ce9749df378ad7
@coverage	internal/release	68357c92cbd5d37ac7b14c8880d690da016be211e1c03a7246b963bf2f93170b
internal/claimactivation/runner.go	Runner.Run	authority	F,G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit operator CLI uid 0 on the trusted signing host;basis=trusted operator phases bind expected signed roster revision, exact deployment and actors; verify each write; dry-run overlay never calls backing Put; sign-policy has no writable key and publish-identity only its tag's identity key	file:Read@310,file:Read@6223,file:Read@6838	f692a20a4e705b763bfb47501885d0afc4d35a8c76aeb502ef01f4a67250c14b
internal/claimactivation/artifacts.go	Runner.signPolicy	authority	F,G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit operator CLI uid 0 on the trusted signing host;basis=reads the published floor pair through the runner's checked store only to refuse a different, half-published or roster-unbound floor; signs with hostfloor.ArmedPolicy; writes nothing	file:Read@833	3b9d80cdb40d07febb76aa58db883b7140918f251a782caeca46bf186c837f88
internal/claimactivation/artifacts.go	readConsole	authority	F,G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit operator CLI uid 0 on the trusted signing host;basis=reads the console artefact the root-verified pointer and digest-checked manifest name, bounded to 512 MiB; the caller requires its sha256 and build stamp before any use	file:ReadAll@202	73f7833251f87e9996bf9baf5a9bd4103b4232fb78844a72800d4ee0dfbd9f83
internal/release/program.go	ArtifactBuild	authority	G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit operator CLI uid 0 on the trusted signing host (publish-identity);basis=parses build info of bytes already hashed against a signed manifest; returns a stamp only for exactly one plain -X version.Build flag; no box path calls it	file:Read@50	059d3c75e9b753e9f186a110d20a6f05182f6dc28bbe2950e78b1e55c48fee3a
internal/host/activation_command_linux.go	runSystemClaims	authority	G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit operator CLI uid 0;basis=explicit command validates per-command arguments, protected input files and signed roster revisions or matching signing key before invoking phased writes, reporting or installers; dry-run propagates without writes; install-control requires offline migration preflight; run takes --out only for sign-policy and publish-identity and checks it before signing; install-console verifies the staged identity against the published one	file:Read@1602	f39b0f0c3803392de7634edf278ae354e7bf611f69c0d8c7e06cf589eac70a18
internal/host/activation_artifacts_linux.go	writeActivationOutputAt	authority	G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit operator CLI uid 0 on the trusted signing host;basis=checked root-owned parent; refuses any existing entry without following it; creates exclusively 0600, fsyncs file and directory, reads back owner, mode and exact bytes; dry-run writes nothing	file:Fstat@1051,file:Fstatat@220,file:ReadAll@1126	90f83716bcedfde1c2df95da5507517d378cdf072f3bf27acbc42e035b7efe15
internal/host/activation_artifacts_linux.go	consoleDir	authority	G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit box installer uid 0 (claims install-console);basis=walks from / by no-follow descriptors; every component root-owned, not group or other writable and other-searchable; creates missing components 0755 and fsyncs the parent; the protected directory must be exactly 0755 root:root	file:Fstat@374,file:Open@196,file:Openat@1083,file:Openat@770	da62b08ade87fe3b24f9fb7dc3c7e32f4cbdcc8cc8797ca2162a264447f9c721
internal/host/activation_artifacts_linux.go	consoleSlotHolds	authority	G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit box installer uid 0 (claims install-console);basis=a slot is absent, or a root:root 0755 regular file with one link hashing to the identity's console sha256; anything else refuses	file:Fstatat@96	fc9eb31225e1fa57def05ebc3b704730590e5ebd419673c73d5a44a198d49464
internal/host/activation_artifacts_linux.go	installProtectedConsole	authority	G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit box installer uid 0 (claims install-console);basis=verifies the source bytes before creating anything; refuses foreign slots; writes .prev then current through private staging and rename, 0755 root; reads both back through hostfloor.OpenProtected and rehashes; .prev equals current (C3, install-channel A2-2); dry-run writes nothing	file:Fstat@1459	40e0d5fa1add46e9cb1f9f142ad6e662bd29705a806f82d5d3cb7d70fd628d01
internal/host/activation_artifacts_linux.go	readConsoleSource	authority	G,J4	rev3=census-ruling-claim-step6-artifacts;identity=explicit box installer uid 0 (claims install-console);basis=opens the source with no symlink followed on its path, regular file with one link, at most 512 MiB, and refuses it unless it hashes to the identity's console sha256	file:OpenFile@72,file:ReadAll@183	8db59f5b0d0d8af36c3e06de68f4cc694e005feb96a84566603976c356a334ee
internal/host/guardarm.go	RunSystemGuardArm	authority	F,J4	rev3=census-ruling-claim-step6-artifacts;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main; policy and identity parse moved unchanged into guardArmInputs, same files read	file:OpenFile@565,file:ReadFile@1572,file:ReadFile@5613,file:ReadFile@865,file:ReadFile@945,file:Stat@3264	e753096e19334946dab8e3bd4f06abe17187c8a62a775e4e43befa8daa168374