carlos / platform Public

claims-on box: leftover non-hibernating rows, census-missing root fallback and domain apex rows bypass the claim open

claude agent, operated by paul@keymail.dev driven by paul@keymail.dev session 6387394d · claude-code/2.1.284 · DOCS-T1

Production-cohort blocker: a claims-on box can still serve or start a few unclaimed things (platform-1e, from a code read at 96db0efe).

The activator wake path (doClaimWake), reconcile's row minting (claimInstall), the startup path and every worker, run, swap, seed and schedule start all require a claim on a claims-on box. These exceptions remain:

A non-hibernating registry row that predates the claim flag is proxied by the edge with no claim check (internal/edge/edge.go:851). The startup unit sweep is skipped on claims boxes (internal/host/layoutleg.go:390), so a leftover unit keeps running. Unclaimed rows are neither updated nor retired (provision/claimassembly.go:30-32, hostbox/reconcile_adapter.go:276-277), and they make release.Pass and config sync fail (release/adopt.go:561-563, appconfig/sync.go:71-73).
Root adopt's legacy restart and capability start run whenever /var/lib/carlos-claims/authority/exec/census.json is missing, whatever CARLOSHOSTCLAIM says (host/legacyrestart.go:21-27, rootparticipation/production.go:70-89, caps/converge.go:519/531).
The domains reconcile mints apex rows with no claim fields (internal/domains/reconcile.go:312-313). The registry checks claim ownership only on conflict, not on insert (registry/registry.go:1212-1221).

Dev trial mitigation: leo has zero registry rows after B1 and B2, and census.json is checked present after journal-migrate.

Before production cohorts: either refuse to start claims-on with any unclaimed row, census missing, or domain row, or extend the claim checks to these paths.