@bongos/core 1.19.505 → 1.19.506

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.505",
-  "core_contract": "1.19.505",
-  "source_commit": "3ab4e5ad43e20da1374af1e120d51911fd799680",
+  "core_version": "1.19.506",
+  "core_contract": "1.19.506",
+  "source_commit": "0c5102c78cf4acf0c5ab19a0f34ab43caa0a53d0",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T17:32:35.678Z",
+  "built_at": "2026-09-03T17:56:16.813Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 427,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1944,
+    "functional_verbatim": 1945,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2395,
-  "tree_sha256": "1bc57733b6267db17eb8b78650effda973d902370c46f3be51c0764e1858de00",
+  "file_count": 2396,
+  "tree_sha256": "d0ec8df4b7c843085a5692c55b908977f2bbc25023e21dc62e246e62cfdfbd0d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1727,12 +1727,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "276273f5edb4e920ce7ffdf33707b3e08c259ab22a45427ebde2f4f1bfdc2831"
+      "sha256": "6f3476adddccabea94bb3bb8af804ec1e6dfc1710a9e3f76fb4ba062b44e3234"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "b6bf1dcc9d8b2bbef68d5ff7b8f2e2b9a3e5d2d504562c21cacd0e3b9a0e9905"
+      "sha256": "d6f13f1ab6d579e195b3240511d68181aabd64591933f1911fc0009fbdf875d8"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2577,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6e57f6714292cf1ab9df6ec0c481390848d08ee35f399719ec5833d2699ed8bd"
+      "sha256": "130aad5d413e749405b9f5104259cdfb9dfde539ae35326649c64e79c5ff6604"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4997,12 +4997,12 @@
     {
       "path": "modules/hall-ui/public/sessions.html",
       "mode": "0000644",
-      "sha256": "cb5a4b2ece4f73cc2ccc29577cd5c724314260b8e7cf6790981ee06866fd4145"
+      "sha256": "160985637f34bbf424e9333af158b260aad268e4a1dd9f22cf4da789283746b2"
     },
     {
       "path": "modules/hall-ui/public/sessions.js",
       "mode": "0000644",
-      "sha256": "6cc6ea120acd76bc42901adaa57f89f98f87eadfc2088ce4f6ccaa20106347ce"
+      "sha256": "9470e5816bcb5aa0a77856413df9e20e5d5aa1a1948a01d41810037e8355e7f9"
     },
     {
       "path": "modules/hall-ui/public/sessions.states.json",
@@ -7227,12 +7227,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5b46ca655ee12c47c36c6d2e05baea5d10bdf139404a931c041225e7e0343426"
+      "sha256": "7a6dd18246bdbc4fbf57c52d54246a17ce2f5fb144bb256a6a163804175a8be3"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "54330892dd305c453d6e4f8b18051ba2116277c101651f912da36c07b15e314c"
+      "sha256": "26b904a0eb436c1b3654cac79c075a39ccd61bd9db7d3eab8c96f43507fd2686"
     },
     {
       "path": "public-docs/index.html",
@@ -8902,7 +8902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "da3ceeaa7c239b0ec879e2724b32c30d3efae1ef2440d5d8defa0a729f18c69d"
+      "sha256": "818b1e08d902b65dedaf1d670b920a12f8eedbc3191051c4977675ec34a4e8d6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10282,7 +10282,7 @@
     {
       "path": "tests/hall_audit.mjs",
       "mode": "0000644",
-      "sha256": "f6b972549bd19663760d9a65512e622799ad833613b5d4cfa365fa331997f052"
+      "sha256": "7df5602bb92b44186613870501ecb4e959c9288f8d103cfc8075a3a24d51d840"
     },
     {
       "path": "tests/hall_board_world.mjs",
@@ -11524,6 +11524,11 @@
       "mode": "0000644",
       "sha256": "a630ac72981f230e8aa6609152765c13e8928ac329cb0ff3fe615371f31208d2"
     },
+    {
+      "path": "tests/sessions_kit_pager.mjs",
+      "mode": "0000644",
+      "sha256": "ce4a6f81b17821ed34710f2e3f616eeb51655973b3c9b2537b74f7c371ef0719"
+    },
     {
       "path": "tests/setup_device_flow_fallback.mjs",
       "mode": "0000644",

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1626 strings** across 3 surfaces · 1416 distinct pieces of copy · 1626 certain, 0 heuristic · 150 shown in more than one place.
+**1623 strings** across 3 surfaces · 1412 distinct pieces of copy · 1623 certain, 0 heuristic · 151 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 73 | 1183 |
+| `builders-hall` | `modules/hall-ui/public` | 73 | 1180 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 98 |
 | `landing` | `modules/public-landing/public` | 5 | 345 |
 
@@ -76,9 +76,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f6bb75b08e98` | 2x | Back to {…} | modules/hall-ui/public/task.js:188, modules/hall-ui/public/task.js:197 |
 | `60b248791dc3` | 2x | Builders — {{worldName}} | modules/hall-ui/public/roster.html:6, modules/hall-ui/public/roster.html:6 |
 | `563d29ed86d8` | 2x | Bulk actions | modules/hall-ui/public/goals.html:172, modules/hall-ui/public/work.html:129 |
-| … | | _110 more in the JSON registry_ | |
+| … | | _111 more in the JSON registry_ | |
 
