@bongos/core 1.19.505 → 1.19.507

package/modules/hall-ui/public/sessions.js

@@ -121,91 +121,146 @@
     $('#sessions-scroll').hidden = true;
   }
 
-  // ---- paging state --------------------------------------------------------
+  // ---- paging --------------------------------------------------------------
+  //
+  // This page used to hand-roll its own server-offset pager, and hall-ui/CLAUDE.md
+  // carried it as the ONE sanctioned exception to "no bespoke pager" (audited task
+  // 2179) — because the kit could only slice an array the browser already held, and
+  // this corpus cannot be held. Task 1003281 added the server-offset mode to the kit
+  // and left the migration as its own task; this is it. The exception is gone, so
+  // there is one pager contract in the hall again rather than one-plus-a-footnote.
+  //
+  // What the reader gains: a per-page control that remembers their choice, and a
+  // clamp — if the corpus shrinks under an open page, renderServerPage() says so and
+  // we re-ask, instead of showing an empty page under a range that claims rows.
+  //
+  // The one thing NOT taken from the kit is makeLedger: it stamps table+pager into a
+  // single mount, and the CARD is this page's scroll container (hall-ui/CLAUDE.md, the
+  // sideways-scroll rule), so a pager stamped into the table's mount would slide with
+  // the columns. Keeping it a separate sibling below the ledger is what holds it still.
+  // (This page used to carry a .ledger-table-wrap scrollport; task 1003470 removed it
+  // because the wrapper broke the shell's sticky th. The separate mount outlived it.)
+  // Table markup stays in sessions.html; the PAGER is the kit's.
 
-  const PAGE_SIZE = 50;
-  const state = { offset: 0, total: 0 };
+  // Guarded the way every other kit consumer guards it (profile.js): the kit is a
+  // separate <script>, so a cache miss or a load-order slip must degrade to a named
+  // failure rather than an uncaught throw at parse time that also kills load().
+  const kit = window.OTBKit;
+  const PAGER_PREFIX = 'sessions';
+  // 50 was this page's fixed page size before the per-page control existed; keeping it
+  // as the default means a returning reader's first page looks exactly as it did.
+  const pager = kit ? kit.makePager(PAGER_PREFIX, 'otb.sessions.perPage', { defaultPerPage: 50 }) : null;
+  // `page`/`perPage` here are the last values that actually PAINTED. The kit moves the
+  // pager first and calls back second, so a failed fetch has to put it back to these —
+  // otherwise the bar goes on claiming a page whose rows never arrived. Keeping both
+  // (not just the page) means a failed per-page change rolls back cleanly too.
+  const state = { total: 0, shown: 0, page: 1, perPage: pager?.perPage ?? 0 };
   let loading = false;
+  // Two clicks can be in flight at once; only the newest may paint (the profile
+  // activity-log idiom, task 1003281).
+  let inFlight = 0;
 
+  // Paint the kit's bar, then apply the one thing the kit deliberately does not model:
+  // a fetch is in flight, so nothing may be pressed again until it lands. Only the
+  // DISABLING is ours — re-enabling the arrows is left to the kit, which knows whether
+  // there is a page on either side; re-enabling them here would light up "Prev" on
+  // page 1. Returns the kit's clamped flag: true = the page outran a shrunken corpus.
   function renderPager() {
-    const pager = $('#ledger-pager');
-    const total = state.total;
-    if (total <= PAGE_SIZE) {
-      // Everything fits on one page — no pager needed.
-      pager.hidden = true;
-      return;
+    const clamped = kit.renderServerPage(pager, state.total, state.shown);
+    const perPage = $(`#${PAGER_PREFIX}-per-page`);
+    if (perPage) perPage.disabled = loading;
+    if (loading) {
+      for (const id of ['prev', 'next']) {
+        const el = $(`#${PAGER_PREFIX}-${id}`);
+        if (el) el.disabled = true;
+      }
     }
-    pager.hidden = false;
-    const page = Math.floor(state.offset / PAGE_SIZE) + 1;
-    const pages = Math.max(1, Math.ceil(total / PAGE_SIZE));
-    const from = state.offset + 1;
-    const to = Math.min(state.offset + PAGE_SIZE, total);
-    $('#pager-pos').textContent = `Page ${fmtInt(page)} of ${fmtInt(pages)} · ${fmtInt(from)}–${fmtInt(to)} of ${fmtInt(total)}`;
-    $('#pager-prev').disabled = loading || state.offset <= 0;
-    $('#pager-next').disabled = loading || state.offset + PAGE_SIZE >= total;
+    return clamped;
   }
 
