# Census overlay roster-binding (roster binding, design-roster-revision-holds.md rev 3 plus section 7, tasks 1 to 7 at 7103ee07, plus code-review fix rounds 1 and 2): installed state is stamped with and compared against hostactors.BoxBinding, a digest of the box's roster row and the deployment's binding facts, instead of the roster write counter, so holds and other unrelated roster writes no longer refuse claim work while a quarantine, readmission, re-enrolment, floor, home or census-key change still does. The binding is computed from the reads the claim roster adapter and the cleanup identity already make; root's inventory actor is the fresh Identity.Verify; stop receipts take their directory_revision numeral from the fence's persisted RosterRevision and carry the binding in a new field; root startup settles obsolete inventory and rebind intents through the guard's SettleObsoleteRootInventory (and a superseded-claim abandonment ends in the same settled state), a quarantine only the startup migration census inspects, and obsolete cold-handover barriers through the new fenced SettleObsoleteColdHandover; the cold handover admits only a fresh successor. Changed units are re-pinned at their existing class, task and identity; new units take the class of the callers that execute them; servingPriorRevision is removed (renamed servingPriorBinding). productionClaimRoster.Actor is folded from the claim-ack-refresh overlay, which stays loaded before this one. No accepted-legacy row, so the seal stands. PROPOSED, awaiting a ruling (docs/superpowers/notes/census-proposal-claim-step8-readiness.md, "Roster binding").
@coverage	internal/host	666e36a0028965ba28349018b3958f9f448dcf3d66ea2b0d6f6bb48ea639c7a3
@coverage	internal/hostactors	1af14a5c45dacffe3d5b1878fde611b6887b1f3fdf2604adad427c819818813b
@coverage	internal/hostbox	6a698fe2c67cf9096d341b558e3f151481221f4134f578fcd2b8dbfcb07f3b50
@coverage	internal/hostguard	d3483cd67d197851473583e9ef941ff73d7007aa15d048c4b315d45185ec2764
internal/host/claimassembly.go	ClaimAssembly.Build	authority	C,G	rev3=census-ruling-roster-binding;identity=agent uid carlos; root instance-control uid 0;basis=as before; the agent's install pin (Reconcile.DirectoryRevision) and its census pin are the startup actor's binding, not the roster write counter; reads unchanged	file:Prepare@3791,file:Prepare@3824,file:Prepare@3840,file:Prepare@3857,file:Prepare@4606,file:Read@4536,whole:Timer@2044	cc979699a6390a04b76b1c02b8d53ff1f72b11a40191ad7e6951aed9cf21f9ba
internal/host/claimcleanup_identity.go	verifyClaimCleanupEnrollment	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-roster-binding;basis=the same read; the cleanup actor also carries hostactors.BoxBinding of its row in that startup read, which stamps only what the cleanup identity itself constructs; fresh authority is never this actor	file:Read@173	dafa2d78591fccac8a3bd7d6b6faa5088e2f3fda665a9906e8b9ae128ade1908
internal/host/claimconstruction.go	OpenProductionClaimAssembly	authority	C,E3,J4	rev3=census-ruling-roster-binding;identity=root controller and service UID using authenticated root projection;basis=as before; the launch owner's fence target is stamped with the actor's binding and carries the roster write counter as RosterRevision, the stop receipt's numeral; reads unchanged	file:Read@10611,file:Read@4684,file:ReadFile@4228,registry:Host@10638,whole:Route@10726,whole:Route@11475	171e91d7bb19f31def2d0077694b0cc7fd4b4917d62b4b852c0a74b2d0d786b0
internal/host/claimfilesseed_select.go	inspectFilesSeed	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the actor must also carry a binding (a format check beside Revision == 0); reads unchanged	file:Exec@1209,file:Read@753,registry:Account@1641,registry:App@1681,registry:Backing@1515,registry:Host@1354,registry:Replica@1436,registry:Seed@1498,registry:Tunnel@1570,registry:Unit@1535,whole:Route@1341,whole:Route@1786	cbb0022c535e70bf84bf1eadc2d6a5b14a75bd524abbe95eb6f415aa1e9184b8
internal/host/claimhandover_recovery.go	claimCrossBoxHandover.installRecoveryInventory	authority	C,G,J1	root-route;kept=C,G;scope=protected-decision-only;rev3=census-ruling-roster-binding;basis=the same read; the predecessor inventory is reused only when it is stamped with the fresh actor's binding (R3), else ErrTypedInventory before any reuse; the successor check and the restamp use the binding, not the write counter	whole:Route@1727	3463339194c9f4680565db7c41e4ad1c974d5dbeb846ae9e90c3ce38c483f2c3
internal/host/claimjournal_proof.go	legacyJournalProof	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-roster-binding;basis=the same read; the proof's match tuple digests the receipt's binding field (the installation stamp) where it digested directory_revision, which is now the roster numeral; a receipt from before the change, without binding, no longer proves a legacy journal (the design's clean break)	file:Read@817	87b6d60dcf5b22ca37cd5b35498021fb84d9df056cd77030ff74c17489c0f6a4
