# Census overlay claim-step8-readiness (dev cohort-1 step 8 readiness: the backfill phases, leo's migration census classes, journal-migrate's window masks and umask, and the absent legacy directory), loaded LAST, after claim-guard-umask. RULED (platform-1e, 2026-10-20): accepted as proposed, under census-ruling-claim-step8-readiness; the proposal is docs/superpowers/notes/census-proposal-claim-step8-readiness.md.
# Existing units keep their class and task exactly; their bases add what changed. New units: backfillReady and Backfill.Done (signer), legacyRouteRow, claimMigrationSharedPaths, verifyMigrationWindow and rootPrivateEntry (journal-migrate). It adds no accepted-legacy row, so the seal stands.
@coverage	internal/claimactivation	fbb4d4d615bdb5c9aa7dece8c4cab680f0edf31aaf606b5f05ea50d4066f821f
@coverage	internal/host	7af2df2472fe86811814416b977dbd5d782fd813636eaeafd143ef7025f228ad
@coverage	internal/hostbox	46f97aa29603b9fcd9ee1f32fea80669c00df36601437eb5871b0cd83507e305
@coverage	internal/hostops	71bc9fe23edb5356320359700ce04409a4744214c796546c9856ca5d0c458368
internal/claimactivation/runner.go	Runner.Run	authority	F,G,J4	rev3=census-ruling-claim-step8-readiness;identity=explicit operator CLI uid 0 on the trusted signing host;basis=unchanged phases as ruled for claim-step6-artifacts; adds backfill-collect, backfill-adopt and backfill-done, whose only writable key is control/hosts-backfill.json, each write verified and read back, the dry-run overlay never calling backing Put	file:Read@310,file:Read@6322,file:Read@7365	2e16f7bcb0879a116f5b8ead539d424cd167cec3e8bb22bcb9c9d26568ca959d
internal/hostops/backfill_publish.go	Backfill.Done	authority	F,G,J4	rev3=census-ruling-claim-step8-readiness;identity=explicit operator CLI uid 0 on the trusted signing host (carlos system claims run backfill-done, the only caller);basis=new: reads the signed collecting plan, the roster, the record listing, control/hosts/, each app's admission and each keyed box's signed census report, refusing unless the listing is the plan's, no claim or admission exists and every keyed report verifies as the census verifies it and lists no installation; its one write is the plan as done under the collecting etag (If-Match), read back and checked by CheckCreateFreeze; it adopts and installs nothing	file:Read@3107,file:Read@544	9a5baeea4eace87c960d1df2a4b01487980b6b2b3f2aaf761835ae475ec34f4f
internal/claimactivation/backfill.go	backfillReady	authority	F,G,J4	rev3=census-ruling-claim-step8-readiness;identity=explicit operator CLI uid 0 on the trusted signing host;basis=refusal up front only: the signed roster must be published with a home region, and the published floor must verify under the release key to the roster's floor digest; it reads and grants nothing else	file:Read@240	ebbb04dde23cff468ca19227aa30ba6f3de738d3de173c809b95c5bb438d5885
internal/host/claimjournal_migration.go	RunSystemJournalMigrate	authority	G,J4	rev3=census-ruling-claim-step8-readiness;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=explicit offline root operator entry requests full G2 bootstrap after verified claim owner setup; --window is checked before anything is written and only lets the census accept the named window's own masks		2e9b7b851f6aba29dcdcd607d950ab5ae26c6a4291becfa35ff91e05d443cd8c
internal/host/rootmigration_census.go	rootMigrationCollector.collect	authority	G,J4	rev3=census-ruling-claim-step8-readiness;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=signed collecting manifest and actor directory bound complete records/claims census; registry Seeds are refusal-only; with the agent stopped and masked, a legacy route row is reported as a route installation only when legacyRouteRow matches it to its frozen record, which only nominates this box for that record's adoption (checked again by the adopter against the signed census and the committed domain claim) and installs nothing; any other row refuses	file:Exec@4684,file:Read@2868,file:Read@689,registry:Host@6224,registry:Host@6376,registry:Host@6578,registry:Host@6710,whole:Route@6193,whole:Route@6415	d1348e630d27e62d90643b9d73ee4ac0a1f11af720410430f23d113aa69f390d