+  // Paint one page. Returns true when the pager clamped — the corpus shrank under an
+  // open page, so the caller must re-ask rather than leave a range that lies.
   function showData(data) {
     const sessions = Array.isArray(data.sessions) ? data.sessions : [];
     const totals = data.totals || { total: data.total || sessions.length };
     state.total = num(totals.total);
+    state.shown = sessions.length;
     $('#gate-scroll').hidden = true;
     $('#stats-scroll').hidden = false;
     $('#sessions-scroll').hidden = false;
     renderStats(totals);
     renderTable(sessions);
-    renderPager();
+    const clamped = renderPager();
     $('#ledger-sub').textContent =
       `${fmtInt(totals.total)} session${num(totals.total) === 1 ? '' : 's'} across ${fmtInt(totals.builders)} builder${num(totals.builders) === 1 ? '' : 's'}.`;
     $('#ledger-foot').textContent =
       'Most recent first. Each load of this page is itself recorded in the audit log.';
+    return clamped;
   }
 
   // ---- load ----------------------------------------------------------------
 
-  // Fetch one page at the current offset. Returns true on success.
-  async function fetchPage() {
+  // Fetch the page the pager currently points at. Returns true on success.
+  //
+  // `pager.page` has ALREADY moved by the time this runs — wirePager advances it and
+  // then calls back — so a failure restores `state.page`/`state.perPage`, the last
+  // values that painted. That roll-back is what the old hand-roll did with
+  // `state.offset`, and it is the one piece of it worth carrying over.
+  async function fetchPage({ reclamps = 0 } = {}) {
+    const seq = ++inFlight;
     loading = true;
     renderPager();
     try {
       const res = await api.request(
         'GET',
-        `${API}/sessions/search?order=recent&limit=${PAGE_SIZE}&offset=${state.offset}`
+        `${API}/sessions/search?order=recent&limit=${pager.perPage}&offset=${kit.pageOffset(pager)}`
       );
+      // A newer click already went out; painting this answer would show a page nobody
+      // is on any more.
+      if (seq !== inFlight) return true;
       if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return false; }
       if (res.status === 403) {
         showSealed('You do not have access to the session log.');
         return false;
       }
       if (!res.ok) throw new Error(`search → ${res.status}`);
-      const data = res.data;
-      showData(data);
+      const clamped = showData(res.data);
+      // The corpus shrank under this page (sessions pruned between loads):
+      // renderServerPage pulled the page back into range, so go get the rows that page
+      // actually holds rather than leaving a range that disagrees with the table.
+      // One re-ask, never a loop: a corpus shrinking on every round-trip would
+      // otherwise spin here, and a stale range for one paint is the smaller harm.
+      if (clamped && reclamps < 1) { loading = false; return fetchPage({ reclamps: reclamps + 1 }); }
+      state.page = pager.page;
+      state.perPage = pager.perPage;
       return true;
     } catch (err) {
+      if (seq !== inFlight) return true;
       console.error('[sessions] failed to load corpus', err);
+      pager.page = state.page;
+      pager.perPage = state.perPage;
       $('#ledger-sub').textContent = 'The session log could not be loaded. Try again.';
       toast('Could not load sessions.');
       return false;
     } finally {
-      loading = false;
-      renderPager();
+      if (seq === inFlight) {
+        loading = false;
+        renderPager();
+      }
     }
   }
 
