amadan
Fixed on main as 96db0efe (squash of claim-guard-umask, Astra approved, CI green, merged with Paul's go). It ships in the next release. Until a box runs that release, the trial runbook's post-guard-arm mode check stays.
guard-arm's directories inherit the caller's umask: umask 077 broke the guarded console (exit 203) open
carlos system guard-arm created /opt/carlos/system/guard and guard/identities with os.MkdirAll(dir, 0755) (internal/host/guardarm.go), so the caller's umask applied. In the dev cohort-1 trial (step 6.3, 2026-10-19), the operator shell ran umask 077. That left both directories 0700 root:root on sophie-knitting. console.service runs as a non-root user and execs /opt/carlos/system/guard/carlos, so it restart-looped with exit 203 (Permission denied), and platform.dev returned 502 until the directories were chmod 755 by hand.
Fix: branch claim-guard-umask. mkdirAllExact sets exactly 0755 on every directory it creates and on its target. guard-arm also repairs <opt>/system and makes its lock directory that way. The tests run under umask 077, including the real call order, with and without a 0700 parent left by an earlier run.
Interim: the trial runbook checks for 755 root:root and the carlos user's exec access right after each guard-arm.