-## `builders-hall` — 1183 strings
+## `builders-hall` — 1180 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -284,8 +284,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `589a4cfc5442` | certain | Could not load idea {…}. | `modules/hall-ui/public/ideas.js:629` |
 | `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:318` |
 | `8a4b590fa1a0` | certain | Could not load requests. | `modules/hall-ui/public/collab.js:173` |
-| `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:187` |
-| `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:226` |
+| `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:243` |
+| `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:281` |
 | `b2147cc90e36` | certain | Could not load the idea template. Reload, or file from the terminal with capture.js. | `modules/hall-ui/public/ideas.js:611` |
 | `7604af13c40e` | certain | Could not load the profile. | `modules/hall-ui/public/profile.js:759` |
 | `8b69e445592a` | certain | Could not load the question labels; showing the answers as stored. | `modules/hall-ui/public/idea.js:244` |
@@ -330,7 +330,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b1602d01f4bb` | certain | Could not unblock: {…} | `modules/hall-ui/public/harbor.js:187` |
 | `3db890b074a7` | certain | Could not update visibility just now. | `modules/hall-ui/public/goals-render.js:1043` |
 | `112d12b24879` | certain | Could not verify your access. Go back and try again. | `modules/hall-ui/public/watch.js:1010` |
-| `6bd74fd20311` | certain | Could not verify your access. Try again. | `modules/hall-ui/public/sessions.js:225` |
+| `6bd74fd20311` | certain | Could not verify your access. Try again. | `modules/hall-ui/public/sessions.js:280` |
 | `278e8281c82f` | certain | Could not vote: {…} | `modules/hall-ui/public/government.js:990` |
 | `a48e9f098392` | certain | Could not {…} just now. | `modules/hall-ui/public/goals-render.js:1029` |
 | `cb09ee26014f` | certain | Could not {…}: {…} | `modules/hall-ui/public/government.js:321` |
@@ -559,7 +559,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9af4b7a3a36f` | certain | Module truth | `modules/hall-ui/public/atlas.html:48` |
 | `319e9db996ea` | certain | Modules — {{worldName}} | `modules/hall-ui/public/modules.html:6` |
 | `319e9db996ea` | certain | Modules — {{worldName}} | `modules/hall-ui/public/modules.html:6` |
-| `1ae18e58fead` | certain | Most recent first. Each load of this page is itself recorded in the audit log. | `modules/hall-ui/public/sessions.js:160` |
+| `1ae18e58fead` | certain | Most recent first. Each load of this page is itself recorded in the audit log. | `modules/hall-ui/public/sessions.js:196` |
 | `f14a91b3f625` | certain | Most recent first. Each row is one recorded work session; every id on it opens its record. | `modules/hall-ui/public/sessions.html:56` |
 | `e52ae74f0052` | certain | Move to goal | `modules/hall-ui/public/task.js:510` |
 | `ae84ebe1d735` | certain | Name cannot be blank. | `modules/hall-ui/public/settings.js:831` |
@@ -618,7 +618,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/work.js:1016` |
 | `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:258` |
 | `9d25ba1d2f17` | certain | Off voice — says it in the wrong register | `modules/hall-ui/public/copy-desk.html:89` |
-| `55bc72820efc` | certain | Older → | `modules/hall-ui/public/sessions.html:70` |
 | `b89ad49770e7` | certain | On Windows, run | `modules/hall-ui/public/hall-render.js:811` |
 | `11a1905c76b2` | certain | On the board | `modules/hall-ui/public/hall-render.js:556` |
 | `ea1f179dd878` | certain | On this page | `modules/hall-ui/public/drachmae.html:51` |
@@ -650,7 +649,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `695ffff13730` | certain | Over time | `modules/hall-ui/public/profile.html:72` |
 | `5ded44da0cc5` | certain | Override requests | `modules/hall-ui/public/watch.html:139` |
 | `15a49bf15007` | certain | Page {…} of {…} | `modules/hall-ui/public/hall-kit.js:109` |
-| `d1cd74b39c2e` | certain | Page {…} of {…} · {…}–{…} of {…} | `modules/hall-ui/public/sessions.js:143` |
 | `8595b0aa76a0` | certain | Pair Claude Desktop | `modules/hall-ui/public/settings.html:242` |
 | `cf68a394cfa5` | certain | Paste command copied. | `modules/hall-ui/public/settings.js:996` |
 | `a495649d1f82` | certain | Paste your key first. | `modules/hall-ui/public/settings.js:1117` |
@@ -774,7 +772,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ae43a132699b` | certain | Selectable today | `modules/hall-ui/public/government.js:721` |
 | `d14e8e9acaff` | certain | Session ended. | `modules/hall-ui/public/settings-sessions.js:81` |
 | `55e0a34bafed` | certain | Session log{…} | `modules/hall-ui/public/task.js:447` |
-| `3f8f6c62adb8` | certain | Session pages | `modules/hall-ui/public/sessions.html:67` |
 | `cccb362bd6da` | certain | Sessions — {{worldName}} | `modules/hall-ui/public/sessions.html:6` |
 | `cccb362bd6da` | certain | Sessions — {{worldName}} | `modules/hall-ui/public/sessions.html:6` |
 | `b823d9a37a35` | certain | Set up key storage | `modules/hall-ui/public/settings.js:1069` |
@@ -878,7 +875,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `38ce5d68c182` | certain | The roster | `modules/hall-ui/public/roster.html:36` |
 | `dd6a926b8137` | certain | The same sentence, in several places. Sometimes that is right and the answer is to dismiss it; sometimes it is | `modules/hall-ui/public/copy-desk.html:57` |
 | `cd4ceb6e7e48` | certain | The seeded plan | `modules/hall-ui/public/roadmap.js:194` |
-| `d01d36a596b0` | certain | The session log could not be loaded. Try again. | `modules/hall-ui/public/sessions.js:186` |
+| `d01d36a596b0` | certain | The session log could not be loaded. Try again. | `modules/hall-ui/public/sessions.js:242` |
+| `d01d36a596b0` | certain | The session log could not be loaded. Try again. | `modules/hall-ui/public/sessions.js:294` |
 | `e48a9b77d91b` | certain | The session log opens from a higher rank. | `modules/hall-ui/public/sessions.html:41` |
 | `af664a644b13` | certain | The seven government structures, for getting a team up to speed before deciding when to flip a switch. | `modules/hall-ui/public/government.js:721` |
 | `6360a5988f26` | certain | The shape and health of the codebase. | `modules/hall-ui/public/watch.html:112` |
@@ -1205,7 +1203,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `275f3565c78b` | certain | {…} reset to its default {…} permissions. | `modules/hall-ui/public/government.js:304` |
 | `33afba17ee0f` | certain | {…} seeded | `modules/hall-ui/public/roadmap.js:194` |
 | `732b4c935e36` | certain | {…} sessions | `modules/hall-ui/public/task.js:446` |
-| `3d76dce19c4a` | certain | {…} session{…} across {…} builder{…}. | `modules/hall-ui/public/sessions.js:158` |
+| `3d76dce19c4a` | certain | {…} session{…} across {…} builder{…}. | `modules/hall-ui/public/sessions.js:194` |
 | `e08fa22622f0` | certain | {…} shipped, {…} confirmed, {…} completed, {…} remaining of {…} | `modules/hall-ui/public/roadmap.js:74` |
 | `e08fa22622f0` | certain | {…} shipped, {…} confirmed, {…} completed, {…} remaining of {…} | `modules/hall-ui/public/roadmap.js:273` |
 | `ad27ae9f5433` | certain | {…} tasks · {…} | `modules/hall-ui/public/roadmap.js:390` |
@@ -1253,7 +1251,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7926e30955d2` | certain | ← Back to goal | `modules/hall-ui/public/goals.html:184` |
 | `7926e30955d2` | certain | ← Back to goal | `modules/hall-ui/public/goals.html:195` |
 | `7926e30955d2` | certain | ← Back to goal | `modules/hall-ui/public/goals.html:207` |
-| `1e7cf7b1e64e` | certain | ← Newer | `modules/hall-ui/public/sessions.html:68` |
 | `2180e0ecf138` | certain | → no idea # | `modules/hall-ui/public/task-detail.js:484` |
 | `d5d76f1c0dfe` | certain | ○ reserved | `modules/hall-ui/public/diagrams.html:44` |
 | `97b0773e72a5` | certain | ● LIVE | `modules/hall-ui/public/diagrams.html:42` |

