# Census overlay claim-own-child (platform-d8 deployment harness, the 4th 8.2 stop on 2026-10-20): the retired-generation kernel census refused journal-migrate's own service-user registry child, which from an operator shell sits in no service that selects the running binary. Only when journal-migrate runs the census (a context value with its pid) does a non-root, non-kernel task whose /proc stat ppid is that pid pass the root-task rule. It is not trusted: it must share the census's namespaces and pass every exe, cwd, root, descriptor, mapping and mount reference check, and the closing start-time re-read still binds the pid. procStatParent is the one ppid parser the quiesce scan and this census share. Classes unchanged.
internal/host/claimjournal_migration_linux.go procParent authority C,G,J4 root-input;kept=C,G;scope=protected-decision-only;rev3=census-ruling-claim-own-child;identity=carlos system journal-migrate, offline operator CLI, uid 0;basis=reads one /proc/<pid>/stat; the ppid parse moved into procStatParent, shared with the generation census; a malformed file is an error the scan refuses on file:ReadFile@61 2640074280b6764a0ff4e9b817703c860790b2f4877322044f1d14a1933341e9
4
internal/host/rootgeneration_kernel_linux.go generationKernel.task authority E2 rev3=census-ruling-claim-own-child;identity=root generation census, uid 0;basis=unchanged reference checks; a non-root non-kernel task whose stat ppid equals the kernel's parent (set only by journal-migrate) passes the root-task rule untrusted, so namespaces must match and every reference check and the start-time re-read still apply; with no parent set the rule is exactly as before file:Readlink@1342 29f36b9d2d03972f66d7cf63803a25146b815f704dab47458696688a796a7818
5
internal/host/rootmigration_production_linux.go migrateRootClaimAuthority authority G,J4,E3 rev3=census-ruling-claim-own-child;identity=offline root migration uid 0;basis=as before; its generation kernel census carries the migration's own pid so its registry child is recognised as its own file:Open@1814,file:Open@374,file:Open@615,file:Open@739,file:Open@7567,file:Read@2766,file:ReadFile@1571,whole:Route@3079 62482c7d1b91514578397f3f0bac42f34ec41d02f6cf19e3ded9fdff90795cc8
6
internal/host/rootgeneration_census_linux.go productionGenerationKernelCensus authority E2 rev3=census-ruling-claim-own-child;basis=as before; passes the context's census parent (generationCensusParent, zero unless journal-migrate set it) to the kernel 3588ecc2628ef3914113d306029adbc82143f542fcfb129a5ba35a5c8f15eb93
7
internal/host/rootgeneration_kernel_linux.go type generationKernel authority E2 rev3=census-ruling-claim-own-child;basis=as before, plus parent: the pid whose direct children pass the root-task rule untrusted; zero everywhere but journal-migrate 5ac1e05c15d44a84a968385bb81aff33d440d9d27256a2e4cfa57141c2c87f97
amadan