- Shipped
- September 4, 2026 at 6:49 PM UTC
- Author
- Kamo
- Commit
- 9bc47d6
The switch was invisible to god-eligible operators. It was gated on **************** — GD plus an opened break-glass window — and holding GD is not the same fact as having activated it. godMode(request) becomes godEligible(request) and reads godEligible(), and every parameter it feeds is renamed with it: a boolean called godMode that ignores the window is how this gets quietly reverted. This is now the one place in the service that reads eligibility rather than the window, and both the controller javadoc and the repository's say so explicitly, including the warning never to hand it to PlatformRightsResolver — it is a wider set, and the resolver would turn it into every platform right, permanently. canManage is untouched and still resolves MANAGE_SYSTEM_BUGS through the window. The two gates are different populations and neither contains the other: a platform administrator may triage every report without being god-eligible, and a god-eligible operator may do the reverse. SystemBugPublishTest gains **************** which pins WHERE the boolean comes from rather than what the method computes — a caller swapping back to the narrower flag would compile, pass every other test in the file, and leave every operator without a window unable to see the control, which is precisely the report that sent us back here.