@bongos/core 1.19.506 → 1.19.508

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.506",
-  "core_contract": "1.19.506",
-  "source_commit": "0c5102c78cf4acf0c5ab19a0f34ab43caa0a53d0",
+  "core_version": "1.19.508",
+  "core_contract": "1.19.508",
+  "source_commit": "f80c3ed5ba139cbecb704b5cd064990b3ff9aaaf",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T17:56:16.813Z",
+  "built_at": "2026-09-03T18:24:24.662Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 427,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1945,
+    "functional_verbatim": 1947,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2396,
-  "tree_sha256": "d0ec8df4b7c843085a5692c55b908977f2bbc25023e21dc62e246e62cfdfbd0d",
+  "file_count": 2398,
+  "tree_sha256": "8482fdb735f30dbc4866dbf952a55196a50e643fd932b0ef0bb5b701ada05eab",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "036e1064bb9513d7acbf0dafd0850deac9f45a38f31c3cbb8c1d7493c9159b76"
+      "sha256": "afe60dae1ca8b55c5f9521b4f23eaad4eb194627a2ee105cae1513745ae71544"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1702,7 +1702,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "c02241e6fd8372fb80339eaa385f227b642754ff127dd529cfdc94ed87d077a4"
+      "sha256": "0b5eab5940ae6cf0e8691c6ec59757e8bbfb719a660ec3e8492d9870c95a8c62"
     },
     {
       "path": "docs/architecture.md",
@@ -1727,12 +1727,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "6f3476adddccabea94bb3bb8af804ec1e6dfc1710a9e3f76fb4ba062b44e3234"
+      "sha256": "b6b680304b158480b87c61679bafa3431d6e492aa9323933abf68621ce243365"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "d6f13f1ab6d579e195b3240511d68181aabd64591933f1911fc0009fbdf875d8"
+      "sha256": "ed8c0d7c6ab7edd3ae61cd97c530323ed915f32cfa14a4f4ed1bca4d52437a01"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2577,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "130aad5d413e749405b9f5104259cdfb9dfde539ae35326649c64e79c5ff6604"
+      "sha256": "4af1ded195d83c7060e26bf72c6aa27144bfba92e2ce679e2e90d57b866a0c93"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4487,7 +4487,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "1a8bf6e502311a22ac937ffbf05214d5a0286b4f94b5275e580b7fb68911e7f7"
+      "sha256": "18e113894ddb8d8e86faa01d20edde978f8710f8eb546e0baa8b7732d46cf00c"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -4707,7 +4707,7 @@
     {
       "path": "modules/hall-ui/public/hall-widgets.js",
       "mode": "0000644",
-      "sha256": "8aa90c0bb15a19f13295da6225d270bbbdaf4b5336240f03cbc05abe192e87c0"
+      "sha256": "6a3a19788c6e39497f32c130086c812fad15a5a7cf01d91b8a68f673b9ea6437"
     },
     {
       "path": "modules/hall-ui/public/harbor.css",
@@ -5512,7 +5512,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "0bbf26870c5959ef6101c535e9a3987d2177d2a8d1b6c91bded9c31350836165"
+      "sha256": "0ba020342e32eb552532a3a34a57b19aa4bbe87f0cb89ace0c45f4c301d7a015"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -7227,12 +7227,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7a6dd18246bdbc4fbf57c52d54246a17ce2f5fb144bb256a6a163804175a8be3"
+      "sha256": "e9270218a7b9b405011ac398777c9eb70fca7f0cdf3010649ea7450f25d399bb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "26b904a0eb436c1b3654cac79c075a39ccd61bd9db7d3eab8c96f43507fd2686"
+      "sha256": "6a1614277a1b71103a1882256a82e138cbdb4bfbc28be233e69cc751d7f24eed"
     },
     {
       "path": "public-docs/index.html",
@@ -8902,7 +8902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "818b1e08d902b65dedaf1d670b920a12f8eedbc3191051c4977675ec34a4e8d6"
+      "sha256": "eef34fbd7a43f793b876c07999581137f4e8e37cc0b3f03d7db41759b0271693"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10287,7 +10287,7 @@
     {
       "path": "tests/hall_board_world.mjs",
       "mode": "0000644",
-      "sha256": "61c5fc8a46807653801315d14711b7f11f52ce80e27908fe59518e032582228f"
+      "sha256": "b0ef3e407d7bd9266231dc089f1288ee40efb113e40333f79d3de4436db6cc21"
     },
     {
       "path": "tests/hall_catalog_world.mjs",
@@ -10317,7 +10317,7 @@
     {
       "path": "tests/hall_page_gate_map.mjs",
       "mode": "0000644",
-      "sha256": "d529685063de8c4aa6676abf86f1180bb9cd13d27a3c372d8a3d9cf078af1999"
+      "sha256": "e65e22471469a9bf4551925f0549cfd6720aa7d5b7b7cf9df17984604e07c3cb"
     },
     {
       "path": "tests/hall_palette.mjs",
@@ -10389,6 +10389,11 @@
       "mode": "0000644",
       "sha256": "e2d482ca08d151719f61b52bcbb8056d5c91c9447b5bba7c9f7682d9582e34b8"
     },
+    {
+      "path": "tests/home_bounded_reads.mjs",
+      "mode": "0000644",
+      "sha256": "186a8ebd04cd4dc8021b3a36699468e9c0bcf78ca61ce9f7be7c3e25c632fb3e"
+    },
     {
       "path": "tests/hook_core_resolve.mjs",
       "mode": "0000644",
@@ -10874,6 +10879,11 @@
       "mode": "0000644",
       "sha256": "079d7eef5828912e306e9dbbe081fef6004526067bd15aa6433dc2ff1873a4be"
     },
+    {
+      "path": "tests/my_projects_surface.mjs",
+      "mode": "0000644",
+      "sha256": "03b61cb8de6713b03fe17b2b3c5d70af7c511b33b17a42295f49c36e27771470"
+    },
     {
       "path": "tests/needs_rebase.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -123,7 +123,7 @@ export interface GetSessionsSearchResponse { sessions: unknown; count: unknown;
 export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_key_b64: unknown }
 export interface GetTaskRecommendationsForMeResponse { recommendations: unknown; count: unknown }
 export interface GetTaskRecommendationsMineResponse { recommendations: unknown; count: unknown }
-export interface GetTasksClaimableResponse { claimable: unknown; active_claims: unknown }
+export interface GetTasksClaimableResponse { claimable: unknown; claimable_total: unknown; active_claims: unknown }
 export interface GetTasksIdCriteriaResponse { criteria: unknown }
 export interface GetTasksIdDependenciesResponse { dependencies: unknown; dependents: unknown }
 export interface GetTasksIdRecommendationsResponse { recommendations: unknown; count: unknown }

