@bongos/core 1.19.506 → 1.19.507

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.506",
-  "core_contract": "1.19.506",
-  "source_commit": "0c5102c78cf4acf0c5ab19a0f34ab43caa0a53d0",
+  "core_version": "1.19.507",
+  "core_contract": "1.19.507",
+  "source_commit": "f4008a4f0c0527a72d19cfc989889a3610a164d1",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T17:56:16.813Z",
+  "built_at": "2026-09-03T18:09:01.161Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 427,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1945,
+    "functional_verbatim": 1946,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2396,
-  "tree_sha256": "d0ec8df4b7c843085a5692c55b908977f2bbc25023e21dc62e246e62cfdfbd0d",
+  "file_count": 2397,
+  "tree_sha256": "cf9525f9de033ff0382bbc7986cc416062ed1a629caabc30849cc4efa1065398",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "036e1064bb9513d7acbf0dafd0850deac9f45a38f31c3cbb8c1d7493c9159b76"
+      "sha256": "afe60dae1ca8b55c5f9521b4f23eaad4eb194627a2ee105cae1513745ae71544"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1702,7 +1702,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "c02241e6fd8372fb80339eaa385f227b642754ff127dd529cfdc94ed87d077a4"
+      "sha256": "0b5eab5940ae6cf0e8691c6ec59757e8bbfb719a660ec3e8492d9870c95a8c62"
     },
     {
       "path": "docs/architecture.md",
@@ -1727,12 +1727,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "6f3476adddccabea94bb3bb8af804ec1e6dfc1710a9e3f76fb4ba062b44e3234"
+      "sha256": "b6b680304b158480b87c61679bafa3431d6e492aa9323933abf68621ce243365"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "d6f13f1ab6d579e195b3240511d68181aabd64591933f1911fc0009fbdf875d8"
+      "sha256": "ed8c0d7c6ab7edd3ae61cd97c530323ed915f32cfa14a4f4ed1bca4d52437a01"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2577,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "130aad5d413e749405b9f5104259cdfb9dfde539ae35326649c64e79c5ff6604"
+      "sha256": "ca0326ffd2f4996d2c4f42940ba5c2a2b40b18f9a676023918fd2cde9cd85634"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4487,7 +4487,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "1a8bf6e502311a22ac937ffbf05214d5a0286b4f94b5275e580b7fb68911e7f7"
+      "sha256": "18e113894ddb8d8e86faa01d20edde978f8710f8eb546e0baa8b7732d46cf00c"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -4707,7 +4707,7 @@
     {
       "path": "modules/hall-ui/public/hall-widgets.js",
       "mode": "0000644",
-      "sha256": "8aa90c0bb15a19f13295da6225d270bbbdaf4b5336240f03cbc05abe192e87c0"
+      "sha256": "6a3a19788c6e39497f32c130086c812fad15a5a7cf01d91b8a68f673b9ea6437"
     },
     {
       "path": "modules/hall-ui/public/harbor.css",
@@ -5512,7 +5512,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "0bbf26870c5959ef6101c535e9a3987d2177d2a8d1b6c91bded9c31350836165"
+      "sha256": "0ba020342e32eb552532a3a34a57b19aa4bbe87f0cb89ace0c45f4c301d7a015"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -7227,12 +7227,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7a6dd18246bdbc4fbf57c52d54246a17ce2f5fb144bb256a6a163804175a8be3"
+      "sha256": "e59012a1aaea2c2e25ac2a7f0c40f096bfe2cae832502cdabfe3519fdb37322d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "26b904a0eb436c1b3654cac79c075a39ccd61bd9db7d3eab8c96f43507fd2686"
+      "sha256": "aae944a6300fb887bd38a4692813e2f03965d7bb044c843fe7f23a26715233d8"
     },
     {
       "path": "public-docs/index.html",
@@ -8902,7 +8902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "818b1e08d902b65dedaf1d670b920a12f8eedbc3191051c4977675ec34a4e8d6"
+      "sha256": "c8e168b4ae8a7dc956802de03248b6509b871e98bf0315dbd94d8dc7cc16be50"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10287,7 +10287,7 @@
     {
       "path": "tests/hall_board_world.mjs",
       "mode": "0000644",
-      "sha256": "61c5fc8a46807653801315d14711b7f11f52ce80e27908fe59518e032582228f"
+      "sha256": "b0ef3e407d7bd9266231dc089f1288ee40efb113e40333f79d3de4436db6cc21"
     },
     {
       "path": "tests/hall_catalog_world.mjs",
@@ -10389,6 +10389,11 @@
       "mode": "0000644",
       "sha256": "e2d482ca08d151719f61b52bcbb8056d5c91c9447b5bba7c9f7682d9582e34b8"
     },
+    {
+      "path": "tests/home_bounded_reads.mjs",
+      "mode": "0000644",
+      "sha256": "186a8ebd04cd4dc8021b3a36699468e9c0bcf78ca61ce9f7be7c3e25c632fb3e"
+    },
     {
       "path": "tests/hook_core_resolve.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -123,7 +123,7 @@ export interface GetSessionsSearchResponse { sessions: unknown; count: unknown;
 export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_key_b64: unknown }
 export interface GetTaskRecommendationsForMeResponse { recommendations: unknown; count: unknown }
 export interface GetTaskRecommendationsMineResponse { recommendations: unknown; count: unknown }
-export interface GetTasksClaimableResponse { claimable: unknown; active_claims: unknown }
+export interface GetTasksClaimableResponse { claimable: unknown; claimable_total: unknown; active_claims: unknown }
 export interface GetTasksIdCriteriaResponse { criteria: unknown }
 export interface GetTasksIdDependenciesResponse { dependencies: unknown; dependents: unknown }
 export interface GetTasksIdRecommendationsResponse { recommendations: unknown; count: unknown }