-  async function goTo(offset) {
-    if (loading) return;
-    const next = Math.max(0, offset);
-    if (next === state.offset) return;
-    const prev = state.offset;
-    state.offset = next;
-    const ok = await fetchPage();
-    if (!ok) state.offset = prev; // roll back on failure so the pager stays honest
-    else window.scrollTo({ top: 0, behavior: 'smooth' });
-  }
-
-  function wirePager() {
-    $('#pager-prev').addEventListener('click', () => goTo(state.offset - PAGE_SIZE));
-    $('#pager-next').addEventListener('click', () => goTo(state.offset + PAGE_SIZE));
+  function mountPager() {
+    const mount = $('#sessions-pager-mount');
+    if (!mount) return;
+    mount.innerHTML = kit.pagerBarHtml(PAGER_PREFIX, { label: 'sessions' });
+    // The kit has already updated `pager` by the time this fires; go get the rows that
+    // match it. Scrolling up only on success keeps a failed page from yanking the
+    // reader away from the table they were still looking at.
+    kit.wirePager(pager, async () => {
+      const ok = await fetchPage();
+      if (ok) window.scrollTo({ top: 0, behavior: 'smooth' });
+    });
   }
 
   async function load() {
@@ -234,8 +289,14 @@
       return;
     }
 
+    if (!kit) {
+      console.error('[sessions] OTBKit did not load — the pager cannot be built');
+      $('#ledger-sub').textContent = 'The session log could not be loaded. Try again.';
+      return;
+    }
+
     // 2. Fetch the first page (Archon-gated + audited server-side).
-    wirePager();
+    mountPager();
     await fetchPage();
   }
 

package/modules/lifecycle/routes/tasks.js

@@ -161,7 +161,12 @@ module.exports = function buildTasksRouter() {
     if (claimCreatedBy && claimCreatedBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
     const claimStaleDays = posInt(req.query.stale_days, 'bad_stale_days', 3650);
     if (claimStaleDays && claimStaleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
-    const [claimable, active] = await Promise.all([
+    // ?limit=N — opt-in, for a caller that renders N rows (goal 1000072; the hall's
+    // two-line Home card was pulling this whole feed, descriptions and all). It slices
+    // the RETURNED feed, never the query — lifecycle/CLAUDE.md has the why.
+    const claimLimit = posInt(req.query.limit, 'bad_limit', 1000);
+    if (claimLimit && claimLimit.bad) return res.fail('bad_limit', { status: 400, message: 'limit must be a positive integer (max 1000).' });
+    const [feed, active] = await Promise.all([
       db.listClaimableTasks({
         versionId: version || null,
         builderId: req.builder.id,
@@ -172,13 +177,17 @@ module.exports = function buildTasksRouter() {
       }),
       db.listActiveClaims(),
     ]);
+    const claimable = claimLimit ? feed.slice(0, claimLimit) : feed;
     // V3.R75 (#294): tick the onboarding state machine for first_start. Fire
     // and forget — the response should never wait on or fail because of the
     // onboarding write. safeMarkStage swallows errors and handles the
     // graduation broadcast. Through the `onboarding` kernel port (BV1.R81 / ADR
     // 0093 §1); ?. degrades to a no-op when the module is off.
     seams.resolveOptional('onboarding')?.safeMarkStage(pool, req.builder.id, 'first_start', req.builder);
-    res.json({ claimable, active_claims: active });
+    // `claimable_total` is what makes the limit honest — two rows with no count reads
+    // as "there are only two". It is the length of the array the slice came from, never
+    // a second count query (that is how a total and its own list drift apart, ADR 0197).
+    res.json({ claimable, claimable_total: feed.length, active_claims: active });
   });
 
   // GET /tasks/newcomer-floor — supply gauge for the newcomer queue (task 614).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.505",
+  "version": "1.19.507",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.505",
+      "version": "1.19.507",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.505",
+  "version": "1.19.507",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.505'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.507'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_audit.mjs

@@ -198,6 +198,44 @@ test('the sidebar scrolls its nav list, not the whole column', () => {
 