package/docs/api/openapi.json

@@ -17273,10 +17273,12 @@
         "type": "object",
         "properties": {
           "claimable": {},
+          "claimable_total": {},
           "active_claims": {}
         },
         "required": [
           "claimable",
+          "claimable_total",
           "active_claims"
         ]
       },

package/docs/copy-inventory.md

@@ -131,7 +131,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `daf73127afff` | certain | A word on why | `modules/hall-ui/public/hall-render.js:278` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:46` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:61` |
-| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1123` |
+| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1150` |
 | `6ca31dd5eb91` | certain | Acknowledge the primer | `modules/hall-ui/public/primer.html:99` |
 | `4461b13f95c2` | certain | Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime. | `modules/hall-ui/public/settings.html:209` |
 | `524188fe0078` | certain | Active sessions | `modules/hall-ui/public/settings.html:162` |
@@ -864,7 +864,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `381f29be7497` | certain | The most recently shipped tasks. | `modules/hall-ui/public/work.html:108` |
 | `82479c539fca` | certain | The name shown beside your work — in the roster, the leaderboard, and the work feed. Your sign-in and the cred | `modules/hall-ui/public/settings.html:75` |
 | `b88dd8b96b72` | certain | The next person to notice this sentence reads your note instead of re-litigating it. | `modules/hall-ui/public/copy-desk.html:135` |
-| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1365` |
+| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1392` |
 | `6c3d88de42de` | certain | The primer | `modules/hall-ui/public/primer.html:41` |
 | `dea378cd4837` | certain | The primer did not load | `modules/hall-ui/public/primer.html:88` |
 | `3bc5ec5f35ec` | certain | The ranks, lowest to highest | `modules/hall-ui/public/ranks.html:46` |

