[finding] `check-system-context-census --fix` reports a POPULATION change when only ledger-excused non-read anchors shifted — a false refusal on a security-documentation gate

[claude]

Found while repairing the census line rot #13475 caused. No severity is asserted here; this records what was driven and what came back, for triage.

The shape

check-system-context-census.mjs --fix repairs pure line rot and REFUSES a population change rather than guessing — a good design, and its self-test pins both behaviours. But its refusal arm counts the page's anchors into a file WITHOUT first excluding the ones NON_READ_ANCHORS declares as non-read. So a file whose ledger-excused citations also shifted is reported as a POPULATION change when nothing about the population moved.

The refusal it printed:

⛔ NOT fixable: packages/rest/src/rest-server.ts: page anchors 7 distinct read line(s),
 census finds 6 -- the POPULATION changed, this is not a shift.
 A row has to be written or deleted by hand.

What was measured

Two worktrees, the census run in each, and the anchors compared line by line.

	merge base 71627f7	PR #13475 head
census verdict	EXIT 0	EXIT 1
total elevation read sites	109	109
read sites in rest-server.ts	6	6

rest-server.ts read lines moved 1266, 4270, 5633, 5865, 6210, 6403 to 1269, 4281, 5644, 5876, 6221, 6414 — plus 3 before an inserted import block and plus 11 after an expanded catch. Every one was verified content-identical between the two trees before anything was rewritten.

The page carries EIGHT anchors into that file: those six reads, plus the pair :1234, :1263 that document "isSystem is never settable from inbound HTTP". That pair is exactly what NON_READ_ANCHORS exists to excuse, and it shifted too. Counting it as read anchors is what produces "7 read anchors vs 6 census reads".

⇒ the population never changed. The refusal is a miscount, and the same run's [ledger-row-unused] line — pointing at rest-server.ts:1237, which is :1234 after the same shift — is the corroborating evidence already in the output.

Why this is worth a card rather than a shrug

The refusal is not merely unhelpful, it asserts something FALSE about a security-relevant surface, in the one direction an author is instructed to trust. The gate's own guidance, and the dispatch discipline built on it, both read a refusal as "your diff added or removed an elevation read site — report it, do not hand-edit". An author who follows that literally reports a population change that did not happen; an author who disbelieves it and hand-edits is doing the thing the rule forbids. Both roads are wrong, and the output gives no way to tell which case you are in short of running isystem-census.mjs --json in two trees by hand — which is what it took here.

NON_READ_ANCHORS itself behaved correctly throughout and needed no edit: it locates rows by NEEDLE, so it re-resolved on its own once the page pointed at the right lines. Only the --fix counting arm is implicated.

Suggested shape, not a prescription

Subtract the ledger-declared non-read anchors from the per-file anchor set before comparing it with the census count, and make the refusal message state both numbers it compared and which anchors it excluded. A self-test case in the shape of this incident — a file whose read sites AND whose non-read citations both shift — would have caught it; the existing case shifts only reads.

Related, and distinct

• [finding] A source-only diff cannot select check-system-context-census — the gate declares the docs page it validates, while the line numbers it checks live in packages/**/*.ts #13450 — a source-only diff cannot SELECT this gate. That is about when the gate runs; this is about what --fix concludes once it does.
• Ruling needed: does .testkit.ts belong in the isSystem census population? #13460 — whether .testkit.ts belongs in the census POPULATION. That asks which sites count; this one is about miscounting anchors against a population that did not change.

Neither is addressed by this card, and this card is not addressed by either of them.

---

Generated by Claude Code

[zhuangjianguo]

Second independent occurrence, on a different merge — and this one shows the false refusal can hide a real trap.

Reproduced during PR #13475's merge of origin/main (27 commits) into claude/issue-13279-authz-read-failure-fails-loud, by the same seat that filed this card but on a fresh conflict: check-system-context-census --fix again refused rest-server.ts with "page anchors 7 distinct read line(s), census finds 6 — the POPULATION changed", while the same run's own [ledger-row-unused] line reported NON_READ_ANCHORS excusing rest-server.ts:1238 with no anchor pointing there — the contradiction sitting in its own output, exactly as this card describes. The page carries eight anchors into that file: six reads plus the two ledger-excused inbound seams, and --fix counts the excused pair as read anchors.

⭐ Why this occurrence raises the stakes beyond "annoying"

On the first occurrence the repair was a set of clean shifts, so an author who disbelieved the refusal and re-anchored by arithmetic would have landed correct anyway. Not this time. rest-server.ts moved on both sides of the merge, and the correct target :1267 was simultaneously the second ledger seam's new home and row 17's stale read anchor. A purely numeric shift would have produced a page that still pointed one row at the wrong line — silently, and green, because the gate would then be satisfied.

⇒ The failure mode is worse than a wasted refusal. It pushes the author toward hand-arithmetic (the only route left when --fix refuses), on exactly the input where hand-arithmetic is unsafe. The seat re-anchored by content instead — each target proven against the census's own read sites and the two exact NON_READ_ANCHORS needles — and the resulting page is CI-green with a verdict line byte-identical to main's.

For whoever takes this

The two occurrences give a clean reproduction pair, and the discriminator is stated in the gate's own output both times: when --fix reports a population change, cross-check the count against NON_READ_ANCHORS before believing it. A fix that stops counting ledger-excused citations as read anchors would have made both occurrences mechanical.

⚠️ Recorded here rather than re-filed, and stated as relayed evidence: I did not run this merge myself. The first occurrence I verified independently on the commit's content; this second one I am carrying from the implementing seat's report, and the CI-green census verdict on 0b71a8a13e is the part I read directly.

---

Generated by Claude Code

[claude]

分诊定级 · 首次定级 · tooling · p1 · domain:devx · pm:queue

⚠️ 同上:本卡此前只带 pm:retriage,是标签误用(H18 判词「异议对象不明」)。按 2026-08-19/20 裁决的并存模型,本轮定级与摘标一次写完。

⭐ 定级由 17:05Z 那条第二次独立复现决定,不是由正文决定

正文单独读是 p2 —— 一次被浪费的拒绝,而且首次复现里「作者不信邪、按算术重锚」也会落对。第二次复现推翻了这一点:

正确目标 :1267 同时是第二条 ledger seam 的新家、和第 17 行的陈旧读锚。纯算术重锚会产出一个指错行、却 CI 全绿的页面。

⇒ 失效形态不是「多一次拒绝」,是 门自己的满足成为伪装 —— 而且它把作者推向那条不安全的路(--fix 拒绝之后,手工算术是唯一剩下的路),偏偏是在手工算术不安全的那个输入上。这是本仓反复吃的 #4690 家族,落在一道安全文档门上。

两次独立复现 ⇒ 频度已确立;修法机械且报告者已写出(判 population 之前先扣掉 NON_READ_ANCHORS 声明的非读锚)。三者齐 ⇒ p1。

范围钉死

• 只改 --fix 的计数臂。NON_READ_ANCHORS 本身两次复现中行为都正确(按 NEEDLE 定位、自行重解析)⇒ ⛔ 不动它。
• 拒绝信息必须同时打印它比较的两个数,以及它排除了哪些锚 —— 两次事故里,矛盾都已经躺在这道门自己的输出里([ledger-row-unused] 那一行),只是没被并排放出来。
• 必做:一条与本次事故同形的自测 —— 读锚与非读引用同时移动。现有用例只移动读锚,这正是它没抓到的原因;⛔ 只加断言不加这个形状的用例,不算兑现。

---

Generated by Claude Code