# Census overlay claim-guard-umask (guard-arm's directories ignore the caller's umask; amadan issue drafted 2026-10-19), loaded LAST, after claim-untagged-pointer-fix2. Ruled by platform-1e as census owner: census-ruling-claim-guard-umask.
2
# RunSystemGuardArm: the guard and identities directories are now made through mkdirAllExact instead of os.MkdirAll; its read sites are the same files at shifted offsets. mkdirAllExact (new): Lstat walks up only to find which components it creates, then chmods exactly those and the target to 0755. It reads no file content and grants nothing. The seal stands: no accepted-legacy row. No 9B8 entry: it writes no record. prepareGuardArmLockDir (new) has no read site of its own: it repairs <opt>/system to 0755 and makes the lock directory, both through mkdirAllExact.
internal/host/guardarm.go RunSystemGuardArm authority F,J4 rev3=census-ruling-claim-guard-umask;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main; policy and identity parse in guardArmInputs, same files read; guard directories, the shared system parent and the lock directory made through mkdirAllExact file:OpenFile@588,file:ReadFile@1595,file:ReadFile@5906,file:ReadFile@888,file:ReadFile@968,file:Stat@3557 23ad7a4d52c3c004f701a937f26b0f58f115b9a007aa7b15446bfa45aacf2b3c
5
internal/host/guardarm.go mkdirAllExact authority G,J4 rev3=census-ruling-claim-guard-umask;identity=carlos system guard-arm, offline CLI uid 0;basis=Lstat of the target path and its missing parents only, to choose which directories to create and chmod to 0755; no file content is read file:Lstat@149 d1c988f22c5559ba6765ba9072d3fbbf26fd33836ab672157cb4e1bd9b99aaf3
amadan