package/docs/copy-registry.json

@@ -3,17 +3,17 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1626,
-    "unique_ids": 1416,
-    "certain": 1626,
+    "strings": 1623,
+    "unique_ids": 1412,
+    "certain": 1623,
     "heuristic": 0,
-    "duplicate_ids": 150
+    "duplicate_ids": 151
   },
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 73,
-      "strings": 1183
+      "strings": 1180
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -604,8 +604,8 @@
       "text": "Could not load sessions.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/sessions.js:187",
-        "modules/hall-ui/public/sessions.js:226"
+        "modules/hall-ui/public/sessions.js:243",
+        "modules/hall-ui/public/sessions.js:281"
       ]
     },
     {
@@ -1268,6 +1268,16 @@
         "modules/hall-ui/public/primer.html:89"
       ]
     },
+    {
+      "id": "d01d36a596b0",
+      "surface": "builders-hall",
+      "text": "The session log could not be loaded. Try again.",
+      "occurrences": 2,
+      "at": [
+        "modules/hall-ui/public/sessions.js:242",
+        "modules/hall-ui/public/sessions.js:294"
+      ]
+    },
     {
       "id": "e9a366866022",
       "surface": "builders-hall",
@@ -3423,7 +3433,7 @@
       "surface": "builders-hall",
       "text": "Could not load sessions.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 187,
+      "line": 243,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3432,7 +3442,7 @@
       "surface": "builders-hall",
       "text": "Could not load sessions.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 226,
+      "line": 281,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3837,7 +3847,7 @@
       "surface": "builders-hall",
       "text": "Could not verify your access. Try again.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 225,
+      "line": 280,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5898,7 +5908,7 @@
       "surface": "builders-hall",
       "text": "Most recent first. Each load of this page is itself recorded in the audit log.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 160,
+      "line": 196,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6424,15 +6434,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "55bc72820efc",
-      "surface": "builders-hall",
-      "text": "Older →",
-      "file": "modules/hall-ui/public/sessions.html",
-      "line": 70,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "b89ad49770e7",
       "surface": "builders-hall",
@@ -6712,15 +6713,6 @@
       "origin": "js-text-assign",
       "confidence": "certain"
     },
-    {
-      "id": "d1cd74b39c2e",
-      "surface": "builders-hall",
-      "text": "Page {…} of {…} · {…}–{…} of {…}",
-      "file": "modules/hall-ui/public/sessions.js",
-      "line": 143,
-      "origin": "js-text-assign",
-      "confidence": "certain"
-    },
     {
       "id": "8595b0aa76a0",
       "surface": "builders-hall",
@@ -7828,15 +7820,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "3f8f6c62adb8",
-      "surface": "builders-hall",
-      "text": "Session pages",
-      "file": "modules/hall-ui/public/sessions.html",
-      "line": 67,
-      "origin": "html-attr:aria-label",
-      "confidence": "certain"
-    },
     {
       "id": "cccb362bd6da",
       "surface": "builders-hall",
@@ -8769,7 +8752,16 @@
       "surface": "builders-hall",
       "text": "The session log could not be loaded. Try again.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 186,
+      "line": 242,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
+    {
+      "id": "d01d36a596b0",
+      "surface": "builders-hall",
+      "text": "The session log could not be loaded. Try again.",
+      "file": "modules/hall-ui/public/sessions.js",
+      "line": 294,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -11712,7 +11704,7 @@
       "surface": "builders-hall",
       "text": "{…} session{…} across {…} builder{…}.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 158,
+      "line": 194,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -12139,15 +12131,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "1e7cf7b1e64e",
-      "surface": "builders-hall",
-      "text": "← Newer",
-      "file": "modules/hall-ui/public/sessions.html",
-      "line": 68,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "2180e0ecf138",
       "surface": "builders-hall",

package/docs/module-api-changelog.md

@@ -1447,5 +1447,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.503 with no explicit bump. run 33784387586. (task 1002620)
   1.19.505 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.504 with no explicit bump. run 33785121177. (task 1002620)
+  1.19.506 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.505 with no explicit bump. run 33787453336. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/sessions.html