package/docs/copy-registry.json

@@ -2056,7 +2056,7 @@
       "surface": "builders-hall",
       "text": "Achievements could not be loaded.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1123,
+      "line": 1150,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8653,7 +8653,7 @@
       "surface": "builders-hall",
       "text": "The page could not be loaded. Try again.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1365,
+      "line": 1392,
       "origin": "js-notice",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -1449,5 +1449,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.504 with no explicit bump. run 33785121177. (task 1002620)
   1.19.506 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.505 with no explicit bump. run 33787453336. (task 1002620)
+  1.19.507 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.506 with no explicit bump. run 33788726591. (task 1002620)
+  1.19.508 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.507 with no explicit bump. run 33790206682. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/builders.js

@@ -866,7 +866,10 @@
   let canTriage = false;
   function loadTriageInbox() {
     if (!canTriage) return;
-    getJSON(`${API}/inbox`)
+    // ?limit=5 — the card renders five rows; the route's default is 50, and the
+    // open_count that drives the "N waiting" line is a separate count, so asking for
+    // what is rendered costs the reader nothing (goal 1000072).
+    getJSON(`${API}/inbox?limit=5`)
       .then((data) => renderTriageInbox(data))
       .catch(() => { /* nice-to-have; never break the hall */ });
   }
@@ -895,13 +898,28 @@
     const subhead = document.getElementById('home-recent-subh');
     if (!wrap || !list) return;
     try {
-      const resp = await getJSON(`${API}/tasks/claimable`, { softAuth: true });
-      // task 1003464: the same feed answers the greeting's "N tasks are
-      // claimable right now" — rank-scoped, so it is THIS builder's number.
-      lastClaimableCount = resp && Array.isArray(resp.claimable) ? resp.claimable.length : null;
+      // ?limit=2 — this card is TWO lines. It used to download the entire claimable
+      // feed, every row with its full description, and `.slice(0, 2)` it: the same
+      // shape goal 1000072's criterion names, and the one goal-rollup.js was carved to
+      // fix on the Goals page (5,229,455 bytes to produce forty counters). The server
+      // already orders by priority then calibrated estimate, so the first two rows ARE
+      // the top two. `claimable_total` comes back so the foot can say how many are
+      // waiting instead of leaving two rows to imply there are only two.
+      const resp = await getJSON(`${API}/tasks/claimable?limit=2`, { softAuth: true });
+      // task 1003464: the greeting's "N tasks are claimable right now" — rank-scoped,
+      // so it is THIS builder's number. It reads claimable_total rather than the length
+      // of a fully-downloaded feed: the same number, without the wire cost that this
+      // commit exists to remove. The .length fallback covers a server that predates
+      // the field (a deploy skew), so the greeting degrades to correct-but-costly
+      // rather than to blank.
+      const claimableTotal = Number(resp && resp.claimable_total);
+      lastClaimableCount = Number.isFinite(claimableTotal)
+        ? claimableTotal
+        : (resp && Array.isArray(resp.claimable) ? resp.claimable.length : null);
       renderGreeting();
-      const rows = (resp && Array.isArray(resp.claimable) ? resp.claimable : []).slice(0, 2);
+      const rows = resp && Array.isArray(resp.claimable) ? resp.claimable : [];
       if (!rows.length) { wrap.hidden = true; if (subhead) subhead.hidden = true; return; }
+      const total = Number(resp.claimable_total);
       const cur = (window.__BRANDING__ && window.__BRANDING__.currency && window.__BRANDING__.currency.label) || 'credits';
       list.innerHTML = rows.map((t) => {
         const credits = window.OTBBranding?.taskCreditValue?.(t) ?? t.credits_reward;
@@ -911,6 +929,15 @@
             <span class="next-up__meta">#${escapeHtml(String(t.id))}${mins} · ${fmtNum(credits)} ${escapeHtml(cur)} est.</span>
           </li>`;
       }).join('');
+      // Name the size of the queue these two came off. Silent when the count is
+      // missing or not bigger than what is shown — "See all 2" under two rows is
+      // noise, and a made-up number is worse than none.
+      const foot = document.getElementById('home-next-foot');
+      if (foot) {
+        foot.textContent = Number.isFinite(total) && total > rows.length
+          ? `See all ${fmtNum(total)} ready work →`
+          : 'See all ready work →';
+      }
       wrap.hidden = false;
       if (subhead) subhead.hidden = false;
     } catch (_) {