package/docs/api/openapi.json

@@ -17273,10 +17273,12 @@
         "type": "object",
         "properties": {
           "claimable": {},
+          "claimable_total": {},
           "active_claims": {}
         },
         "required": [
           "claimable",
+          "claimable_total",
           "active_claims"
         ]
       },

package/docs/copy-inventory.md

@@ -131,7 +131,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `daf73127afff` | certain | A word on why | `modules/hall-ui/public/hall-render.js:278` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:46` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:61` |
-| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1123` |
+| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1150` |
 | `6ca31dd5eb91` | certain | Acknowledge the primer | `modules/hall-ui/public/primer.html:99` |
 | `4461b13f95c2` | certain | Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime. | `modules/hall-ui/public/settings.html:209` |
 | `524188fe0078` | certain | Active sessions | `modules/hall-ui/public/settings.html:162` |
@@ -864,7 +864,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `381f29be7497` | certain | The most recently shipped tasks. | `modules/hall-ui/public/work.html:108` |
 | `82479c539fca` | certain | The name shown beside your work — in the roster, the leaderboard, and the work feed. Your sign-in and the cred | `modules/hall-ui/public/settings.html:75` |
 | `b88dd8b96b72` | certain | The next person to notice this sentence reads your note instead of re-litigating it. | `modules/hall-ui/public/copy-desk.html:135` |
-| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1365` |
+| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1392` |
 | `6c3d88de42de` | certain | The primer | `modules/hall-ui/public/primer.html:41` |
 | `dea378cd4837` | certain | The primer did not load | `modules/hall-ui/public/primer.html:88` |
 | `3bc5ec5f35ec` | certain | The ranks, lowest to highest | `modules/hall-ui/public/ranks.html:46` |

package/docs/copy-registry.json

@@ -2056,7 +2056,7 @@
       "surface": "builders-hall",
       "text": "Achievements could not be loaded.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1123,
+      "line": 1150,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8653,7 +8653,7 @@
       "surface": "builders-hall",
       "text": "The page could not be loaded. Try again.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1365,
+      "line": 1392,
       "origin": "js-notice",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -1449,5 +1449,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.504 with no explicit bump. run 33785121177. (task 1002620)
   1.19.506 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.505 with no explicit bump. run 33787453336. (task 1002620)
+  1.19.507 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.506 with no explicit bump. run 33788726591. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/builders.js