@@ -64,11 +64,11 @@
             </thead>
             <tbody id="sessions-body"></tbody>
           </table>
-          <nav class="pager" id="ledger-pager" hidden aria-label="Session pages">
-            <button type="button" class="btn-ghost" id="pager-prev">← Newer</button>
-            <span class="pager__range" id="pager-pos"></span>
-            <button type="button" class="btn-ghost" id="pager-next">Older →</button>
-          </nav>
+          <!-- The kit stamps the pager bar here (sessions.js, OTBKit.pagerBarHtml).
+               makeLedger is deliberately NOT used: it stamps table + pager into one
+               mount, and this page keeps them separate so the bar sits below the
+               ledger rather than inside whatever scrollport the table is in. -->
+          <div id="sessions-pager-mount"></div>
           <p class="ledger__note" id="ledger-foot"></p>
         </section>
       </main>
@@ -88,7 +88,11 @@
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
+<!-- The shared component kit — the pager contract this page now uses instead of
+     its own (task 1003279-sibling follow-up of 1003281). Must load BEFORE
+     sessions.js, which reads window.OTBKit at boot. -->
+<script src="/builders/hall-kit.js"></script>
 <script src="/builders/brand-apply.js?v=2026-06-19-r56"></script>
-<script src="/builders/sessions.js?v=2026-06-19-r56"></script>
+<script src="/builders/sessions.js?v=2026-08-28-kitpager"></script>
 </body>
 </html>

package/modules/hall-ui/public/sessions.js

@@ -121,91 +121,146 @@
     $('#sessions-scroll').hidden = true;
   }
 
-  // ---- paging state --------------------------------------------------------
+  // ---- paging --------------------------------------------------------------
+  //
+  // This page used to hand-roll its own server-offset pager, and hall-ui/CLAUDE.md
+  // carried it as the ONE sanctioned exception to "no bespoke pager" (audited task
+  // 2179) — because the kit could only slice an array the browser already held, and
+  // this corpus cannot be held. Task 1003281 added the server-offset mode to the kit
+  // and left the migration as its own task; this is it. The exception is gone, so
+  // there is one pager contract in the hall again rather than one-plus-a-footnote.
+  //
+  // What the reader gains: a per-page control that remembers their choice, and a
+  // clamp — if the corpus shrinks under an open page, renderServerPage() says so and
+  // we re-ask, instead of showing an empty page under a range that claims rows.
+  //
+  // The one thing NOT taken from the kit is makeLedger: it stamps table+pager into a
+  // single mount, and the CARD is this page's scroll container (hall-ui/CLAUDE.md, the
+  // sideways-scroll rule), so a pager stamped into the table's mount would slide with
+  // the columns. Keeping it a separate sibling below the ledger is what holds it still.
+  // (This page used to carry a .ledger-table-wrap scrollport; task 1003470 removed it
+  // because the wrapper broke the shell's sticky th. The separate mount outlived it.)
+  // Table markup stays in sessions.html; the PAGER is the kit's.
 
-  const PAGE_SIZE = 50;
-  const state = { offset: 0, total: 0 };
+  // Guarded the way every other kit consumer guards it (profile.js): the kit is a
+  // separate <script>, so a cache miss or a load-order slip must degrade to a named
+  // failure rather than an uncaught throw at parse time that also kills load().
+  const kit = window.OTBKit;
+  const PAGER_PREFIX = 'sessions';
+  // 50 was this page's fixed page size before the per-page control existed; keeping it
+  // as the default means a returning reader's first page looks exactly as it did.
+  const pager = kit ? kit.makePager(PAGER_PREFIX, 'otb.sessions.perPage', { defaultPerPage: 50 }) : null;
+  // `page`/`perPage` here are the last values that actually PAINTED. The kit moves the
+  // pager first and calls back second, so a failed fetch has to put it back to these —
+  // otherwise the bar goes on claiming a page whose rows never arrived. Keeping both
+  // (not just the page) means a failed per-page change rolls back cleanly too.
+  const state = { total: 0, shown: 0, page: 1, perPage: pager?.perPage ?? 0 };
   let loading = false;
+  // Two clicks can be in flight at once; only the newest may paint (the profile
+  // activity-log idiom, task 1003281).
+  let inFlight = 0;
 
+  // Paint the kit's bar, then apply the one thing the kit deliberately does not model:
+  // a fetch is in flight, so nothing may be pressed again until it lands. Only the
+  // DISABLING is ours — re-enabling the arrows is left to the kit, which knows whether
+  // there is a page on either side; re-enabling them here would light up "Prev" on
+  // page 1. Returns the kit's clamped flag: true = the page outran a shrunken corpus.
   function renderPager() {
-    const pager = $('#ledger-pager');
-    const total = state.total;
-    if (total <= PAGE_SIZE) {
-      // Everything fits on one page — no pager needed.
-      pager.hidden = true;
-      return;
+    const clamped = kit.renderServerPage(pager, state.total, state.shown);
+    const perPage = $(`#${PAGER_PREFIX}-per-page`);
+    if (perPage) perPage.disabled = loading;
+    if (loading) {
+      for (const id of ['prev', 'next']) {
+        const el = $(`#${PAGER_PREFIX}-${id}`);
+        if (el) el.disabled = true;
+      }
     }
-    pager.hidden = false;
-    const page = Math.floor(state.offset / PAGE_SIZE) + 1;
-    const pages = Math.max(1, Math.ceil(total / PAGE_SIZE));
-    const from = state.offset + 1;
-    const to = Math.min(state.offset + PAGE_SIZE, total);
-    $('#pager-pos').textContent = `Page ${fmtInt(page)} of ${fmtInt(pages)} · ${fmtInt(from)}–${fmtInt(to)} of ${fmtInt(total)}`;
-    $('#pager-prev').disabled = loading || state.offset <= 0;
-    $('#pager-next').disabled = loading || state.offset + PAGE_SIZE >= total;
+    return clamped;
   }
 