internal/host/claimlaunch_root.go	ClaimLaunchRoot.startRecorded	authority	E1,E2,E3	rev3=census-ruling-roster-binding;identity=root claim, migration or adoption controller uid 0;basis=as before; the fresh actor's binding (non-empty) must equal the launch target's stamp, where the write counter's decimal had to; same read	file:Read@4101	a19ad8299cd2aa9c9a896b4a8bc7a41ca0c95ea886a7272525f516c040b24b6e
internal/host/claimproduction.go	productionClaimRoster.Actor	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-roster-binding;basis=the same two reads; the verified actor carries hostactors.BoxBinding of this box's row in the verified roster (ErrChanged if the row is missing), which replaces claim-ack-refresh's QuarantineRevision field and covers it; folded from the claim-ack-refresh overlay	file:Read@127,file:Read@674	ef21562903552bb5cd33b673b5e129ace76f5dce8071351de0265902e3be1588
internal/host/claimrecovery_remote.go	claimCrossBoxHandover.installRecoveryRemote	authority	C,J1	rev3=census-ruling-roster-binding;basis=root installation and fence authority; recovery rebind and timer identity; the successor in root's rebind request is stamped with the actor's binding, not the write counter, and root checks it against its fresh binding; reads unchanged	file:Read@2553,file:Read@912	999a89cc8558d09465cbabb455f19a2974cef0ab92935536dcbe68c09db86b8f
internal/host/claimroleassembly_linux.go	ClaimRoleAssembly.PrepareState	authority	C,J1	rev3=census-ruling-roster-binding;identity=carlos agent uid carlos; root validates final inventory and launch;basis=as before; the local wake's inventory comparison uses the actor's binding where it used the write counter; reads unchanged	file:Fstatat@2088,file:Fstatat@3171,file:Open@1572,file:Openat@1859	164ffd84af404da2913becdf160c88d565ba16eac9eee62347b66b1e49039ccf
internal/host/claimservinghandover.go	ClaimRootHTTP.validateServingHandover	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the fresh actor's binding must equal both the successor's and the prior's stamps (servingPriorBinding, equality, where servingPriorRevision was an ordering on the write counter); reads unchanged	file:Read@2637,file:Read@3747,registry:ClaimIncarnation@1477,registry:ClaimOwner@1619,registry:ClaimRowID@1641,registry:ClaimStamp@1505,whole:Route@1744	d96f0ce0c0489833f46c0d110395b24ee0a1ed11268146cc00b6eda7def82488
internal/host/claimservinglegacy.go	validateServingLegacyStop	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the stop request carries the target's RosterRevision, and a target without one is refused; same exec	file:Exec@413	0272d1329b83e9e532fa78f4acf96da35db4d8491a21a3ce7d36ba2f6f25b36d
internal/host/claimservinglegacyroot_linux.go	servingParkRoot.retainLegacyNoProcess	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the result target's stamp must equal the fresh actor's binding (servingPriorBinding) where it had to equal the write counter's decimal; same read	file:Read@1197	1a3238ca4ea458af0e26481441465cd9ad346da190cf3edb7c03f4ca4a48d017
internal/host/claimservingparkroot_linux.go	servingParkRoot.withRootInstallation	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the fresh actor must also carry a binding; same read	file:Read@2136	d32aea9959a65a8a5ff13259ce82b21c945f00daa9bf2064854b957f993aed3d
internal/host/claimservingreboot_prepare_linux.go	servingParkRoot.prepareOrCommitServingReboot	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the preparation and the commit persist the bound actor (Actor.Bound, write counter cleared) and the reread compares with SameBinding, so holds and other unrelated roster writes no longer refuse it while a quarantine, readmission or re-enrolment still does; same read	file:Read@1513	ffccacf59482b5c25c95de1887009504bbdce4be8352a628efd74557f30147d3
internal/host/claimstop.go	ClaimStopCoordinator.FenceAndStop	authority	C,J4	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=as before; the request must carry RosterRevision, persisted in the fence target; the receipt's directory_revision is the persisted target's numeral (stopReceiptNumeral, never the request's) and its binding field the target's stamp; a fence without a numeral is refused before any drain or kill; same read; fix round 1 (finding 3): before the fence is begun or resumed, the request's RosterRevision is bounded by 0 < n <= root's own fresh verified roster read (boundRosterRevision); a retry still keeps the fence's original numeral (B2); same read	file:Read@1646	1eeab1f435123642edd6baefa63e9cc0eaddf51922d943223573d9298e5ab446
