carlos / platform Public

claim-untagged-pointer: apply Paul's copy approval (all nine strings verbatim)

Paul approved all nine strings on 2026-10-18 with no edits
(claim-untagged-copy/result.json, action approve).

- RHB-C19: installChannelUsage is now "usage: carlos system
  install-channel [--policy FILE --identity FILE]" plus the unchanged
  second line. The row in the 2b copy record carries the same text (line
  breaks written \n), noted "re-approved by Paul 2026-10-18
  (claim-untagged-pointer)". TestRegionHA2bBuiltCopyIsApplied checks the
  new text, and fails if the code keeps the old usage.
- docs/site/cli.md: the approved --identity paragraph is added after the
  approved --policy paragraph. They do not contradict each other, so no
  approved word changed.
- The other seven strings were already in installchannel.go, byte for
  byte.

Census overlay claim-untagged-pointer-fix2 (PROPOSED): an envelope-only
re-pin of internal/host for the usage constant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 6 days ago 6797c8e22f4c0584b3cf19438faecce453c34cb4 parent fdc0990

7 files changed, +22 −3

approved_region_ha_2b_copy_test.go +2 −1
docs/site/cli.md +2 −0
docs/superpowers/notes/census-proposal-claim-untagged-pointer.md +6 −0
docs/superpowers/plans/2026-10-17-region-ha-2b-copy.md +1 −1
internal/host/installchannel.go +1 −1
internal/provision/plan14_root_reads_test.go +7 −0
internal/provision/testdata/plan14-root-reads-claim-untagged-pointer-fix2.tsv +3 −0

diff --git a/approved_region_ha_2b_copy_test.go b/approved_region_ha_2b_copy_test.go

index d49cf5638..4fa248032 100644

--- a/approved_region_ha_2b_copy_test.go

+++ b/approved_region_ha_2b_copy_test.go

@@ -70,7 +70,8 @@ func TestRegionHA2bBuiltCopyIsApplied(t *testing.T) {

rows := builtRows(mustParseRegionHA2bRecord(t), regionHA2bCopyBuilt)

// A table cell holds one line, so in this record a row's text writes a

// newline as \n: RHB-C19, the install-channel usage Paul re-approved on

- // 2026-10-18 (claim-prev-rehearsal), is two lines and a blank one.

+ // 2026-10-18 (claim-prev-rehearsal, then claim-untagged-pointer), is two

+ // lines and a blank one.

for i := range rows {

rows[i].Text = strings.ReplaceAll(rows[i].Text, `\n`, "\n")

}

diff --git a/docs/site/cli.md b/docs/site/cli.md

index 8638a2d39..22601a4d6 100644

--- a/docs/site/cli.md

+++ b/docs/site/cli.md

@@ -2288,6 +2288,8 @@ carlos system install-channel installs the release the box's channel names, as b

With --policy FILE, the armed policy carlos system claims run sign-policy wrote, it installs before the host floor is published. The policy's floor stands in for the published one, and once a floor is published the two must be the same. It also arms a box that carlos system update has already moved to the channel's release: carlos is left as it is, and carlos.prev, the release before, is replaced by it, so guard-arm finds the release in both. A box on another release, or with an armed guard, is still refused.