+  // Paint one page. Returns true when the pager clamped — the corpus shrank under an
+  // open page, so the caller must re-ask rather than leave a range that lies.
   function showData(data) {
     const sessions = Array.isArray(data.sessions) ? data.sessions : [];
     const totals = data.totals || { total: data.total || sessions.length };
     state.total = num(totals.total);
+    state.shown = sessions.length;
     $('#gate-scroll').hidden = true;
     $('#stats-scroll').hidden = false;
     $('#sessions-scroll').hidden = false;
     renderStats(totals);
     renderTable(sessions);
-    renderPager();
+    const clamped = renderPager();
     $('#ledger-sub').textContent =
       `${fmtInt(totals.total)} session${num(totals.total) === 1 ? '' : 's'} across ${fmtInt(totals.builders)} builder${num(totals.builders) === 1 ? '' : 's'}.`;
     $('#ledger-foot').textContent =
       'Most recent first. Each load of this page is itself recorded in the audit log.';
+    return clamped;
   }
 
   // ---- load ----------------------------------------------------------------
 
-  // Fetch one page at the current offset. Returns true on success.
-  async function fetchPage() {
+  // Fetch the page the pager currently points at. Returns true on success.
+  //
+  // `pager.page` has ALREADY moved by the time this runs — wirePager advances it and
+  // then calls back — so a failure restores `state.page`/`state.perPage`, the last
+  // values that painted. That roll-back is what the old hand-roll did with
+  // `state.offset`, and it is the one piece of it worth carrying over.
+  async function fetchPage({ reclamps = 0 } = {}) {
+    const seq = ++inFlight;
     loading = true;
     renderPager();
     try {
       const res = await api.request(
         'GET',
-        `${API}/sessions/search?order=recent&limit=${PAGE_SIZE}&offset=${state.offset}`
+        `${API}/sessions/search?order=recent&limit=${pager.perPage}&offset=${kit.pageOffset(pager)}`
       );
+      // A newer click already went out; painting this answer would show a page nobody
+      // is on any more.
+      if (seq !== inFlight) return true;
       if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return false; }
       if (res.status === 403) {
         showSealed('You do not have access to the session log.');
         return false;
       }
       if (!res.ok) throw new Error(`search → ${res.status}`);
-      const data = res.data;
-      showData(data);
+      const clamped = showData(res.data);
+      // The corpus shrank under this page (sessions pruned between loads):
+      // renderServerPage pulled the page back into range, so go get the rows that page
+      // actually holds rather than leaving a range that disagrees with the table.
+      // One re-ask, never a loop: a corpus shrinking on every round-trip would
+      // otherwise spin here, and a stale range for one paint is the smaller harm.
+      if (clamped && reclamps < 1) { loading = false; return fetchPage({ reclamps: reclamps + 1 }); }
+      state.page = pager.page;
+      state.perPage = pager.perPage;
       return true;
     } catch (err) {
+      if (seq !== inFlight) return true;
       console.error('[sessions] failed to load corpus', err);
+      pager.page = state.page;
+      pager.perPage = state.perPage;
       $('#ledger-sub').textContent = 'The session log could not be loaded. Try again.';
       toast('Could not load sessions.');
       return false;
     } finally {
-      loading = false;
-      renderPager();
+      if (seq === inFlight) {
+        loading = false;
+        renderPager();
+      }
     }
   }
 
-  async function goTo(offset) {
-    if (loading) return;
-    const next = Math.max(0, offset);
-    if (next === state.offset) return;
-    const prev = state.offset;
-    state.offset = next;
-    const ok = await fetchPage();
-    if (!ok) state.offset = prev; // roll back on failure so the pager stays honest
-    else window.scrollTo({ top: 0, behavior: 'smooth' });
-  }
-
-  function wirePager() {
-    $('#pager-prev').addEventListener('click', () => goTo(state.offset - PAGE_SIZE));
-    $('#pager-next').addEventListener('click', () => goTo(state.offset + PAGE_SIZE));
+  function mountPager() {
+    const mount = $('#sessions-pager-mount');
+    if (!mount) return;
+    mount.innerHTML = kit.pagerBarHtml(PAGER_PREFIX, { label: 'sessions' });
+    // The kit has already updated `pager` by the time this fires; go get the rows that
+    // match it. Scrolling up only on success keeps a failed page from yanking the
+    // reader away from the table they were still looking at.
+    kit.wirePager(pager, async () => {
+      const ok = await fetchPage();
+      if (ok) window.scrollTo({ top: 0, behavior: 'smooth' });
+    });
   }
 
   async function load() {
@@ -234,8 +289,14 @@
       return;
     }
 
+    if (!kit) {
+      console.error('[sessions] OTBKit did not load — the pager cannot be built');
+      $('#ledger-sub').textContent = 'The session log could not be loaded. Try again.';
+      return;
+    }
+
     // 2. Fetch the first page (Archon-gated + audited server-side).
-    wirePager();
+    mountPager();
     await fetchPage();
   }
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.505",
+  "version": "1.19.506",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.505",
+      "version": "1.19.506",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.505",
+  "version": "1.19.506",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.505'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.506'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_audit.mjs