internal/host/claimstop.go	ClaimStopCoordinator.witnessNoProcess	authority	C,G,J4	rev3=census-ruling-roster-binding;basis=as before; the witness target carries the request's RosterRevision, the receipt's numeral, and the receipt's binding field is the target's stamp; refused without a numeral before the inventory read; same reads; fix round 1 (finding 3): the request's RosterRevision is bounded by root's fresh verified roster read before the witness target or receipt takes it; same reads	file:Exec@1881,file:Read@2896,file:Read@668	a534246f305bd4a9a29a436760ea02c8f9e17a29b54080a852aa8eb0cf0ab47b
internal/host/claimstop_writers.go	ClaimStopCoordinator.WritersStopped	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-roster-binding;basis=the same reads; the request must carry roster_revision, copied into the observation's fence target; no receipt comes from it	file:Read@1078,file:Read@2771	cb0fbe24c32dc361c4d3661a1f99dbcdedb26b5cc771263d424407f23304dc56
internal/host/claimwakestop.go	ClaimAssembly.collectCapturedStop	authority	C,G,J4	rev3=census-ruling-roster-binding;basis=as before; with no launch record the expected stamp is the actor's binding; the request carries the launch record's roster numeral, or the actor's write counter when the record names none; same reads	file:Exec@3264,file:Read@605	45c827a643468eeac5413de43546f0135d28e7d18b99aee31dcd290fd5fbad78
internal/host/rootexecution_authority.go	ClaimRootHTTP.executionAuthority	authority	C,E2,J4	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=as before; the execution authority carries the fresh actor's binding as its DirectoryRevision; same reads	file:Exec@1657,file:Read@553	00818a660276f82be32f4753aae26edc547ef55654c51c6dec81fdd2e9404cdd
internal/host/rootinventory.go	ClaimRootHTTP.commitRootInventoryPending	authority	E2	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=as before; the inventory's stamp must equal the binding of a fresh InventoryActor (root's inventory actor is Identity.Verify on every call, R2); same reads; fix round 1 (finding 2): a non-empty target DirectoryRevision must equal the inventory's stamp, itself equal to the fresh binding, before any intent is persisted; same reads	file:Read@1708,file:Read@3748,registry:Account@5112,registry:Account@5127,registry:App@5148,registry:App@5159,registry:ClaimIncarnation@4618,registry:ClaimOwner@4668,registry:ClaimOwner@5798,registry:ClaimOwnership@5210,registry:ClaimOwnership@5232,registry:ClaimOwnership@6114,registry:ClaimOwnership@8317,registry:ClaimRowID@4832,registry:ClaimRowID@4909,registry:ClaimStamp@4646,registry:DBPath@5176,registry:DBPath@5190,registry:Host@5082,registry:Host@5094,registry:Host@8781,registry:Name@8804,whole:ClaimOwnership@5214,whole:ClaimOwnership@5242,whole:ClaimOwnership@6124,whole:ClaimOwnership@8328,whole:Route@10571,whole:Route@3940,whole:Route@4323,whole:Route@4339,whole:Route@4394,whole:Route@5045,whole:Route@5058,whole:Route@5067,whole:Route@5305,whole:Route@5537,whole:Route@6371,whole:Route@6507,whole:Route@6731,whole:Route@8173,whole:Route@9836,whole:Route@9897,whole:Timer@8789,whole:Timer@8812	bb679c624346c0392db6f7dcddbf75aa1d96baf93e614cc509217d2c2a69d24a
internal/host/rootinventory.go	ClaimRootHTTP.recoverRootInventory	authority	C,E1	rev3=census-ruling-roster-binding;basis=as before (E16, E46); a pending inventory or rebind intent stamped under a binding other than root's startup binding is obsolete: it is settled, one intent at a time, through the guard's existing AbandonRootInventory (settleObsoleteIntent), logged, never replayed and never an assembly abort (N3); same reads. Executing identity: root instance-control or root participation/update; fix round 1 (finding 1): an obsolete intent is settled through SettleObsoleteRootInventory, told whether an interrupted inventory write already landed (inventoryIntentApplied) or, for a rebind, that its predecessor is kept (rebindIntentUnapplied); same reads; fix round 1 (finding 2): obsolescence is decided on the inventory's validated stamp only (obsoleteIntent takes one stamp), never the agent-sent target stamp; same reads; fix round 2: a superseded-claim abandonment passes the same applied reconciliation (inventoryIntentApplied, rebindIntentUnapplied), so it ends settled like an obsolete intent; same reads	file:Read@1934,file:Read@911	877fbabf76173278757f8696582c56e361934986052fa02fce12cec20ce364d1
internal/host/rootmigration_evidence.go	readMigrationStop	authority	G,J4	rev3=census-ruling-roster-binding;identity=carlos system journal-migrate offline operator uid 0;basis=as before; the wanted receipt is matched on its binding field; a receipt whose directory_revision is not a canonical non-zero numeral is skipped, and the numeral is carried into the target's RosterRevision; same read	file:Read@592	e16256c1a4c6807b32e55a0617bbc6e17d12ff708a7fcaa765af9b35226c61b7
