# Census overlay claim-ack-refresh (G10 fix, 2026-10-20): the box keeps its own execution acknowledgement fresh while a create, delete or purge waits on the console, and the regional enrollment check stops pinning the roster-wide revision. hostclaim.AcknowledgeExecution lets an ack be replaced only by one with the same op, enrollment, boot and controller, a lease ETag and a strictly later expiry. productionClaimRoster.Actor now also carries the row's QuarantineRevision on the actor, read from the same roster object; no new read. Classes unchanged; refreshAcknowledgement is a new declaration under acknowledgeOperation's authority and task.
internal/host/claimproduction.go productionClaimRoster.Actor authority C,G,J4 root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-claim-ack-refresh;basis=the same two reads; the verified actor also carries the roster row's QuarantineRevision, so the regional enrollment check can ignore the roster-wide revision and still refuse a box quarantined since startup file:Read@127,file:Read@674 f930f8c38f722d67f41ffe65bca4c2ef5f7ef6bb5959a7da24099fc20a1c35e8
6
internal/host/rootexecution_client.go productionClaimLocal.acknowledgeOperation authority C rev3=census-ruling-claim-ack-refresh;identity=agent uid carlos;basis=publishes only the required participant own active root-client tuple under claim CAS; checks host incarnation operation box enrollment; an existing acknowledgement is no longer left as is but handed to refreshAcknowledgement, which only extends this controller's own bf01c7d9ac473f9152af37d3117da67b1af63f6b2e61f32bc3d67e0f7662b767
7
internal/host/rootexecution_client.go productionClaimLocal.refreshAcknowledgement authority C rev3=census-ruling-claim-ack-refresh;identity=agent uid carlos;basis=extends only an acknowledgement this slot's controller wrote (same op, enrollment, boot and first controller id) once fewer than ackRefreshBefore (60 s) remain, from the controller's current Ready state under the first acknowledgement's checks, under claim CAS; hostclaim refuses anything but a strictly later expiry e236c26943abbab67d29451a9d7a0f880af1b6f97ed0a7c9df7238f91b353aff