@@ -198,6 +198,44 @@ test('the sidebar scrolls its nav list, not the whole column', () => {
 
 // ---- 6. every hall list is paged through the kit (task 1002446) -----------
 
+test('the kit is the ONLY thing in the hall that emits pager markup', () => {
+  // hall-ui/CLAUDE.md's "no bespoke pager" rule had one sanctioned exception for two
+  // releases — sessions.js, which paged server-side by offset, a thing the kit could
+  // not express (audited task 2179). Task 1003281 added `makeLedger({ serverPager })`
+  // and left the migration as its own task; it has now landed, so the hall is back to
+  // ONE pager contract with no footnote.
+  //
+  // A rule that only lives in prose is a rule that comes back as an eleventh pager.
+  // This is the machine-checkable half: the kit STAMPS every bar at runtime, so any
+  // .pager markup written by hand — in a page's HTML or in another script's template —
+  // is by construction a second implementation. Adding an exception here is where the
+  // conversation happens, exactly like the budgets above.
+  const OWNER = 'hall-kit.js';
+  const offenders = [];
+  for (const f of fs.readdirSync(HALL)) {
+    if (!/\.(html|js)$/.test(f) || f === OWNER) continue;
+    const src = read(f);
+    // `class="pager…"` in a template string or in static markup. The kit's own callers
+    // pass a PREFIX and get the markup back; they never write the class themselves.
+    if (/class="pager[\s"_-]/.test(src)) offenders.push(f);
+  }
+  assert.deepEqual(offenders, [],
+    `${offenders.join(', ')} writes pager markup by hand — call OTBKit.pagerBarHtml(prefix) `
+    + '(or makeLedger, which stamps it for you) instead of a second copy.');
+});
+
+test('the session log pages on the kit — the last hand-roll is gone', () => {
+  // The specific exception this rule carried, pinned by name so its removal cannot be
+  // quietly undone. Behaviour is exercised for real in tests/sessions_kit_pager.mjs;
+  // this is the structural half.
+  const js = read('sessions.js');
+  for (const fn of ['makePager', 'pagerBarHtml', 'wirePager', 'pageOffset', 'renderServerPage']) {
+    assert.match(js, new RegExp(`kit\\.${fn}\\(`), `sessions.js must page through the kit's ${fn}`);
+  }
+  assert.doesNotMatch(js, /const PAGE_SIZE\b/, 'its fixed page size is gone — per-page is the kit\'s now');
+  assert.match(read('sessions.html'), /hall-kit\.js/, 'and the page has to load the kit');
+});
+
 test('the peer-recognition feed is paged through OTBKit, not by hand', () => {
   assert.match(read('hall-widgets.js'), /pagerBarHtml\('acclaim'/, 'the acclaim card stamps the kit pager bar');
   const js = read('builders.js');