@@ -866,7 +866,10 @@
   let canTriage = false;
   function loadTriageInbox() {
     if (!canTriage) return;
-    getJSON(`${API}/inbox`)
+    // ?limit=5 — the card renders five rows; the route's default is 50, and the
+    // open_count that drives the "N waiting" line is a separate count, so asking for
+    // what is rendered costs the reader nothing (goal 1000072).
+    getJSON(`${API}/inbox?limit=5`)
       .then((data) => renderTriageInbox(data))
       .catch(() => { /* nice-to-have; never break the hall */ });
   }
@@ -895,13 +898,28 @@
     const subhead = document.getElementById('home-recent-subh');
     if (!wrap || !list) return;
     try {
-      const resp = await getJSON(`${API}/tasks/claimable`, { softAuth: true });
-      // task 1003464: the same feed answers the greeting's "N tasks are
-      // claimable right now" — rank-scoped, so it is THIS builder's number.
-      lastClaimableCount = resp && Array.isArray(resp.claimable) ? resp.claimable.length : null;
+      // ?limit=2 — this card is TWO lines. It used to download the entire claimable
+      // feed, every row with its full description, and `.slice(0, 2)` it: the same
+      // shape goal 1000072's criterion names, and the one goal-rollup.js was carved to
+      // fix on the Goals page (5,229,455 bytes to produce forty counters). The server
+      // already orders by priority then calibrated estimate, so the first two rows ARE
+      // the top two. `claimable_total` comes back so the foot can say how many are
+      // waiting instead of leaving two rows to imply there are only two.
+      const resp = await getJSON(`${API}/tasks/claimable?limit=2`, { softAuth: true });
+      // task 1003464: the greeting's "N tasks are claimable right now" — rank-scoped,
+      // so it is THIS builder's number. It reads claimable_total rather than the length
+      // of a fully-downloaded feed: the same number, without the wire cost that this
+      // commit exists to remove. The .length fallback covers a server that predates
+      // the field (a deploy skew), so the greeting degrades to correct-but-costly
+      // rather than to blank.
+      const claimableTotal = Number(resp && resp.claimable_total);
+      lastClaimableCount = Number.isFinite(claimableTotal)
+        ? claimableTotal
+        : (resp && Array.isArray(resp.claimable) ? resp.claimable.length : null);
       renderGreeting();
-      const rows = (resp && Array.isArray(resp.claimable) ? resp.claimable : []).slice(0, 2);
+      const rows = resp && Array.isArray(resp.claimable) ? resp.claimable : [];
       if (!rows.length) { wrap.hidden = true; if (subhead) subhead.hidden = true; return; }
+      const total = Number(resp.claimable_total);
       const cur = (window.__BRANDING__ && window.__BRANDING__.currency && window.__BRANDING__.currency.label) || 'credits';
       list.innerHTML = rows.map((t) => {
         const credits = window.OTBBranding?.taskCreditValue?.(t) ?? t.credits_reward;
@@ -911,6 +929,15 @@
             <span class="next-up__meta">#${escapeHtml(String(t.id))}${mins} · ${fmtNum(credits)} ${escapeHtml(cur)} est.</span>
           </li>`;
       }).join('');
+      // Name the size of the queue these two came off. Silent when the count is
+      // missing or not bigger than what is shown — "See all 2" under two rows is
+      // noise, and a made-up number is worse than none.
+      const foot = document.getElementById('home-next-foot');
+      if (foot) {
+        foot.textContent = Number.isFinite(total) && total > rows.length
+          ? `See all ${fmtNum(total)} ready work →`
+          : 'See all ready work →';
+      }
       wrap.hidden = false;
       if (subhead) subhead.hidden = false;
     } catch (_) {

package/modules/hall-ui/public/hall-widgets.js

@@ -102,7 +102,7 @@
     '<div id="home-next" hidden>' +
       '<h3 class="ginbox__sec-h">Next up — ready to claim</h3>' +
       '<ul class="next-up" id="home-next-list"></ul>' +
-      '<p class="next-up__foot"><a href="/work">See all ready work →</a></p>' +
+      '<p class="next-up__foot"><a href="/work" id="home-next-foot">See all ready work →</a></p>' +
     '</div>' +
     '<h3 class="ginbox__sec-h" id="home-recent-subh" hidden>Recently shipped</h3>' +
     '<table class="ledger" id="home-recent-table"><thead><tr><th>№</th><th>Work</th><th data-currency-label="caps">Credits</th><th>Shipped</th></tr></thead>' +