+With --policy, --identity FILE is needed too: the release identity carlos system claims run publish-identity wrote. Before a floor is published, the channel pointer carlos system update writes names no release tag, so the release is found through this file instead. It must be the identity published for its tag, and it must name the release and the artifact the channel names.

```sh

carlos system host-env write --deployment prod --region ie

carlos system install-channel

diff --git a/docs/superpowers/notes/census-proposal-claim-untagged-pointer.md b/docs/superpowers/notes/census-proposal-claim-untagged-pointer.md

index 49937aef1..1bec4ffe4 100644

--- a/docs/superpowers/notes/census-proposal-claim-untagged-pointer.md

+++ b/docs/superpowers/notes/census-proposal-claim-untagged-pointer.md

@@ -51,3 +51,9 @@ What changed, all on the `--policy` path or in comments:

- `openChannelPolicy`'s doc comment now names both files it reads. Its digest, which covers the declaration and not its doc comment, is unchanged.

No root-read unit's digest or sites change: `channelInstall.run` and `openChannelPolicy` stand at census-ruling-claim-untagged-pointer's rows. The `internal/host` envelope is re-pinned to `846d5194…d741a5`. The seal stands, and no 9B8 entry is proposed: nothing new writes to a bucket.

+## Fix round 2 (PROPOSED)

+Status: PROPOSED. Overlay `internal/provision/testdata/plan14-root-reads-claim-untagged-pointer-fix2.tsv`, loaded after fix1. Envelope only.

+What changed: Paul approved all nine strings verbatim on 2026-10-18, so `installChannelUsage` now carries the re-approved RHB-C19 usage, `usage: carlos system install-channel [--policy FILE --identity FILE]`. That constant is the only source change in `internal/host`. No root-read unit's digest or sites change. The `internal/host` envelope is re-pinned to `76aa9108…c9bae`. The seal stands, and no 9B8 entry is proposed.

diff --git a/docs/superpowers/plans/2026-10-17-region-ha-2b-copy.md b/docs/superpowers/plans/2026-10-17-region-ha-2b-copy.md

index 7284ee8f6..92e7f5115 100644

--- a/docs/superpowers/plans/2026-10-17-region-ha-2b-copy.md

+++ b/docs/superpowers/plans/2026-10-17-region-ha-2b-copy.md

@@ -79,7 +79,7 @@ as stable; `<platform>` such as linux-arm64; `<box>` a box's reference.

|---|---|---|---|

-| RHB-C19 | internal/host/installchannel.go (a fragment of the usage, re-approved by Paul 2026-10-18 (claim-prev-rehearsal)) | usage: carlos system install-channel [--policy FILE]\n\nInstall the release this box's channel names, as root, on a box that has none yet. | approved |

+| RHB-C19 | internal/host/installchannel.go (a fragment of the usage, re-approved by Paul 2026-10-18 (claim-prev-rehearsal), re-approved by Paul 2026-10-18 (claim-untagged-pointer)) | usage: carlos system install-channel [--policy FILE --identity FILE]\n\nInstall the release this box's channel names, as root, on a box that has none yet. | approved |

diff --git a/internal/host/installchannel.go b/internal/host/installchannel.go

index 63d9aa10c..9410b90e4 100644

--- a/internal/host/installchannel.go

+++ b/internal/host/installchannel.go

@@ -65,7 +65,7 @@ import (

// pointer names (and its tag, if the pointer carries one). That identity is

// the one the floor is checked against and the one kept for guard-arm.

-const installChannelUsage = "usage: carlos system install-channel [--policy FILE]\n\nInstall the release this box's channel names, as root, on a box that has none yet.\n"

+const installChannelUsage = "usage: carlos system install-channel [--policy FILE --identity FILE]\n\nInstall the release this box's channel names, as root, on a box that has none yet.\n"

const installChannelPolicyFlag = "the armed policy carlos system claims run sign-policy wrote, used as the host floor until one is published"

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index d1ef1ac45..9e52a0d25 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -905,6 +905,13 @@ func TestPlan14RootReadCensus(t *testing.T) {

if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-claim-untagged-pointer-fix1.tsv"), &inv, true); err != nil {

t.Fatal(err)

}

+ // Census overlay claim-untagged-pointer-fix2 (Paul's copy approval

+ // applied: the re-approved RHB-C19 usage), loaded last. Envelope only.

+ // PROPOSED (docs/superpowers/notes/census-proposal-claim-untagged-pointer.md,

+ // "Fix round 2"). The seal stands.

+ if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-claim-untagged-pointer-fix2.tsv"), &inv, true); err != nil {

+ t.Fatal(err)

+ }

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/testdata/plan14-root-reads-claim-untagged-pointer-fix2.tsv b/internal/provision/testdata/plan14-root-reads-claim-untagged-pointer-fix2.tsv

new file mode 100644

index 000000000..3e58b5275

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-claim-untagged-pointer-fix2.tsv

@@ -0,0 +1,3 @@

+# Census overlay claim-untagged-pointer-fix2 (Paul's copy approval applied: installChannelUsage carries the re-approved RHB-C19 usage, "[--policy FILE --identity FILE]"), loaded LAST, after claim-untagged-pointer-fix1. PROPOSED: docs/superpowers/notes/census-proposal-claim-untagged-pointer.md, section "Fix round 2".

+# Envelope only. The one source change in internal/host is the usage constant's text. No root-read unit's digest or sites change: channelInstall.run and openChannelPolicy stand at census-ruling-claim-untagged-pointer's rows. The seal stands; the 9B8 inventory is unchanged.

+@coverage internal/host 76aa9108a02c4b47cf6d2cdc7434c83e1048e45eb23406033964b4a0b93c9bae