internal/host/rootrecovery_rebind.go	ClaimRootHTTP.rebindRecoveryInventory	authority	C	rev3=census-ruling-roster-binding;basis=retain fresh claim and inventory checks and refuse a box listed Lost; the successor must be stamped with the fresh actor's non-empty binding, and the predecessor inventory must carry that binding too (R3) before any reuse; same reads	file:Exec@2625,file:Read@1519,file:Read@2129,registry:Account@3346,registry:App@3383,registry:ClaimIncarnation@3446,registry:ClaimOwner@3626,registry:ClaimRowID@3648,registry:ClaimStamp@3474,registry:Host@3318,whole:Route@3767	0e9f3ee60e6077c46c5a951be7abe6878ec79f76a71f78872ac9e54d519a66f4
internal/hostbox/coldhandover.go	ColdHandover.Run	authority	C,J2,J4	rev3=census-ruling-roster-binding;identity=root claim, migration or adoption controller uid 0;basis=as before; when Admit is set (root's handler and startup recovery), it runs first, before any successor state, for a new handover and for every replay (N5, B1); same reads	file:Exec@1114,file:Lstat@10883,file:OpenRoot@10805,file:Read@1466,registry:Addr@3741,registry:Addrs@3759,registry:Backing@3778,registry:Canary@3835,registry:ClaimIncarnation@3619,registry:ClaimIncarnation@4121,registry:ClaimOwner@11633,registry:ClaimOwner@4203,registry:ClaimOwner@4223,registry:ClaimOwner@6098,registry:ClaimOwner@7190,registry:ClaimOwner@8444,registry:ClaimOwnership@11225,registry:ClaimOwnership@3589,registry:ClaimOwnership@4567,registry:ClaimOwnership@4785,registry:ClaimOwnership@4818,registry:ClaimRowID@11523,registry:ClaimRowID@11604,registry:ClaimRowID@4241,registry:ClaimRowID@4849,registry:ClaimRowID@7149,registry:ClaimRowID@8469,registry:ClaimStamp@3664,registry:ClaimStamp@4168,registry:Host@7026,registry:Host@8406,registry:Kind@3697,registry:Name@4903,registry:Name@7041,registry:Name@8425,registry:Platform@3819,registry:Registration@4267,registry:Registration@7106,registry:Registration@8494,registry:Replica@3849,registry:Route@11225,registry:Route@4567,registry:Route@4818,registry:Route@5349,registry:Route@6098,registry:Timers@4766,registry:Timers@4785,registry:Timers@4849,registry:Timers@4903,registry:Timers@6978,registry:Timers@8281,registry:Tunnel@3799,registry:Unit@3723,whole:ClaimOwnership@11239,whole:ClaimOwnership@3593,whole:ClaimOwnership@4579,whole:ClaimOwnership@4801,whole:ClaimOwnership@4830,whole:ColdRows@11227,whole:ColdRows@12339,whole:ColdRows@12349,whole:ColdRows@5064,whole:ColdRows@5072,whole:ColdRows@5080,whole:ColdRows@5087,whole:ColdRows@5351,whole:ColdRows@6100,whole:ColdRows@6980,whole:ColdRows@8283,whole:Route@11233,whole:Route@3574,whole:Route@3934,whole:Route@4366,whole:Route@4374,whole:Route@4425,whole:Route@4433,whole:Route@4573,whole:Route@4824,whole:Route@5358,whole:Route@6107,whole:Timer@4105,whole:Timer@4379,whole:Timer@4387,whole:Timer@4438,whole:Timer@4476,whole:Timer@4772,whole:Timer@4791,whole:Timer@4855,whole:Timer@4909,whole:Timer@6987,whole:Timer@8290	14778af6e9553d5d386ad88c48c5331e7312e0bc94d48e8ad8e72a8d3e8b06fa
internal/host/claimassembly.go	NewProductionRootClaimStop	authority	C,E2	rev3=census-ruling-roster-binding;identity=root claim, migration or adoption controller uid 0;basis=the stop coordinator and root handler assembly moved unchanged into ClaimAssembly.rootStopCoordinator and ClaimAssembly.claimRootHTTP, where root's InventoryActor became the fresh Identity.Verify (R2)		2012b280fe8a23ccec695ce795f089a65560b001913a04b9ad524e1e4c647359
internal/host/claimhandover_transport.go	ClaimRootHTTP.serveColdHandover	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the handover comes from ClaimRootHTTP.coldHandover, which wires the fresh successor admission (admitColdSuccessor)		99ebffd31a008e177d995ab5a10c337f903f89de52963e0176ae0c80cba6a036
internal/host/claimlaunch_authority.go	ClaimLaunchRoot.authorize	authority	D,E2	rev3=census-ruling-roster-binding;basis=as before (E47); the fresh actor's non-empty binding must equal the launch target's stamp, where the write counter's decimal had to		68b8cebb7841224b3901a873691d68b9693d1395d01e6604f47b18b915691177
internal/host/claimretire_transport.go	ClaimRootHTTP.RecoverPending	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; its cold handover comes from coldHandover, so startup resumes a journaled handover only through the fresh successor admission (B1); Obsolete settles one whose successor was stamped under a binding other than the startup binding instead of resuming it (B3), logged		2737d7777ea6ad1b28e0e3e93d621eb43a1d0ac33c0f57348d68e3ad6b281874
internal/host/claimretire_transport.go	type ClaimRootHTTP	authority	E1	rev3=census-ruling-roster-binding;identity=root claim, migration or adoption controller uid 0;basis=as before, plus startupBinding: this box's binding in root's startup roster read, used only to decide that a pending intent or a journaled cold handover is obsolete		adb1886705a64f9129b59ec03e11cda983f9579e6e0317e5d76910e1620493f5
internal/host/claimservinglegacyroot_linux.go	servingParkRoot.validateLegacyRootEvidence	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the saved target's stamp must equal the fresh actor's binding (servingPriorBinding, equality), where it had to be a numeral no newer than the actor's		fe6d47a93058783384652fc63a65bf01fcf9ce153c73305815cc39c1077b65ad