package/modules/lifecycle/routes/tasks.js

@@ -161,7 +161,12 @@ module.exports = function buildTasksRouter() {
     if (claimCreatedBy && claimCreatedBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
     const claimStaleDays = posInt(req.query.stale_days, 'bad_stale_days', 3650);
     if (claimStaleDays && claimStaleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
-    const [claimable, active] = await Promise.all([
+    // ?limit=N — opt-in, for a caller that renders N rows (goal 1000072; the hall's
+    // two-line Home card was pulling this whole feed, descriptions and all). It slices
+    // the RETURNED feed, never the query — lifecycle/CLAUDE.md has the why.
+    const claimLimit = posInt(req.query.limit, 'bad_limit', 1000);
+    if (claimLimit && claimLimit.bad) return res.fail('bad_limit', { status: 400, message: 'limit must be a positive integer (max 1000).' });
+    const [feed, active] = await Promise.all([
       db.listClaimableTasks({
         versionId: version || null,
         builderId: req.builder.id,
@@ -172,13 +177,17 @@ module.exports = function buildTasksRouter() {
       }),
       db.listActiveClaims(),
     ]);
+    const claimable = claimLimit ? feed.slice(0, claimLimit) : feed;
     // V3.R75 (#294): tick the onboarding state machine for first_start. Fire
     // and forget — the response should never wait on or fail because of the
     // onboarding write. safeMarkStage swallows errors and handles the
     // graduation broadcast. Through the `onboarding` kernel port (BV1.R81 / ADR
     // 0093 §1); ?. degrades to a no-op when the module is off.
     seams.resolveOptional('onboarding')?.safeMarkStage(pool, req.builder.id, 'first_start', req.builder);
-    res.json({ claimable, active_claims: active });
+    // `claimable_total` is what makes the limit honest — two rows with no count reads
+    // as "there are only two". It is the length of the array the slice came from, never
+    // a second count query (that is how a total and its own list drift apart, ADR 0197).
+    res.json({ claimable, claimable_total: feed.length, active_claims: active });
   });
 
   // GET /tasks/newcomer-floor — supply gauge for the newcomer queue (task 614).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.506",
+  "version": "1.19.507",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.506",
+      "version": "1.19.507",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.506",
+  "version": "1.19.507",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.506'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.507'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_board_world.mjs

@@ -294,8 +294,18 @@ test('the system notices are inbox LINES, first in the card, and counted by its
 
 test('the greeting reads /me, the public progress and the claimable feed, and builders.js feeds all three', () => {
   assert.match(buildersJs, /getJSON\(`\$\{API\}\/public\/progress`\)/, 'Home fetches the public progress once');
-  assert.match(buildersJs, /lastClaimableCount = resp && Array\.isArray\(resp\.claimable\) \? resp\.claimable\.length : null;/,
+  // The count comes off the SAME Next-up response — one request, not a second
+  // fetch. It reads `claimable_total` rather than the length of the returned array,
+  // because that request is now bounded (?limit=2, task 1003545): the array holds two
+  // rows and the total holds the whole rank-scoped queue. Asserting the derivation
+  // rather than one literal expression is deliberate — the previous version pinned
+  // `resp.claimable.length`, which read as a requirement to download the feed.
+  assert.match(buildersJs, /lastClaimableCount = Number\.isFinite\(claimableTotal\)/,
     'the claimable feed Home already fetches for Next-up answers the count');
+  assert.match(buildersJs, /const claimableTotal = Number\(resp && resp\.claimable_total\);/,
+    'and it takes the count from the response total, so a bounded read still knows it');
+  assert.doesNotMatch(buildersJs, /getJSON\(`\$\{API\}\/tasks\/claimable`/,
+    'no unbounded claimable fetch on Home — the count must never cost the whole queue');
   assert.match(buildersJs, /get lastProgressState\(\)/, 'the renderer reads progress through a getter, so it cannot freeze at boot');
   assert.match(buildersJs, /get lastClaimableCount\(\)/, 'and the count the same way');
   assert.equal((buildersJs.match(/renderGreeting\(\)/g) || []).length, 3, 'rendered after /me, after progress and after the claimable feed — each half as it lands');