package/tests/sessions_kit_pager.mjs

@@ -0,0 +1,312 @@
+// tests/sessions_kit_pager.mjs — the session log pages on the KIT's contract, not
+// its own (goal 1000072, the migration task 1003281 left behind).
+//
+// WHY THIS FILE EXISTS. `sessions.js` was the hall's one sanctioned hand-rolled
+// pager — audited as an exception at task 2179 because the kit could only slice an
+// array the browser already held, and the session corpus cannot be held. Task 1003281
+// added the server-offset mode to the kit and explicitly deferred the migration:
+// "sessions.js stays as it is; migrating it is its own task." This is that task, and
+// an exception removed without a test is an exception waiting to be re-added.
+//
+// It runs the REAL hall-kit.js and the REAL sessions.js in one vm against a stub DOM
+// and a fake API (the profile_activity.mjs idiom), so what is asserted is the request
+// the page actually issues and the bar a reader actually sees — not a stub of the kit
+// agreeing with a stub of the page.
+//
+// The five behaviours the migration had to keep or gain:
+//   1. it asks the SERVER for one page (the corpus is never pulled into the browser)
+//   2. a page click moves the offset by the reader's per-page, not a fixed 50
+//   3. per-page is a real control now, and it resets to page 1 and persists
+//   4. a failed fetch ROLLS BACK the pager — the bar may never claim a page whose
+//      rows never arrived (the one piece of the hand-roll worth keeping)
+//   5. nothing is pressable while a fetch is in flight
+//
+// Run:  node tests/sessions_kit_pager.mjs
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const KIT_JS = read('modules/hall-ui/public/hall-kit.js');
+const SESSIONS_JS = read('modules/hall-ui/public/sessions.js');
+const SESSIONS_HTML = read('modules/hall-ui/public/sessions.html');
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+// ---------------------------------------------------------------------------
+// the harness: a stub DOM just rich enough for the kit's ids + the page's cells
+// ---------------------------------------------------------------------------
+
+function makeEl(id) {
+  const listeners = new Map();
+  return {
+    id,
+    innerHTML: '', textContent: '', value: '',
+    hidden: false, disabled: false,
+    options: [], style: {}, dataset: {},
+    classList: { add() {}, remove() {}, toggle() {} },
+    addEventListener(ev, fn) {
+      if (!listeners.has(ev)) listeners.set(ev, []);
+      listeners.get(ev).push(fn);
+    },
+    fire(ev, arg) { for (const fn of listeners.get(ev) || []) fn(arg); },
+    listenerCount(ev) { return (listeners.get(ev) || []).length; },
+  };
+}
+
+// `rank: 'metic'` is the gate sessions.js applies before it fetches anything.
+function harness({ total = 320, failAfter = null, viewerRank = 'metic', perPagePref = null, dropKit = false } = {}) {
+  const els = new Map();
+  const getEl = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+  const documentObj = {
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    getElementById: getEl,
+    querySelector(sel) { return getEl(String(sel).replace(/^#/, '')); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+  };
+
+  const requests = [];
+  let calls = 0;
+  const rowsFor = (limit, offset) => Array.from(
+    { length: Math.max(0, Math.min(limit, total - offset)) },
+    (_, i) => ({ session_id: `sid-${offset + i}`, builder_id: 1, github_login: 'jaxri', rank: 'metic', task_ids: [], assistant_turns: 3, total_tokens: 100, tool_errors: 0, duration_seconds: 60, uploaded_at: '2026-08-01T00:00:00Z' })
+  );
+
+  const client = {
+    request: async (method, url) => {
+      requests.push(url);
+      if (url.endsWith('/me')) {
+        return { status: 200, ok: true, data: { builder: { id: 1, rank: viewerRank } } };
+      }
+      if (url.includes('/sessions/search')) {
+        calls += 1;
+        if (failAfter != null && calls > failAfter) return { status: 500, ok: false, data: null };
+        const q = new URLSearchParams(url.split('?')[1] || '');
+        const limit = Number(q.get('limit'));
+        const offset = Number(q.get('offset'));
+        return {
+          status: 200,
+          ok: true,
+          data: { sessions: rowsFor(limit, offset), totals: { total, builders: 3 } },
+        };
+      }
+      return { status: 404, ok: false, data: null };
+    },
+  };
+
+  const store = new Map();
+  // Seeded BEFORE the scripts run — makePager reads the preference at boot, so this is
+  // the only way to model a returning reader.
+  if (perPagePref != null) store.set('otb.sessions.perPage', String(perPagePref));
+  const windowObj = {
+    BongosClient: { createClient: () => client },
+    location: { assign() {} },
+    localStorage: {
+      getItem: (k) => (store.has(k) ? store.get(k) : null),
+      setItem: (k, v) => store.set(k, String(v)),
+    },
+    scrollTo() {},
+    addEventListener() {},
+    OTB: {
+      escapeHtml: (s) => String(s == null ? '' : s),
+      $: (sel) => documentObj.querySelector(sel),
+      num: (n) => Number(n) || 0,
+      fmtInt: (n) => String(Number(n) || 0),
+      fmtCompact: (n) => String(Number(n) || 0),
+      fmtDate: (iso) => String(iso ?? '').slice(0, 10),
+      rankLabel: (r) => String(r ?? ''),
+      toast() {},
+    },
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console: { error() {}, warn() {}, log() {} },
+    setTimeout, clearTimeout, URLSearchParams,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  // The real kit first — that is the point: the page is held to the shipped contract.
+  vm.runInContext(KIT_JS, sandbox, { filename: 'hall-kit.js' });
+  if (dropKit) delete sandbox.window.OTBKit;
+  vm.runInContext(SESSIONS_JS, sandbox, { filename: 'sessions.js' });
+
+  const searches = () => requests.filter((u) => u.includes('/sessions/search'));
+  const q = (n) => {
+    const list = searches();
+    const url = list[n < 0 ? list.length + n : n];
+    return Object.fromEntries(new URLSearchParams(url.split('?')[1]));
+  };
+  return { els, getEl, searches, q, store, kit: sandbox.window.OTBKit };
+}
+
+// ---------------------------------------------------------------------------
+// 1. the page markup no longer carries a pager of its own
+// ---------------------------------------------------------------------------
+
+await test('sessions.html carries a mount, not a hand-rolled pager', () => {
+  assert.ok(!/id="ledger-pager"/.test(SESSIONS_HTML), 'the bespoke <nav class="pager"> is gone');
+  assert.ok(!/id="pager-(prev|next|pos)"/.test(SESSIONS_HTML), 'its bespoke button ids are gone');
+  assert.match(SESSIONS_HTML, /id="sessions-pager-mount"/);
+  assert.match(SESSIONS_HTML, /hall-kit\.js/, 'the kit must load on this page now');
+  // The kit must be loaded BEFORE the page script that reads window.OTBKit at boot.
+  assert.ok(SESSIONS_HTML.indexOf('hall-kit.js') < SESSIONS_HTML.indexOf('sessions.js?'),
+    'hall-kit.js must come before sessions.js');
+  // The pager mount stays OUTSIDE the horizontal scrollport, or it slides away with