internal/host/claimservingpark_transport.go	ClaimRootHTTP.serveServingPark	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the fresh actor must also carry a binding		486b2d97192b5dc6503d5cfa0b557b0e039141fc2993dbfe057c545366ebfeea
internal/host/claimservingparkroot_linux.go	servingRootStops	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; each retained receipt's stamp must equal the active actor's binding (servingPriorBinding), where it had to be a numeral no newer than the actor's		32842c26d8b5e8f9e8daaea561780a40a9ee627475632ea8ee5a82990d3bf65b
internal/host/claimservingparksource_linux.go	servingParkStateDirectory	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the actor must carry a binding, and the installation inventory's stamp must equal it where it had to equal the write counter		3596d8a75440c454d0acfa8033a8bf67cbae0625911925a0bb45140975d55baa
internal/host/claimservingreboot_prepare_linux.go	servingParkLedger.observeRebootPreparation	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before; the persisted bound actor must carry a binding (Actor.Bound clears Revision, so its zero check is dropped)		cbada9ad7ce2730aa022679cf7c024954c7d3f451ce45038df26ee6f8a49c85c
internal/host/claimservingreboot_prepare_linux.go	type servingParkRebootAuthority	authority	C,J4	rev3=census-ruling-roster-binding;basis=comment only: Actor is the bound actor (Actor.Bound), so a preparation survives unrelated roster writes and still moves with the binding		ba0cc635a2fd0c1dd4a753736137a6284a44e73127f17299227b870436cae6c2
internal/host/claimstop_recovery.go	ClaimStopCoordinator.RecoverStopped	authority	C,J4	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=as before; the fence target must carry a roster numeral, refused before any kill; the recovered receipt's directory_revision is that numeral and its binding field the target's stamp		804edb1c8f315facf1685993a48c1ffe514e23dbe04f8e66e92deae13a709e05
internal/host/rootinventory_startup.go	recoverRootInventoryStartup	authority	C,G	rev3=census-ruling-roster-binding;identity=root control startup and system recovery uid 0;basis=as before; its one read, rootstate.Open of the migration directory, moved unchanged into var openRootMigrationState; the census pin is the startup actor's binding; the recovery handler's InventoryActor is the fresh Identity.Verify and its startupBinding the startup actor's binding (N3)		2e6647bbc6121ce3333e129e89304f1a6494abb9ccc11b17aeb3439c936de83a
internal/host/rootmigration_startup.go	verifyRootMigrationStartup	authority	G,F,J4	rev3=census-ruling-roster-binding;identity=root instance-control startup and recovery uid 0;basis=as before; its one read, rootstate.Open of the migration directory, moved unchanged into var openRootMigrationState; fix round 1 (finding 1): a census view marked Settled with no inventory and root revision 0 (a settled first install whose journal never committed) is skipped; the installed-binary floor check goes through var rootMigrationStartupFloors; reads unchanged		35f815830a3b4dcac325e0651eb047a6571c5b39a6bd0f63d76a24f3ca2b3858
internal/hostbox/coldhandover.go	ColdHandover.Recover	authority	C	rev3=census-ruling-roster-binding;basis=a provably superseded cold admission can abandon its barrier without discarding its receipt; a settled journal is skipped, and a journaled successor that Obsolete reports is settled through settleObsolete instead of resumed; a failed settlement does not stop the other journals		d28f0ac7dee5f858be05175e24338818069deb902f26e38b81170966b710d9b9
internal/hostbox/coldhandover.go	type ColdHandover	authority	C,J4	rev3=census-ruling-roster-binding;basis=as before, plus Admit (root's fresh successor admission) and Obsolete (root's startup obsolescence test); with both nil, Run and Recover are as before		ae1abb4422718e4b72401a43ff2a239f060274397e6c904e696cfacb67ba55a6
internal/host/rootmigration_startup.go	var openRootMigrationState	authority	C,F,G,J4	rev3=census-ruling-roster-binding;identity=root instance-control startup and recovery uid 0;basis=new: rootstate.Open of rootMigrationDir, read-only, moved unchanged out of recoverRootInventoryStartup (C,G) and verifyRootMigrationStartup (G,F,J4) into a variable so tests can stand in for the root-owned directory; its only callers are those two, and it takes both their tasks	file:Open@71	4564c16cd8ec2d403e99191a94f67ba1655abe8642eaa3660234c104c3f5ac6d
internal/host/claimassembly.go	ClaimAssembly.rootStopCoordinator	authority	C,E2	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new: NewProductionRootClaimStop's stop coordinator assembly, moved unchanged; NewProductionRootClaimStop is its only caller, and its class; fix round 1 (finding 3): sets the coordinator's VerifiedRosterRevision to the cleanup enrollment's fresh roster read (claimCleanupEnrollment.rosterRevision); without a cleanup enrollment the bound stays nil and every stop refuses (fix round 2 dropped the Identity.Verify fallback, unreachable in production); no read		4fc76cfcc5639668f8c2da88ae168371c0b801f61a92eb7685e5d58c562cb884