package/tests/home_bounded_reads.mjs

@@ -0,0 +1,159 @@
+// tests/home_bounded_reads.mjs — the Home card asks for what it renders
+// (goal 1000072, "Human legibility").
+//
+// THE PATTERN THIS CLOSES. This goal's criterion `legibility-sort-and-staleness` set
+// the rule in its own words — "~1,357 tasks on BONGOS-V1 alone. A view that does not
+// survive that number is not a solution" — and `modules/lifecycle/goal-rollup.js`
+// exists because the Goals page broke it: **5,229,455 bytes for ~1,400 tasks, measured
+// 2026-08-25, to produce roughly forty small counter objects.**
+//
+// The same shape was still live on the page every builder lands on first. Home's
+// "Next up" card called `GET /tasks/claimable` — no limit, `SELECT v.*`, every
+// description on every claimable row — and then `.slice(0, 2)` to fill TWO lines. Its
+// triage card pulled the route's default fifty ideas to render five.
+//
+// So this pins the rule rather than the two instances: a Home card may not download a
+// feed and throw most of it away, and the limit it asks for must come back with a
+// total, or two rows are indistinguishable from "there are only two".
+//
+// Run:  node tests/home_bounded_reads.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const BUILDERS_JS = read('modules/hall-ui/public/builders.js');
+const WIDGETS_JS = read('modules/hall-ui/public/hall-widgets.js');
+const ROUTE = read('modules/lifecycle/routes/tasks.js');
+const DB_TASKS = read('modules/lifecycle/db-tasks.js');
+
+// Comments stripped before any "is the bad pattern gone" assertion — the same rule
+// scripts/gds/category-advisory-guard.js applies. A comment EXPLAINING the pattern that
+// was removed is documentation; matching it would make the fix un-documentable.
+const noComments = (src) => src.replace(/^\s*\/\/.*$/gm, '');
+
+const { test, summary } = makeRunner();
+
+// ---------------------------------------------------------------------------
+// 1. the rule, over Home's own boot reads
+// ---------------------------------------------------------------------------
+
+await test('no Home read downloads a feed and slices it in the browser', () => {
+  // The tell is a `.slice(0, N)` applied to a response body. Narrowing what is
+  // DISPLAYED is fine; narrowing what was FETCHED is the bug, and the two look
+  // identical at the call site — which is why this is a test and not a code review.
+  const src = noComments(BUILDERS_JS);
+  for (const fn of ['loadNextUp', 'loadTriageInbox']) {
+    const from = src.indexOf(`function ${fn}(`);
+    assert.ok(from > 0, `${fn} must exist`);
+    const body = src.slice(from, src.indexOf('\n  }\n', from));
+    const name = fn;
+    const url = body.match(/\$\{API\}\/[^`'"]+/);
+    assert.ok(url, `${name} must issue a request`);
+    assert.match(url[0], /[?&]limit=\d+/, `${name} must ask the server for its page size`);
+  }
+});
+
+await test('the two cards ask for exactly the rows they draw', () => {
+  assert.match(BUILDERS_JS, /\$\{API\}\/tasks\/claimable\?limit=2/, 'Next up draws two rows');
+  assert.match(BUILDERS_JS, /\$\{API\}\/inbox\?limit=5/, 'the triage card draws five');
+  // …and no longer re-slices what came back.
+  const src = noComments(BUILDERS_JS);
+  const from = src.indexOf('function loadNextUp(');
+  const body = src.slice(from, src.indexOf('\n  }\n', from));
+  assert.ok(body.length > 0, 'loadNextUp body found');
+  assert.doesNotMatch(body, /\.slice\(0,\s*2\)/, 'the client-side slice is gone');
+});
+
+// ---------------------------------------------------------------------------
+// 2. the limit is honest — it comes back with a total
+// ---------------------------------------------------------------------------
+
+await test('GET /tasks/claimable validates ?limit and answers with a total', () => {
+  assert.match(ROUTE, /posInt\(req\.query\.limit, 'bad_limit', 1000\)/, 'same validator as GET /tasks');
+  assert.match(ROUTE, /res\.fail\('bad_limit'/);
+  assert.match(ROUTE, /claimable_total: feed\.length/);
+  // The total must be the length of the very array the rows were sliced from. A
+  // companion count query would be a second copy of a filter chain that runs half in
+  // SQL and half in JS — the ADR 0197 failure, one release later.
+  assert.doesNotMatch(ROUTE, /countClaimableTasks/,
+    'no second count query: the sliced array reports its own length');