+  // the columns on a narrow screen.
+  const wrapEnd = SESSIONS_HTML.indexOf('</div>', SESSIONS_HTML.indexOf('ledger-table-wrap'));
+  assert.ok(SESSIONS_HTML.indexOf('sessions-pager-mount') > wrapEnd,
+    'the pager mount must not be inside .ledger-table-wrap');
+});
+
+await test('sessions.js hand-rolls no pager state any more', () => {
+  assert.ok(!/const PAGE_SIZE\b/.test(SESSIONS_JS), 'the fixed page size is gone');
+  assert.ok(!/state\.offset/.test(SESSIONS_JS.replace(/^\s*\/\/.*$/gm, '')),
+    'the hand-rolled offset cursor is gone (comments may still explain it)');
+  for (const fn of ['makePager', 'pagerBarHtml', 'wirePager', 'pageOffset', 'renderServerPage']) {
+    assert.ok(SESSIONS_JS.includes(`kit.${fn}`), `sessions.js must use the kit's ${fn}`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// 2. what the page actually does, executed
+// ---------------------------------------------------------------------------
+
+await test('the first load asks the SERVER for one page — the corpus is never held', async () => {
+  const h = harness({ total: 320 });
+  await tick(); await tick();
+  assert.equal(h.searches().length, 1);
+  const p = h.q(0);
+  assert.equal(p.offset, '0');
+  assert.equal(p.limit, '50', 'the page keeps its historical 50 as the default per-page');
+  assert.equal(p.order, 'recent');
+});
+
+await test('Next moves the offset by the reader\'s per-page, and the bar says where they are', async () => {
+  const h = harness({ total: 320 });
+  await tick(); await tick();
+  h.getEl('sessions-next').fire('click');
+  await tick(); await tick();
+  assert.equal(h.searches().length, 2);
+  assert.equal(h.q(-1).offset, '50');
+  assert.equal(h.getEl('sessions-page').textContent, 'Page 2 of 7');
+  assert.equal(h.getEl('sessions-range').textContent, 'Showing 51–100 of 320');
+  assert.equal(h.getEl('sessions-pager').hidden, false);
+});
+
+await test('per-page is a real control now: it re-asks, resets to page 1, and persists', async () => {
+  const h = harness({ total: 320 });
+  await tick(); await tick();
+  h.getEl('sessions-next').fire('click');
+  await tick(); await tick();
+  assert.equal(h.q(-1).offset, '50', 'sanity: on page 2');
+
+  const sel = h.getEl('sessions-per-page');
+  sel.fire('change', { target: { value: '100' } });
+  await tick(); await tick();
+  const p = h.q(-1);
+  assert.equal(p.limit, '100', 'the new page size reaches the server');
+  assert.equal(p.offset, '0', 'a per-page change returns to page 1');
+  assert.equal(h.store.get('otb.sessions.perPage'), '100', 'the choice is remembered');
+  assert.equal(h.getEl('sessions-page').textContent, 'Page 1 of 4');
+});
+
+await test('a remembered per-page is used on the very first request of the next visit', async () => {
+  // The point of persisting it: a returning reader does not have to set it again, and
+  // does not first get a page at the default size and then a second one at theirs.
+  const h = harness({ total: 320, perPagePref: 25 });
+  await tick(); await tick();
+  assert.equal(h.searches().length, 1, 'one request, not a default page then a corrected one');
+  assert.equal(h.q(0).limit, '25');
+  assert.equal(h.getEl('sessions-page').textContent, 'Page 1 of 13');
+});
+
+await test('a junk stored preference falls back to the default rather than to nothing', async () => {
+  // localStorage is reader-writable and survives across releases; a value the option
+  // list no longer offers must not become the page size.
+  const h = harness({ total: 320, perPagePref: 'lots' });
+  await tick(); await tick();
+  assert.equal(h.q(0).limit, '50');
+});
+
+await test('a failed page ROLLS BACK — the bar never claims a page whose rows never came', async () => {
+  // failAfter: 1 → the first load succeeds, every page click after it 500s.
+  const h = harness({ total: 320, failAfter: 1 });
+  await tick(); await tick();
+  assert.equal(h.getEl('sessions-page').textContent, 'Page 1 of 7');
+
+  h.getEl('sessions-next').fire('click');
+  await tick(); await tick();
+  assert.equal(h.searches().length, 2, 'it did try');
+  assert.equal(h.getEl('sessions-page').textContent, 'Page 1 of 7',
+    'the failed page 2 must not be left showing in the bar');
+  assert.equal(h.getEl('sessions-range').textContent, 'Showing 1–50 of 320',
+    'and the range must still describe the rows that are actually in the table');
+});
+
+await test('a failed per-page change rolls the SIZE back too', async () => {
+  const h = harness({ total: 320, failAfter: 1 });
+  await tick(); await tick();
+  h.getEl('sessions-per-page').fire('change', { target: { value: '10' } });
+  await tick(); await tick();
+  h.getEl('sessions-next').fire('click');
+  await tick(); await tick();
+  // Back on the 50-row page 1, the only page whose rows ever arrived, so Next asks
+  // for offset 50 and not offset 10.
+  assert.equal(h.q(-1).limit, '50', 'the rolled-back size is what the next request uses');
+});
+
+await test('nothing is pressable while a fetch is in flight', async () => {
+  const h = harness({ total: 320 });
+  await tick(); await tick();
+  assert.equal(h.getEl('sessions-per-page').disabled, false, 'idle: the control is live');
+  assert.equal(h.getEl('sessions-next').disabled, false);
+  h.getEl('sessions-next').fire('click');
+  // deliberately not awaited — this is mid-flight
+  assert.equal(h.getEl('sessions-next').disabled, true, 'in flight: Next is dead');
+  assert.equal(h.getEl('sessions-prev').disabled, true, 'in flight: Prev is dead');
+  assert.equal(h.getEl('sessions-per-page').disabled, true, 'in flight: per-page is dead');
+  await tick(); await tick();
+  assert.equal(h.getEl('sessions-per-page').disabled, false, 'landed: live again');
+});
+
+await test('Prev stays dead on page 1 — the kit decides that, not the page', async () => {
+  const h = harness({ total: 320 });
+  await tick(); await tick();
+  assert.equal(h.getEl('sessions-prev').disabled, true, 'page 1 has nothing before it');
+  assert.equal(h.getEl('sessions-next').disabled, false);
+});
+
+await test('a corpus that fits one page shows no bar at all', async () => {
+  const h = harness({ total: 8 });
+  await tick(); await tick();
+  assert.equal(h.getEl('sessions-pager').hidden, true);
+});
+
+await test('a missing kit degrades to a named failure, not a blank page', async () => {
+  // The kit is a separate <script>; a cache miss must not throw at parse time and take
+  // the whole page — including the rank gate — down with it.
+  const h = harness({ total: 320, dropKit: true });
+  await tick(); await tick();
+  assert.equal(h.searches().length, 0, 'no corpus request without a pager to place it');
+  assert.match(h.getEl('ledger-sub').textContent, /could not be loaded/);
+});
+
+await test('the rank gate still runs before any corpus request', async () => {
+  const h = harness({ total: 320, viewerRank: 'xenos' });
+  await tick(); await tick();
+  assert.equal(h.searches().length, 0, 'a xenos must not even ask');
+  assert.equal(h.getEl('gate-scroll').hidden, false, 'they get the sealed notice');
+});
+
+summary();