# Census overlay armed-box-updates (cherry-picks 8376a468 and 8a313548 from claim-empty-cohort-done onto main for v0.28.5; rows and ruling census-ruling-claim-rootaws-sentinel, confirmed for main by platform-1c, 2026-10-20). Only the rootaws and hostfloor parts apply on main.
2
# Census overlay claim-rootaws-sentinel (a scrubbed root parent's own disabled shared-file sentinels are not an override in a root child, so the child's scrub stays silent; found by platform-d8's deployment harness at G4: a guard-armed box refused every router update because the candidate's version printed the ALERT into the guarded updater's combined output), loaded LAST, after claim-empty-cohort-fix2. RULED (platform-1e, 2026-10-20): accepted. Envelope only: ScrubEnvironment has no classified root-read unit; no row changes and the seal stands.
# Also (harness G4, parent side, same ruling): hostfloor's guarded run returns the image's stdout only through runImage (new), so stderr progress or an alert cannot corrupt the version or plan an updater parses; Disk.Run's exec site moved into runImage at its class, and Disk.Run's row is retired.
internal/hostfloor/image_linux.go runImage authority F,J4 rev3=census-ruling-claim-rootaws-sentinel;identity=root (the system updater and root's apply through hostfloor.Disk.Run on a guard-armed box);basis=root-input: the exec of the verified, protected image Disk.Run opened and checked, moved unchanged from Disk.Run; stdout is returned and stderr kept only for the error file:CommandContext@89 fbf4a73db9e71f8deefa8d56ece729f489f84689d064e2475f5551a823d6fa59
amadan