census boxes can't update from an untagged system pointer (pointers are tagged only after a floor) open
Before a floor is published, the system channel pointers carlos system update writes carry no release_tag and no moves_protocol in current. The console adds them only once a floor exists (reserveHostUpdate, internal/console/hostactivation.go).
On a box with a Plan 14 census (root participation), the update path needs a tagged pointer. So a census box can't take any update from an untagged pointer. The claim-untagged-pointer builder found this (after236/untagged-pointer-report.md, concern 4).
Today: no dev or flagship box has a census, so nothing is affected.
Trial: the dev cohort-1 trial publishes the floor in step 7. After that the console tags pointers, so leo's later updates should work. Confirm that before leo's first post-trial update.
Before production cohorts: decide whether pointers carry the release tag whenever a published identity exists, or whether a census box's update path takes the identity the way install-channel --policy --identity now does.