 // ---- 6. every hall list is paged through the kit (task 1002446) -----------
 
+test('the kit is the ONLY thing in the hall that emits pager markup', () => {
+  // hall-ui/CLAUDE.md's "no bespoke pager" rule had one sanctioned exception for two
+  // releases — sessions.js, which paged server-side by offset, a thing the kit could
+  // not express (audited task 2179). Task 1003281 added `makeLedger({ serverPager })`
+  // and left the migration as its own task; it has now landed, so the hall is back to
+  // ONE pager contract with no footnote.
+  //
+  // A rule that only lives in prose is a rule that comes back as an eleventh pager.
+  // This is the machine-checkable half: the kit STAMPS every bar at runtime, so any
+  // .pager markup written by hand — in a page's HTML or in another script's template —
+  // is by construction a second implementation. Adding an exception here is where the
+  // conversation happens, exactly like the budgets above.
+  const OWNER = 'hall-kit.js';
+  const offenders = [];
+  for (const f of fs.readdirSync(HALL)) {
+    if (!/\.(html|js)$/.test(f) || f === OWNER) continue;
+    const src = read(f);
+    // `class="pager…"` in a template string or in static markup. The kit's own callers
+    // pass a PREFIX and get the markup back; they never write the class themselves.
+    if (/class="pager[\s"_-]/.test(src)) offenders.push(f);
+  }
+  assert.deepEqual(offenders, [],
+    `${offenders.join(', ')} writes pager markup by hand — call OTBKit.pagerBarHtml(prefix) `
+    + '(or makeLedger, which stamps it for you) instead of a second copy.');
+});
+
+test('the session log pages on the kit — the last hand-roll is gone', () => {
+  // The specific exception this rule carried, pinned by name so its removal cannot be
+  // quietly undone. Behaviour is exercised for real in tests/sessions_kit_pager.mjs;
+  // this is the structural half.
+  const js = read('sessions.js');
+  for (const fn of ['makePager', 'pagerBarHtml', 'wirePager', 'pageOffset', 'renderServerPage']) {
+    assert.match(js, new RegExp(`kit\\.${fn}\\(`), `sessions.js must page through the kit's ${fn}`);
+  }
+  assert.doesNotMatch(js, /const PAGE_SIZE\b/, 'its fixed page size is gone — per-page is the kit\'s now');
+  assert.match(read('sessions.html'), /hall-kit\.js/, 'and the page has to load the kit');
+});
+
 test('the peer-recognition feed is paged through OTBKit, not by hand', () => {
   assert.match(read('hall-widgets.js'), /pagerBarHtml\('acclaim'/, 'the acclaim card stamps the kit pager bar');
   const js = read('builders.js');

package/tests/hall_board_world.mjs

@@ -294,8 +294,18 @@ test('the system notices are inbox LINES, first in the card, and counted by its
 
 test('the greeting reads /me, the public progress and the claimable feed, and builders.js feeds all three', () => {
   assert.match(buildersJs, /getJSON\(`\$\{API\}\/public\/progress`\)/, 'Home fetches the public progress once');
-  assert.match(buildersJs, /lastClaimableCount = resp && Array\.isArray\(resp\.claimable\) \? resp\.claimable\.length : null;/,
+  // The count comes off the SAME Next-up response — one request, not a second
+  // fetch. It reads `claimable_total` rather than the length of the returned array,
+  // because that request is now bounded (?limit=2, task 1003545): the array holds two
+  // rows and the total holds the whole rank-scoped queue. Asserting the derivation
+  // rather than one literal expression is deliberate — the previous version pinned
+  // `resp.claimable.length`, which read as a requirement to download the feed.
+  assert.match(buildersJs, /lastClaimableCount = Number\.isFinite\(claimableTotal\)/,
     'the claimable feed Home already fetches for Next-up answers the count');
+  assert.match(buildersJs, /const claimableTotal = Number\(resp && resp\.claimable_total\);/,
+    'and it takes the count from the response total, so a bounded read still knows it');
+  assert.doesNotMatch(buildersJs, /getJSON\(`\$\{API\}\/tasks\/claimable`/,
+    'no unbounded claimable fetch on Home — the count must never cost the whole queue');
   assert.match(buildersJs, /get lastProgressState\(\)/, 'the renderer reads progress through a getter, so it cannot freeze at boot');
   assert.match(buildersJs, /get lastClaimableCount\(\)/, 'and the count the same way');
   assert.equal((buildersJs.match(/renderGreeting\(\)/g) || []).length, 3, 'rendered after /me, after progress and after the claimable feed — each half as it lands');