internal/host/rootmigration_census.go	legacyRouteRow	authority	G,J4	rev3=census-ruling-claim-step8-readiness;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=pure shape check of an agent-written registry row under offline exclusion: an ordinary nested instance row, unowned by any claim, of the frozen signed record's account and app, with a valid version; a match only nominates the box for adoption and grants nothing on it	registry:Account@342,registry:App@377,registry:Backing@261,registry:ClaimOwnership@148,registry:DBPath@431,registry:Host@477,registry:Kind@89,registry:Replica@204,registry:Seed@219,registry:SeedSource@237,registry:Tunnel@320,registry:Unit@282,registry:Version@513,whole:ClaimOwnership@152	71bf89aad3a4357a87a11a74ed8afc861dedf2060dab10cd8ccd5450913bcbf6
internal/host/rootmigration_production_linux.go	migrateRootClaimAuthority	authority	G,J4,E3	rev3=census-ruling-claim-step8-readiness;run=15;identity=offline root migration uid 0;basis=requires masked inactive root mutator units and no running legacy root command under mandatory release exclusion; ordinary nonparticipants acquire no migration lock; the census classifies with claimMigrationSharedPaths after verifyMigrationWindow, and the public floor directories are made 0755 by mkdirAllExact whatever the operator's umask	file:Open@1814,file:Open@374,file:Open@615,file:Open@7287,file:Open@739,file:Read@2766,file:ReadFile@1571,whole:Route@3079	004467e63a878593d7a4836d5f41e1a6555f034233971592f2f49078a38ddb5e
internal/host/claimcensus_migration_linux.go	claimMigrationSharedPaths	authority	G,J4	rev3=census-ruling-claim-step8-readiness;identity=offline root migration uid 0;basis=refusal-only classification for the migration census: a reported route installation's paths and live link at exactly its row's version path, a frozen record's retained leftovers with no row and no claim (never reported, so never adopted, and never deleted), and window masks to exactly /dev/null; anything else stays unclassified and refuses	file:Readlink@1795,registry:Account@1078,registry:Account@1399,registry:App@1107,registry:App@1425,registry:Version@1150,registry:Version@1412,whole:Route@1064,whole:Route@1624	9c3958b4041cfb3ebe1a45bd7fd677f4c9ee4cffc5f4682ae682a50cc5e80705
internal/host/claimcensus_migration_linux.go	verifyMigrationWindow	authority	G,J4	rev3=census-ruling-claim-step8-readiness;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=refusal-only: --window must be root's private directory outside unit, data and opt paths; a window unit that is a symlink must point exactly at /dev/null with its original held as a root-owned single-link regular file	file:Lstat@841,file:Readlink@1023	921f8cde74c5747229ac0f2672f80ceeae7f3872203f43c22a52cecbb3da79d9
internal/host/claimcensus_migration_linux.go	rootPrivateEntry	authority	G,J4	rev3=census-ruling-claim-step8-readiness;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=Lstat only: root-owned, a directory closed to group and other or a single-link regular file, never a symlink; refusal only	file:Lstat@67	13cd93f6a737106cdec1efdbcc31384f121a886421791ea7afb8fab07adca931
internal/host/rootupdates_runtime.go	prepareRootRetryUnitDirectory	authority	E3	rev3=census-ruling-claim-step8-readiness;identity=root claim/adoption controller uid 0;basis=root unit installer requires an independently opened complete census before creating the public retry directory or enabling its controller write path; the directory is made 0755 by mkdirAllExact whatever the operator's umask	file:Lstat@67,file:Open@832	ab65b707653a835a94f11776baca68ae2525d6a72b1ec89d8b0d7a338abfc591
internal/hostbox/migration_census_linux.go	CheckMigrationRoots	authority	G,J4	rev3=census-ruling-claim-step8-readiness;run=18;identity=offline root migration uid 0;basis=accounts for trusted vendor systemd links separately from retained installation artifacts without exempting unknown files or CARLOS unit aliases; a refusal now names the root and path it could not classify	file:Lstat@932,file:WalkDir@1202	dbe07156eaf030cbcc8578beff09cc021c0ef5d6ec8b86954cd6db0a0c837302
internal/hostbox/journalmigration_linux.go	JournalService.MigrateLegacy	authority	C,J2,J4	rev3=census-ruling-claim-step8-readiness;root-input; an absent legacy directory imports nothing, exactly as an empty one does, and its marker records absent	file:QueryRowContext@3944,file:QueryRowContext@5658,file:ReadDir@914	c51829af08eaf56acc99c8e83cda448cc9453d868ed3c16b0d21cd617076984d