+  assert.match(ROUTE, /const claimable = claimLimit \? feed\.slice\(0, claimLimit\) : feed;/);
+});
+
+await test('the limit is OPT-IN — the Work Board and /builder-start are untouched', () => {
+  // Their whole job is the full feed. A default limit would silently truncate the board
+  // and the CLI's claim menu, which is a worse bug than the one being fixed. `posInt`
+  // returns undefined for an absent param, so `claimLimit ? … : feed` hands back
+  // everything exactly as before.
+  assert.match(ROUTE, /claimLimit \? feed\.slice/);
+  assert.doesNotMatch(DB_TASKS, /listClaimableTasks\([^)]*limit/,
+    'the db helper gained no limit — nothing below the route changed');
+});
+
+await test('every db.* the claimable handler calls actually exists', () => {
+  // The bug this catches, caught the hard way: an earlier cut pushed the limit into the
+  // db layer, was reverted, and left the route calling `db.listClaimableTasksPaged` — a
+  // function that no longer existed. Every assertion in this file is source text, and
+  // source text cannot see a missing symbol; a neighbouring suite found it instead.
+  const from = ROUTE.indexOf("router.get('/tasks/claimable'");
+  const body = ROUTE.slice(from, ROUTE.indexOf('res.json({ claimable', from));
+  const called = [...new Set([...body.matchAll(/\bdb\.([A-Za-z0-9_]+)\s*\(/g)].map((m) => m[1]))];
+  assert.ok(called.length > 0, 'the handler calls the db layer');
+  const dbExports = read('modules/lifecycle/db.js');
+  const block = dbExports.slice(dbExports.lastIndexOf('module.exports'));
+  for (const fn of called) {
+    assert.ok(new RegExp(`\\b${fn}\\b`).test(block), `db.js must export ${fn} — the route calls it`);
+  }
+});
+
+await test('the db layer is untouched: no new export, no second feed function', () => {
+  // The first cut pushed the limit into db-tasks.js and exported a paged twin. It
+  // bought nothing — a SQL LIMIT is unsafe here either way, so the query does the same
+  // work — and it widened the hand-mirrored export lists in db.js/db-tasks.js until
+  // they shared a 30-line run and tripped the duplication ratchet. The wire is the
+  // thing being saved, and the route is where the wire is.
+  assert.doesNotMatch(DB_TASKS, /listClaimableTasksPaged/);
+  assert.doesNotMatch(read('modules/lifecycle/db.js'), /listClaimableTasksPaged/);
+});
+
+// ---------------------------------------------------------------------------
+// 3. the trap a SQL LIMIT would have walked into
+// ---------------------------------------------------------------------------
+
+await test('the limit is applied AFTER the JS post-filters, not as a SQL LIMIT', () => {
+  // listClaimableTasks filters twice in JS after the query returns: the autonomous
+  // runner's protected-path + membership drops, and capNewcomerTasks' display cap.
+  // `LIMIT 2` in SQL can hand back two rows that both get dropped, leaving an empty
+  // feed with claimable work sitting right behind it. Slicing the RETURNED feed is
+  // what makes the limit safe, and it is why the query is unchanged.
+  const fn = DB_TASKS.slice(
+    DB_TASKS.indexOf('async function listClaimableTasks('),
+    DB_TASKS.indexOf('function taskTouchesProtectedPath(')
+  );
+  assert.ok(fn.length > 0, 'found listClaimableTasks');
+  assert.doesNotMatch(fn, /LIMIT \$/, 'no SQL LIMIT in the claimable query');
+  assert.match(fn, /return capNewcomerTasks\(rows\);/, 'the JS post-filters still have the last word');
+  const routeFrom = ROUTE.indexOf("router.get('/tasks/claimable'");
+  const routeBody = ROUTE.slice(routeFrom, ROUTE.indexOf('res.json({ claimable', routeFrom));
+  assert.match(routeBody, /feed\.slice\(0, claimLimit\)/, 'the slice happens on the finished feed');
+});
+
+// ---------------------------------------------------------------------------
+// 4. what the reader sees
+// ---------------------------------------------------------------------------
+
+await test('the foot names the queue the two rows came off', () => {
+  assert.match(WIDGETS_JS, /id="home-next-foot"/, 'the link has an id to write into');
+  assert.match(BUILDERS_JS, /See all \$\{fmtNum\(total\)\} ready work/);
+  // Silent rather than wrong when the count is missing or not larger than what is
+  // shown: "See all 2" under two rows is noise, and a guessed number is worse.
+  assert.match(BUILDERS_JS, /Number\.isFinite\(total\) && total > rows\.length/);
+});
+
+summary();