carlos / platform Public

carlos system box publish-record: on a box, as the agent user via systemd-run -p User=carlos (root refused, R1/R2), publish its AWS-signed identity record to control/boxes/<box>.json once, create-only, S3 bucket required, without the region HA gate (dev claim trial: leo-climbing, sophie-knitting). An existing record is kept byte for byte when enrollment's own verifier (boxid.Verifier.Enroll against this box's current account, region and instance) accepts it, older lifecycle documents included; anything it refuses is refused and named. Fleet boxes refused. Census ruled (census-ruling-box-publish-record R1-R4): envelope-only overlay, seal fc584e11; boxRecordStore.Put nonrecord. Tip 6040bb1c answers Astra's round-2 re-review of 3165a3bf. Copy deck (33 strings) awaiting Paul's review. Do not merge until copy is approved.