internal/host/claimassembly.go	ClaimAssembly.claimRootHTTP	authority	C,E2	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new: NewProductionRootClaimStop's root handler assembly; InventoryActor is the fresh Identity.Verify (R2), startupBinding and the census pin are the startup actor's binding; NewProductionRootClaimStop is its only caller, and its class		b231e1b9bb854a667fdab64d21e011d644d8cba26bcb3730c1bb433986ba28c0
internal/host/claimhandover_transport.go	ClaimRootHTTP.coldHandover	authority	C,J4	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new: the operation cold handover that serveColdHandover and RecoverPending both build, as before plus Admit = admitColdSuccessor; the class of those two callers		067248e06d68c2e4f3ceeb449ce37ce99b2cc4d0b66f9c5d31266d59c086d6da
internal/host/claimhandover_transport.go	ClaimRootHTTP.admitColdSuccessor	authority	C,J4	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new: RequireNewWork, then the successor's box, enrollment and stamp against a fresh InventoryActor (non-empty binding); refuses without InventoryActor; runs before any successor state (N5, B1); executed by ColdHandover.Run for coldHandover's callers, their class		72681b40f684ac60e937c8c40984fe97951af92770de9a5d73c1ac5bbbab34eb
internal/hostbox/coldhandover.go	ColdHandover.settleObsolete	authority	C	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new: settles a journaled handover in phase prepared, parked or complete through the guard's SettleObsoleteColdHandover, whose record step rewrites the journal as settled (B3); ColdHandover.Recover is its only caller, and its class		ecdbb6d7e71426e782a2007e730d3e06c46d3a7113290768286a78f64a1aaa70
internal/hostguard/coldhandover.go	Guard.SettleObsoleteColdHandover	authority	C	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new: under the host lock, on the guard record it already reads, requires the prior's completed fence receipt, active stamp and the matching barrier, retires the successor stamp, clears the barrier, restores the prior's completed fence to the deny slot, writes the record, then records; an already settled record only records; ColdHandover.settleObsolete is its only caller, and its class		a342cd17b58ec7d4afdee1d5666b675ced000e4a3ef68bf938651e4229fa7f78
internal/host/rootinventory.go	ClaimRootHTTP.obsoleteIntent	authority	C,E1,J4	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new: reports a stamp other than startupBinding (empty startupBinding never); no read; the class of its callers recoverRootInventory (C,E1) and RecoverPending (C,J4); fix round 1 (finding 2): takes one stamp, validated binding evidence only (an inventory's or a successor's), so an agent-sent target stamp can never mark an intent obsolete; no read		215523d8427b282d262453a45727effa40641a697169baa577e5d30df57e4582
internal/host/rootinventory.go	ClaimRootHTTP.settleObsoleteIntent	authority	C,E1	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new: abandons an obsolete pending intent through the guard's existing AbandonRootInventory (same host lock, exact intent bytes), logged; never consults InventoryActor; recoverRootInventory is its only caller, and its class; fix round 1 (finding 1): settles through the guard's SettleObsoleteRootInventory instead of AbandonRootInventory, so the installation is quarantined and marked settled, inspectable by the migration census and still refused for execution; no read		afe2fea20a0b5368d8762664bd812908f6ae16536acefc735a7c340e2fc4c5c4
internal/host/claimstop.go	stopReceiptNumeral	authority	C,G,J4	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new: the receipt numeral from the fence target's persisted RosterRevision, zero refused; no read; the class of its callers FenceAndStop, witnessNoProcess and RecoverStopped, and of its fourth caller verifyRetirementReceipt (claimretire_transport.go:200), which compares a retirement receipt's directory_revision with the target's numeral; class unchanged		b1776ff85789af138c7215cd3fc4beb758823fdbcd4a98d802b3de29b8490439
internal/host/claimstop.go	receiptRosterRevision	authority	G,J4	rev3=census-ruling-roster-binding;identity=carlos system journal-migrate offline operator uid 0;basis=new: parses a receipt's directory_revision as a canonical non-zero decimal; no read; its root caller is readMigrationStop, and its class (the agent's validateTransportStop also uses it)		40f6c90cdfdf0d03bc3f2e30d7739d9ec5001ad1c412ab2ceb8a27c9d4583009