package/modules/hall-ui/public/hall-widgets.js

@@ -102,7 +102,7 @@
     '<div id="home-next" hidden>' +
       '<h3 class="ginbox__sec-h">Next up — ready to claim</h3>' +
       '<ul class="next-up" id="home-next-list"></ul>' +
-      '<p class="next-up__foot"><a href="/work">See all ready work →</a></p>' +
+      '<p class="next-up__foot"><a href="/work" id="home-next-foot">See all ready work →</a></p>' +
     '</div>' +
     '<h3 class="ginbox__sec-h" id="home-recent-subh" hidden>Recently shipped</h3>' +
     '<table class="ledger" id="home-recent-table"><thead><tr><th>№</th><th>Work</th><th data-currency-label="caps">Credits</th><th>Shipped</th></tr></thead>' +

package/modules/lifecycle/routes/tasks.js

@@ -161,7 +161,12 @@ module.exports = function buildTasksRouter() {
     if (claimCreatedBy && claimCreatedBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
     const claimStaleDays = posInt(req.query.stale_days, 'bad_stale_days', 3650);
     if (claimStaleDays && claimStaleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
-    const [claimable, active] = await Promise.all([
+    // ?limit=N — opt-in, for a caller that renders N rows (goal 1000072; the hall's
+    // two-line Home card was pulling this whole feed, descriptions and all). It slices
+    // the RETURNED feed, never the query — lifecycle/CLAUDE.md has the why.
+    const claimLimit = posInt(req.query.limit, 'bad_limit', 1000);
+    if (claimLimit && claimLimit.bad) return res.fail('bad_limit', { status: 400, message: 'limit must be a positive integer (max 1000).' });
+    const [feed, active] = await Promise.all([
       db.listClaimableTasks({
         versionId: version || null,
         builderId: req.builder.id,
@@ -172,13 +177,17 @@ module.exports = function buildTasksRouter() {
       }),
       db.listActiveClaims(),
     ]);
+    const claimable = claimLimit ? feed.slice(0, claimLimit) : feed;
     // V3.R75 (#294): tick the onboarding state machine for first_start. Fire
     // and forget — the response should never wait on or fail because of the
     // onboarding write. safeMarkStage swallows errors and handles the
     // graduation broadcast. Through the `onboarding` kernel port (BV1.R81 / ADR
     // 0093 §1); ?. degrades to a no-op when the module is off.
     seams.resolveOptional('onboarding')?.safeMarkStage(pool, req.builder.id, 'first_start', req.builder);
-    res.json({ claimable, active_claims: active });
+    // `claimable_total` is what makes the limit honest — two rows with no count reads
+    // as "there are only two". It is the length of the array the slice came from, never
+    // a second count query (that is how a total and its own list drift apart, ADR 0197).
+    res.json({ claimable, claimable_total: feed.length, active_claims: active });
   });
 