package/tests/home_bounded_reads.mjs

@@ -0,0 +1,159 @@
+// tests/home_bounded_reads.mjs — the Home card asks for what it renders
+// (goal 1000072, "Human legibility").
+//
+// THE PATTERN THIS CLOSES. This goal's criterion `legibility-sort-and-staleness` set
+// the rule in its own words — "~1,357 tasks on BONGOS-V1 alone. A view that does not
+// survive that number is not a solution" — and `modules/lifecycle/goal-rollup.js`
+// exists because the Goals page broke it: **5,229,455 bytes for ~1,400 tasks, measured
+// 2026-08-25, to produce roughly forty small counter objects.**
+//
+// The same shape was still live on the page every builder lands on first. Home's
+// "Next up" card called `GET /tasks/claimable` — no limit, `SELECT v.*`, every
+// description on every claimable row — and then `.slice(0, 2)` to fill TWO lines. Its
+// triage card pulled the route's default fifty ideas to render five.
+//
+// So this pins the rule rather than the two instances: a Home card may not download a
+// feed and throw most of it away, and the limit it asks for must come back with a
+// total, or two rows are indistinguishable from "there are only two".
+//
+// Run:  node tests/home_bounded_reads.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const BUILDERS_JS = read('modules/hall-ui/public/builders.js');
+const WIDGETS_JS = read('modules/hall-ui/public/hall-widgets.js');
+const ROUTE = read('modules/lifecycle/routes/tasks.js');
+const DB_TASKS = read('modules/lifecycle/db-tasks.js');
+
+// Comments stripped before any "is the bad pattern gone" assertion — the same rule
+// scripts/gds/category-advisory-guard.js applies. A comment EXPLAINING the pattern that
+// was removed is documentation; matching it would make the fix un-documentable.
+const noComments = (src) => src.replace(/^\s*\/\/.*$/gm, '');
+
+const { test, summary } = makeRunner();
+
+// ---------------------------------------------------------------------------
+// 1. the rule, over Home's own boot reads
+// ---------------------------------------------------------------------------
+
+await test('no Home read downloads a feed and slices it in the browser', () => {
+  // The tell is a `.slice(0, N)` applied to a response body. Narrowing what is
+  // DISPLAYED is fine; narrowing what was FETCHED is the bug, and the two look
+  // identical at the call site — which is why this is a test and not a code review.
+  const src = noComments(BUILDERS_JS);
+  for (const fn of ['loadNextUp', 'loadTriageInbox']) {
+    const from = src.indexOf(`function ${fn}(`);
+    assert.ok(from > 0, `${fn} must exist`);
+    const body = src.slice(from, src.indexOf('\n  }\n', from));
+    const name = fn;
+    const url = body.match(/\$\{API\}\/[^`'"]+/);
+    assert.ok(url, `${name} must issue a request`);
+    assert.match(url[0], /[?&]limit=\d+/, `${name} must ask the server for its page size`);
+  }
+});
+
+await test('the two cards ask for exactly the rows they draw', () => {
+  assert.match(BUILDERS_JS, /\$\{API\}\/tasks\/claimable\?limit=2/, 'Next up draws two rows');
+  assert.match(BUILDERS_JS, /\$\{API\}\/inbox\?limit=5/, 'the triage card draws five');
+  // …and no longer re-slices what came back.
+  const src = noComments(BUILDERS_JS);
+  const from = src.indexOf('function loadNextUp(');
+  const body = src.slice(from, src.indexOf('\n  }\n', from));
+  assert.ok(body.length > 0, 'loadNextUp body found');
+  assert.doesNotMatch(body, /\.slice\(0,\s*2\)/, 'the client-side slice is gone');
+});
+
+// ---------------------------------------------------------------------------
+// 2. the limit is honest — it comes back with a total
+// ---------------------------------------------------------------------------
+
+await test('GET /tasks/claimable validates ?limit and answers with a total', () => {
+  assert.match(ROUTE, /posInt\(req\.query\.limit, 'bad_limit', 1000\)/, 'same validator as GET /tasks');
+  assert.match(ROUTE, /res\.fail\('bad_limit'/);
+  assert.match(ROUTE, /claimable_total: feed\.length/);
+  // The total must be the length of the very array the rows were sliced from. A
+  // companion count query would be a second copy of a filter chain that runs half in
+  // SQL and half in JS — the ADR 0197 failure, one release later.
+  assert.doesNotMatch(ROUTE, /countClaimableTasks/,
+    'no second count query: the sliced array reports its own length');