internal/host/claimservinghandover.go	servingPriorBinding	authority	C,J4	rev3=census-ruling-roster-binding;basis=new name for servingPriorRevision (removed below), now equality: the recorded stamp is the actor's non-empty binding, where it was a numeral no newer than the write counter; the removed row's class		dfbda3bd8e6095f76488e3f6926e8579de9c023b6f4935a81b6c8a554c961007
@remove	internal/host/claimservinghandover.go	servingPriorRevision
internal/host/rootinventory.go	ClaimRootHTTP.inventoryIntentApplied	authority	C,E1	rev3=census-ruling-roster-binding;identity=root instance-control or root participation/update uid 0;basis=new (fix round 1, finding 1): reads the pending installation's inventory version through the root journal service's inventory (SnapshotRequest) and reports whether the interrupted write already landed (revision q.Revision+1, last request q.ID, the pending revision); no file read of its own; the class of its caller recoverRootInventory		0a7d0da576245d9ab8657ae5611c71b97a0786cb8fa9a86f0681ef2033f610d7
internal/host/rootinventory.go	rebindIntentUnapplied	authority	C,E1	rev3=census-ruling-roster-binding;identity=root instance-control or root participation/update uid 0;basis=new (fix round 1, finding 1): constant false, a rebind's commit writes only the successor's inventory so the kept predecessor agrees with its own; no read; the class of its caller recoverRootInventory		19399a184c63b259c3150b6e86c7cdbcab21e2b0f2da64eff07700d0b98930c4
internal/host/rootmigration_startup.go	var rootMigrationStartupFloors	authority	G,F,J4	rev3=census-ruling-roster-binding;identity=root instance-control startup and recovery uid 0;basis=new (fix round 1, finding 1): the startup's installed-binary floor check, verifyRootMigrationFloors unchanged, behind a variable so tests without root-owned floor binaries can stand in for it; its only caller is verifyRootMigrationStartup, and its class		250545174d349672c1c5f8d3a4ff8ea46a0fc73d38fd15e8b81d8b3cbdb61f1e
internal/hostguard/guard.go	Guard.locked	authority	C	rev3=census-ruling-roster-binding;basis=fix round 1 (finding 1): an unsafe-lock quarantine also clears the settled mark, so hostile evidence is never inspectable as a settlement; reads unchanged		fdebfbd4bff4d2064d830ce26c539d99ce140f383e39ce88ac9ce2a8a191c536
internal/hostguard/root.go	Guard.AbandonRootInventory	authority	C	rev3=census-ruling-roster-binding;basis=fix round 1 (finding 1): the superseded-claim abandonment also clears the settled mark; it stays a refusing quarantine for the migration census; no read change; fix round 2: now resolveRootInventory with its superseded check: exact intent and fresh claim kept, a landed commit reconciled, the record left quarantined and settled (inspectable by the census, refused for execution) instead of a non-settled quarantine that blocked cleanup startup on every restart		2d53cdc6491ad4ea53128cb1b48040c33aa3607ecc35da0aab80165d7d7ce1c7
internal/hostguard/root.go	Guard.CommitRootInventoryArtifacts	authority	G,J4	rev3=census-ruling-roster-binding;identity=root claim controller construction uid 0;basis=fix round 1 (finding 1): a successful commit clears the settled mark with the quarantine; reads unchanged		1f640a3d6411ee23f6d23db4b7a5b276bb43e02c5945d537e765ddab093193ab
internal/hostguard/root.go	RootAuthority.write	authority	C,G,J4	rev3=census-ruling-roster-binding;identity=root control uid 0;basis=fix round 1 (finding 1): persists the settled mark (Settled, omitempty); no read		d9da59ba4d96884af78bb953fe7789e0cf737b7c7eff576c28d459f4152bd0f6
internal/hostguard/root.go	RootAuthority.read	authority	C,G,J4	rev3=census-ruling-roster-binding;identity=root control/startup/generation uid 0;basis=fix round 1 (finding 1): reads the settled mark; a record Settled but not Quarantined is malformed; same read	file:Read@175	acd752ed113ea01908ae1dc42dd6742ce7ff00078ac21e67b454e1c38df07f6e
internal/hostguard/rootrebind.go	Guard.RebindRootInventory	authority	E2	rev3=census-ruling-roster-binding;basis=fix round 1 (finding 1): a completed rebind clears the settled mark with the quarantine; reads unchanged		2798adb3e11e8f251d47546c13d7c9ba040ba5bd97dae63017ca08f1a23eb206
internal/hostguard/rootview.go	RootAuthority.viewLocked	authority	C,G,J4	rev3=census-ruling-roster-binding;identity=carlos instance-control, root control service uid 0;basis=fix round 1 (finding 1): now readView with census false, unchanged behaviour: quarantined (settled or not) and pending records refuse		2bc13f3341e273be24c275db459e3e9bbaa2f79354562dfad792ab88f628e45c
internal/hostguard/rootmigration_inventory.go	RootAuthority.MigrationInstallations	authority	C,G,J4	rev3=census-ruling-roster-binding;identity=root migration/startup uid 0;basis=fix round 1 (finding 1): reads each record through readView with census true, so a settled installation is listed, marked Settled; any other quarantined or pending record still refuses the census; reads unchanged		11170afcb762367188400d9472f81c87d6eaf74a6d36b2582001ee8cf99766e6