   // GET /tasks/newcomer-floor — supply gauge for the newcomer queue (task 614).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.506",
+  "version": "1.19.508",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.506",
+      "version": "1.19.508",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.506",
+  "version": "1.19.508",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.506'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.508'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_board_world.mjs

@@ -294,8 +294,18 @@ test('the system notices are inbox LINES, first in the card, and counted by its
 
 test('the greeting reads /me, the public progress and the claimable feed, and builders.js feeds all three', () => {
   assert.match(buildersJs, /getJSON\(`\$\{API\}\/public\/progress`\)/, 'Home fetches the public progress once');
-  assert.match(buildersJs, /lastClaimableCount = resp && Array\.isArray\(resp\.claimable\) \? resp\.claimable\.length : null;/,
+  // The count comes off the SAME Next-up response — one request, not a second
+  // fetch. It reads `claimable_total` rather than the length of the returned array,
+  // because that request is now bounded (?limit=2, task 1003545): the array holds two
+  // rows and the total holds the whole rank-scoped queue. Asserting the derivation
+  // rather than one literal expression is deliberate — the previous version pinned
+  // `resp.claimable.length`, which read as a requirement to download the feed.
+  assert.match(buildersJs, /lastClaimableCount = Number\.isFinite\(claimableTotal\)/,
     'the claimable feed Home already fetches for Next-up answers the count');
+  assert.match(buildersJs, /const claimableTotal = Number\(resp && resp\.claimable_total\);/,
+    'and it takes the count from the response total, so a bounded read still knows it');
+  assert.doesNotMatch(buildersJs, /getJSON\(`\$\{API\}\/tasks\/claimable`/,
+    'no unbounded claimable fetch on Home — the count must never cost the whole queue');
   assert.match(buildersJs, /get lastProgressState\(\)/, 'the renderer reads progress through a getter, so it cannot freeze at boot');
   assert.match(buildersJs, /get lastClaimableCount\(\)/, 'and the count the same way');
   assert.equal((buildersJs.match(/renderGreeting\(\)/g) || []).length, 3, 'rendered after /me, after progress and after the claimable feed — each half as it lands');

package/tests/hall_page_gate_map.mjs

@@ -47,6 +47,13 @@ const ORACLE = {
   '/builders/modules': 'requireBuilderPage',
   '/builders/goals': 'requireBuilderPage',
   '/builders/roadmap': 'requireBuilderPage',
+  // Gated at this tier all along, but with no row until task 1003448 walked the
+  // module's pages: copy-desk (task 1003113) and ideas (task 1002928) are open to
+  // every rank by design, and collab's reads (task 1003172) are scoped to the
+  // caller by the server — so for all three, sign-in IS the whole gate.
+  '/builders/copy-desk': 'requireBuilderPage',
+  '/builders/ideas': 'requireBuilderPage',
+  '/builders/collab': 'requireBuilderPage',
   // task 1002710: the orientation reading rooms moved DOWN to this tier from
   // requireNonXenosPage (thetes+). They are the onboarding documents, so gating
   // them above xenos turned away the exact reader they were written for. The
@@ -92,10 +99,33 @@ const ORACLE = {
   '/builders/drachmae': null,
   '/builders/profile': null,
   '/builders/not-ready': null,
+
+  // NOT deliberate — recorded because it is true, and filed as idea 1000907
+  // (task 1003448). The detail pages are addressed by a second segment, and
+  // /builders/task/:id and /builders/idea/:id are both gated at signed-in; the
+  // id-less slugs still resolve to the same shells through BUILDERS_PAGE_RE and
+  // match no gate. No data rides the shell and every read behind it is gated
+  // server-side, so this is an inconsistency rather than an exposure — but it is
+  // a row that should turn into a real gate (or a redirect) when that is decided.
+  '/builders/task': null,
+  '/builders/idea': null,
+
+  // Gone, not public — the hall ships no my-projects page at all since task
+  // 1003308 (owner's decision: "my projects" is a user-level page the hub owns,
+  // so the hall ships no page, no link and no redirect). Nothing is served here,
+  // so there is nothing to gate. Recorded rather than left out, because "absent
+  // from the map" is indistinguishable from the oversight this file exists to
+  // catch. GONE_PAGES below keeps the row honest if the file ever returns.
+  '/builders/my-projects': null,
 };
 
