Found while repairing the census line rot #13475 caused. No severity is asserted here; this records what was driven and what came back, for triage.
The shape
check-system-context-census.mjs --fix repairs pure line rot and REFUSES a population change rather than guessing — a good design, and its self-test pins both behaviours. But its refusal arm counts the page's anchors into a file WITHOUT first excluding the ones NON_READ_ANCHORS declares as non-read. So a file whose ledger-excused citations also shifted is reported as a POPULATION change when nothing about the population moved.
The refusal it printed:
⛔ NOT fixable: packages/rest/src/rest-server.ts: page anchors 7 distinct read line(s),
census finds 6 -- the POPULATION changed, this is not a shift.
A row has to be written or deleted by hand.
What was measured
Two worktrees, the census run in each, and the anchors compared line by line.
|
merge base 71627f7 |
PR #13475 head |
| census verdict |
EXIT 0 |
EXIT 1 |
| total elevation read sites |
109 |
109 |
read sites in rest-server.ts |
6 |
6 |
rest-server.ts read lines moved 1266, 4270, 5633, 5865, 6210, 6403 to 1269, 4281, 5644, 5876, 6221, 6414 — plus 3 before an inserted import block and plus 11 after an expanded catch. Every one was verified content-identical between the two trees before anything was rewritten.
The page carries EIGHT anchors into that file: those six reads, plus the pair :1234, :1263 that document "isSystem is never settable from inbound HTTP". That pair is exactly what NON_READ_ANCHORS exists to excuse, and it shifted too. Counting it as read anchors is what produces "7 read anchors vs 6 census reads".
⇒ the population never changed. The refusal is a miscount, and the same run's [ledger-row-unused] line — pointing at rest-server.ts:1237, which is :1234 after the same shift — is the corroborating evidence already in the output.
Why this is worth a card rather than a shrug
The refusal is not merely unhelpful, it asserts something FALSE about a security-relevant surface, in the one direction an author is instructed to trust. The gate's own guidance, and the dispatch discipline built on it, both read a refusal as "your diff added or removed an elevation read site — report it, do not hand-edit". An author who follows that literally reports a population change that did not happen; an author who disbelieves it and hand-edits is doing the thing the rule forbids. Both roads are wrong, and the output gives no way to tell which case you are in short of running isystem-census.mjs --json in two trees by hand — which is what it took here.
NON_READ_ANCHORS itself behaved correctly throughout and needed no edit: it locates rows by NEEDLE, so it re-resolved on its own once the page pointed at the right lines. Only the --fix counting arm is implicated.
Suggested shape, not a prescription
Subtract the ledger-declared non-read anchors from the per-file anchor set before comparing it with the census count, and make the refusal message state both numbers it compared and which anchors it excluded. A self-test case in the shape of this incident — a file whose read sites AND whose non-read citations both shift — would have caught it; the existing case shifts only reads.
Related, and distinct
Neither is addressed by this card, and this card is not addressed by either of them.
Generated by Claude Code
Found while repairing the census line rot #13475 caused. No severity is asserted here; this records what was driven and what came back, for triage.
The shape
check-system-context-census.mjs --fixrepairs pure line rot and REFUSES a population change rather than guessing — a good design, and its self-test pins both behaviours. But its refusal arm counts the page's anchors into a file WITHOUT first excluding the onesNON_READ_ANCHORSdeclares as non-read. So a file whose ledger-excused citations also shifted is reported as a POPULATION change when nothing about the population moved.The refusal it printed:
What was measured
Two worktrees, the census run in each, and the anchors compared line by line.
rest-server.tsrest-server.tsread lines moved1266, 4270, 5633, 5865, 6210, 6403to1269, 4281, 5644, 5876, 6221, 6414— plus 3 before an inserted import block and plus 11 after an expandedcatch. Every one was verified content-identical between the two trees before anything was rewritten.The page carries EIGHT anchors into that file: those six reads, plus the pair
:1234,:1263that document "isSystem is never settable from inbound HTTP". That pair is exactly whatNON_READ_ANCHORSexists to excuse, and it shifted too. Counting it as read anchors is what produces "7 read anchors vs 6 census reads".⇒ the population never changed. The refusal is a miscount, and the same run's
[ledger-row-unused]line — pointing atrest-server.ts:1237, which is:1234after the same shift — is the corroborating evidence already in the output.Why this is worth a card rather than a shrug
The refusal is not merely unhelpful, it asserts something FALSE about a security-relevant surface, in the one direction an author is instructed to trust. The gate's own guidance, and the dispatch discipline built on it, both read a refusal as "your diff added or removed an elevation read site — report it, do not hand-edit". An author who follows that literally reports a population change that did not happen; an author who disbelieves it and hand-edits is doing the thing the rule forbids. Both roads are wrong, and the output gives no way to tell which case you are in short of running
isystem-census.mjs --jsonin two trees by hand — which is what it took here.NON_READ_ANCHORSitself behaved correctly throughout and needed no edit: it locates rows by NEEDLE, so it re-resolved on its own once the page pointed at the right lines. Only the--fixcounting arm is implicated.Suggested shape, not a prescription
Subtract the ledger-declared non-read anchors from the per-file anchor set before comparing it with the census count, and make the refusal message state both numbers it compared and which anchors it excluded. A self-test case in the shape of this incident — a file whose read sites AND whose non-read citations both shift — would have caught it; the existing case shifts only reads.
Related, and distinct
check-system-context-census— the gate declares the docs page it validates, while the line numbers it checks live inpackages/**/*.ts#13450 — a source-only diff cannot SELECT this gate. That is about when the gate runs; this is about what--fixconcludes once it does..testkit.tsbelong in theisSystemcensus population? #13460 — whether.testkit.tsbelongs in the census POPULATION. That asks which sites count; this one is about miscounting anchors against a population that did not change.Neither is addressed by this card, and this card is not addressed by either of them.
Generated by Claude Code