internal/hostguard/rootview.go	RootAuthority.readView	authority	C,G,J4	rev3=census-ruling-roster-binding;identity=carlos instance-control, root control service uid 0;basis=new (fix round 1, finding 1): viewLocked's read moved unchanged, plus the census exception for a settled record; reads through RootAuthority.read; the class of its callers viewLocked and MigrationInstallations		cd67585f565aa68f6f73a2ad3540ef79c2ce4c5303b99c80317c77b0be9d5667
internal/hostguard/root.go	Guard.SettleObsoleteRootInventory	authority	C,E1	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new (fix round 1, finding 1): under the host lock and with the exact intent bytes, clears an obsolete pending intent, records the installation the interrupted commit would have recorded when applied says it landed, and marks the record quarantined and settled; no claim read; reads through the guard's record directory; the class of its caller settleObsoleteIntent; fix round 2: its body moved unchanged into resolveRootInventory (no claim read)		89729f43d693b26f516ec35d4f73bd3110bd7d715b3d6adb966322626a459ba6
internal/host/claimstop.go	type ClaimStopCoordinator	authority	C,G,J4	rev3=census-ruling-roster-binding;basis=fix round 1 (finding 3): gains VerifiedRosterRevision, root's fresh verified roster read that bounds an agent-sent receipt numeral; nil refuses every stop and no-process witness		d492a16fa6b3d75c90a72b34c6a30f025e8e8baf085ee49ebf18955f10602cfe
internal/host/claimstop.go	ClaimStopCoordinator.boundRosterRevision	authority	C,G,J4	rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new (fix round 1, finding 3): refuses an agent-sent RosterRevision outside 0 < n <= VerifiedRosterRevision's value, nil refusing; no read of its own; the class of its callers FenceAndStop (C,J4) and witnessNoProcess (C,G,J4)		ddd535a321268d90f9058388304a417d81320d64b468a2ce5a9d65d3789902d3
internal/host/claimcleanup_identity.go	claimCleanupEnrollment.rosterRevision	authority	C,G,J4	root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-roster-binding;identity=root instance-control uid 0;basis=new (fix round 1, finding 3): root's own read of the signed roster (hostactors Directory.Read verifies the deployment signature) at the moment of a stop, never the startup read; the box's row must still name this enrollment; returns the roster's write counter whether or not the box is quarantined, so historical cleanup keeps working; the same read configureSigner makes; reached only through rootStopCoordinator's VerifiedRosterRevision, so the class of boundRosterRevision's callers	file:Read@157	42b607901a37ef0dcd3e3dad7f0c053beab426c3f2acec0457a65800a0fd7f22
internal/hostguard/root.go	Guard.resolveRootInventory	authority	C,E1	rev3=census-ruling-roster-binding;identity=root instance-control or root participation/update uid 0;basis=new (fix round 2): the one terminal resolution of a pending root inventory intent, under the host lock with the exact intent bytes; for a superseded claim it reads the fresh claim through the guard and requires superseded; reconciles a landed commit through applied; clears the intent and marks the record quarantined and settled; reads through the guard's record directory; the class of its callers AbandonRootInventory and SettleObsoleteRootInventory (both reached from recoverRootInventory)		5549be9c521f8ad6514f4c79a39bbcc2442c644641b1f21786f0c94ea54612a6
internal/host/rootmigration_census.go	rootMigrationCollector.collect	authority	G,J4	rev3=census-ruling-roster-binding;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=signed collecting manifest and actor directory bound complete records/claims census; registry Seeds are refusal-only; with the agent stopped and masked, a legacy route row is reported as a route installation only when legacyRouteRow matches it to its frozen record, which only nominates this box for that record's adoption (checked again by the adopter against the signed census and the committed domain claim) and installs nothing; any other row refuses; fix round 2 (census review 2, condition 1): refuses with ErrFenced any installation MigrationInstallations lists as Settled (refuseSettledInstallations), so a settled, quarantined installation still refuses the collection exactly as before settlement existed and never enters the snapshot or the census report as a local item; reads unchanged	file:Exec@4765,file:Read@2868,file:Read@689,registry:Host@6305,registry:Host@6457,registry:Host@6659,registry:Host@6791,whole:Route@6274,whole:Route@6496	0818335a24d2b54b852ef4ce79abe731d58925dc5d3b784640023c825fffb4e8
internal/host/rootmigration_census.go	refuseSettledInstallations	authority	G,J4	rev3=census-ruling-roster-binding;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=new (fix round 2, census review 2 condition 1): ErrFenced for any Settled census view; no read; the class of its caller rootMigrationCollector.collect		0938feca28af6a906ab4d1a32be3140bff5da29eaadb346404f5f52b7ae35708