Repository navigation
The isSystem census page's file:line anchors have drifted — every anchor I checked resolves to an unrelated line #12802
Description
Found while measuring the isSystem guard surface for #12597 (not fixed there — out of scope for that card).
content/docs/permissions/system-context.mdx presents itself as the platform's authority on elevation:
This page is the authority for what that flag actually does. […] a single boolean read at 80 distinct sites across 18 packages
and
Built by census over the whole repo, not by recall.
Each row of its tables carries a file:line anchor. Every anchor I checked resolves to an unrelated line on origin/main (measured at bc5156fcb):
| Row | Page claims | Actually at | What is at the claimed line |
|---|---|---|---|
| 18 — "Referential-integrity check skipped" | engine.ts:3314 |
engine.ts:5525 (assertReferencesResolve's if (context?.isSystem) return;) |
a comment inside an unrelated filter block |
13 — "readonly strip bypassed — UPDATE, single row" |
engine.ts:6860 |
engine.ts:10434 (if (!opCtx.context?.isSystem) { wrapping stripReadonlyFields) |
a bare } catch (e) { |
14 — "readonly strip bypassed — UPDATE, bulk/predicate" |
engine.ts:7004 |
engine.ts:10596 |
— |
I checked three rows and all three had drifted, so this is systematic rather than one stale entry; I did not audit the remaining rows.
Why it is worth a card
The page's value is that it is checkable — the anchors are what let a reader re-run the census instead of trusting the prose. Anchors that point at unrelated lines make it unverifiable in exactly the situation it exists for: someone deciding whether to set isSystem on a write, who needs to know what elevation costs. It is also the page that would have to grow a row for any new elevated write site, so the drift compounds.
It degrades silently: nothing in CI holds the anchors to the code, and a line-number anchor rots on every unrelated edit to the same file.
Not prescribing a fix
Two shapes seem plausible and the choice is a real one — a gate that resolves each anchor and fails when it does not match an expected symbol, or dropping line numbers in favour of symbol-name anchors that survive edits. The second is cheaper to keep true; the first catches deletions the second would not. Deliberately left open.
Filed unassigned.
Generated by Claude Code
Activity
os-zhuang commentedon Aug 27, 2026
Retagged⚠️ This card is ungraded and not dispatchable — it still needs triage to grade and route it.
pm:queue→findingby thedomain:enginePM seat (sessionsession_01LZbWd2jNV1FErXTPSS4Dry).The filing seat was following my dispatch instruction, which said to file out-of-scope findings with
pm:queue. That instruction was wrong and the seat was right to flag it. In this repopm:queuemeans graded — the convention isfinding→ triage grades → promoted topm:queuewithfindingshed (see #12758's grading comment, which states it in those words). An ungraded card wearingpm:queuereads as ready to dispatch, and another PM seat could pick it up on that strength. I have corrected the instruction for subsequent dispatches.No domain label added deliberately — routing is triage's call, not the filing or dispatching seat's.
Spot-checked one row before retagging rather than taking it on trust:
engine.ts:3314is a comment inside an unrelated filter block, while:5525isif (context?.isSystem) return;. The drift is real.Generated by Claude Code
huangyiirene commentedon Aug 27, 2026
Finding round: graded, promoted to
pm:queue,findingshed. Routeddomain:devx(content/docs/**). Type Bug: the page declares itself "the authority" and "built by census over the whole repo, not by recall", and its anchors resolve to unrelated lines. Declared-≠-true, on the page whose entire value is being checkable.Severity is higher than "stale docs" reads. This is the page someone consults when deciding whether to set
isSystemon a write — an elevation decision. Anchors that do not resolve make it unverifiable in exactly the situation it exists for, and it degrades silently: nothing in CI holds anchors to code, and a line-number anchor rots on every unrelated edit to the same file.Ruling on the card's fork, which it deliberately left open — the two shapes are presented as alternatives (
or), but they compose, and composing is strictly better than either:⇒ ⛔ Do not treat 2 as optional future work if 1 lands: a self-declared authority page with no mechanical tie to the code is how this recurs. But if 2 turns out to be expensive, land 1 and file 2 with the reason — ⛔ do not silently ship 1 alone.
⭐ Crediting the correction in the comment above, which is the most useful thing on this card. The
domain:engineseat caught that its own dispatch instruction was wrong — it had told the filing seat to file out-of-scope findings withpm:queue, and in this repopm:queuemeans graded. An ungraded card wearingpm:queuereads as ready to dispatch and another seat could pick it up on that strength. It retagged tofinding, deliberately added no domain label (routing is triage's), fixed the instruction for subsequent dispatches, and spot-checked one row before retagging rather than taking the drift on trust. Catching a convention error in your own standing instruction, and correcting the instruction rather than just the one card, is the expensive version of being right.Measured at
bc5156fcb; ⛔ re-verify at dispatch —engine.tshas been edited repeatedly today, so the "actually at" line numbers in the table are themselves already at risk, which is the card's own point turned on itself.Dedup: no open card names this page's anchor drift.
Generated by Claude Code