+  assert.match(ROUTE, /const claimable = claimLimit \? feed\.slice\(0, claimLimit\) : feed;/);
+});
+
+await test('the limit is OPT-IN — the Work Board and /builder-start are untouched', () => {
+  // Their whole job is the full feed. A default limit would silently truncate the board
+  // and the CLI's claim menu, which is a worse bug than the one being fixed. `posInt`
+  // returns undefined for an absent param, so `claimLimit ? … : feed` hands back
+  // everything exactly as before.
+  assert.match(ROUTE, /claimLimit \? feed\.slice/);
+  assert.doesNotMatch(DB_TASKS, /listClaimableTasks\([^)]*limit/,
+    'the db helper gained no limit — nothing below the route changed');
+});
+
+await test('every db.* the claimable handler calls actually exists', () => {
+  // The bug this catches, caught the hard way: an earlier cut pushed the limit into the
+  // db layer, was reverted, and left the route calling `db.listClaimableTasksPaged` — a
+  // function that no longer existed. Every assertion in this file is source text, and
+  // source text cannot see a missing symbol; a neighbouring suite found it instead.
+  const from = ROUTE.indexOf("router.get('/tasks/claimable'");
+  const body = ROUTE.slice(from, ROUTE.indexOf('res.json({ claimable', from));
+  const called = [...new Set([...body.matchAll(/\bdb\.([A-Za-z0-9_]+)\s*\(/g)].map((m) => m[1]))];
+  assert.ok(called.length > 0, 'the handler calls the db layer');
+  const dbExports = read('modules/lifecycle/db.js');
+  const block = dbExports.slice(dbExports.lastIndexOf('module.exports'));
+  for (const fn of called) {
+    assert.ok(new RegExp(`\\b${fn}\\b`).test(block), `db.js must export ${fn} — the route calls it`);
+  }
+});
+
+await test('the db layer is untouched: no new export, no second feed function', () => {
+  // The first cut pushed the limit into db-tasks.js and exported a paged twin. It
+  // bought nothing — a SQL LIMIT is unsafe here either way, so the query does the same
+  // work — and it widened the hand-mirrored export lists in db.js/db-tasks.js until
+  // they shared a 30-line run and tripped the duplication ratchet. The wire is the
+  // thing being saved, and the route is where the wire is.
+  assert.doesNotMatch(DB_TASKS, /listClaimableTasksPaged/);
+  assert.doesNotMatch(read('modules/lifecycle/db.js'), /listClaimableTasksPaged/);
+});
+
+// ---------------------------------------------------------------------------
+// 3. the trap a SQL LIMIT would have walked into
+// ---------------------------------------------------------------------------
+
+await test('the limit is applied AFTER the JS post-filters, not as a SQL LIMIT', () => {
+  // listClaimableTasks filters twice in JS after the query returns: the autonomous
+  // runner's protected-path + membership drops, and capNewcomerTasks' display cap.
+  // `LIMIT 2` in SQL can hand back two rows that both get dropped, leaving an empty
+  // feed with claimable work sitting right behind it. Slicing the RETURNED feed is
+  // what makes the limit safe, and it is why the query is unchanged.
+  const fn = DB_TASKS.slice(
+    DB_TASKS.indexOf('async function listClaimableTasks('),
+    DB_TASKS.indexOf('function taskTouchesProtectedPath(')
+  );
+  assert.ok(fn.length > 0, 'found listClaimableTasks');
+  assert.doesNotMatch(fn, /LIMIT \$/, 'no SQL LIMIT in the claimable query');
+  assert.match(fn, /return capNewcomerTasks\(rows\);/, 'the JS post-filters still have the last word');
+  const routeFrom = ROUTE.indexOf("router.get('/tasks/claimable'");
+  const routeBody = ROUTE.slice(routeFrom, ROUTE.indexOf('res.json({ claimable', routeFrom));
+  assert.match(routeBody, /feed\.slice\(0, claimLimit\)/, 'the slice happens on the finished feed');
+});
+
+// ---------------------------------------------------------------------------
+// 4. what the reader sees
+// ---------------------------------------------------------------------------
+
+await test('the foot names the queue the two rows came off', () => {
+  assert.match(WIDGETS_JS, /id="home-next-foot"/, 'the link has an id to write into');
+  assert.match(BUILDERS_JS, /See all \$\{fmtNum\(total\)\} ready work/);
+  // Silent rather than wrong when the count is missing or not larger than what is
+  // shown: "See all 2" under two rows is noise, and a guessed number is worse.
+  assert.match(BUILDERS_JS, /Number\.isFinite\(total\) && total > rows\.length/);
+});
+
+summary();