 // ─── reconstruct the URL→gate map from the source ───────────────────────────
 // 1. every `const NAME_RE = /…/;` (the page-matching regexes)
+// The eval below turns a matched regex LITERAL back into a RegExp. Its only
+// input is this repo's own serve-internal.js, read from a path fixed at the top
+// of this file — never a caller's string, never anything fetched. Keep it that
+// way: sourcing SRC from anywhere an outsider can influence makes this arbitrary
+// code execution rather than a parser.
 function readRegexes(src) {
   const out = new Map();
   const re = /const\s+([A-Z0-9_]+_RE)\s*=\s*(\/(?:\\.|\[(?:\\.|[^\]])*\]|[^/\\])+\/[gimsuy]*)\s*;/g;
@@ -170,6 +200,47 @@ test('path-normalization tricks do not slip past a gate', () => {
   }
 });
 
+// ═══ exhaustiveness — the reason a page can go missing from the oracle ═══════
+// The ORACLE above is hand-written, so until now a page could ship with NO gate
+// and NO row and nothing would notice — the same blind spot that let /sessions
+// and /scouting ship ungated, and that left /my-projects out of the map entirely
+// (task 1003448). Walking the module's own pages turns "someone remembered to
+// add a row" into "the tree is walked", which is the half this test was missing.
+const HALL_PAGES_DIR = path.join(ROOT, 'modules/hall-ui/public');
+
+function hallPageUrls() {
+  return fs.readdirSync(HALL_PAGES_DIR)
+    .filter((f) => f.endsWith('.html'))
+    .map((f) => (f === 'index.html' ? '/builders/' : `/builders/${f.replace(/\.html$/, '')}`));
+}
+
+test('every hall page the module ships has a row in the oracle', () => {
+  const missing = hallPageUrls().filter((url) => !(url in ORACLE));
+  assert.deepEqual(missing, [],
+    `hall pages with no ORACLE row: ${missing.join(', ')} — give each a gate, or a deliberate null with the reason`);
+});
+
+// A page can also LEAVE the hall, and then `null` claims something weaker than
+// "the shell is public": nothing is served at that URL at all. Spelling those out
+// keeps the row honest — if the file ever comes back, the null stops describing
+// reality, and this fails instead of quietly waving an ungated shell through.
+const GONE_PAGES = {
+  // Removed by an owner decision in task 1003308 — "my projects" is a user-level
+  // page the hub already owns, so the hall ships no page, no link and no
+  // redirect. tests/hall_settings_world.mjs pins the deletion itself; this row
+  // pins what the deletion means for the gate map.
+  '/builders/my-projects': 'task 1003308 — the hub owns "my projects"',
+};
+
+test('a row that is null because the page left the hall serves no page', () => {
+  for (const [url, why] of Object.entries(GONE_PAGES)) {
+    assert.equal(ORACLE[url], null, `${url} is gone (${why}), so it can carry no gate`);
+    const file = path.join(HALL_PAGES_DIR, `${url.replace('/builders/', '')}.html`);
+    assert.ok(!fs.existsSync(file),
+      `${url} is back, so "${why}" no longer holds — give it a real gate and a real row`);
+  }
+});
+
 test('no gated page is left matching only a REMOVED gate function', () => {
   // requireNonXenosPage still EXISTS in auth.js (page.view.builder is a live
   // catalog atom an Archon can attach to a custom role) but task 1002710 left it

package/tests/home_bounded_reads.mjs

@@ -0,0 +1,159 @@
+// tests/home_bounded_reads.mjs — the Home card asks for what it renders
+// (goal 1000072, "Human legibility").
+//
+// THE PATTERN THIS CLOSES. This goal's criterion `legibility-sort-and-staleness` set
+// the rule in its own words — "~1,357 tasks on BONGOS-V1 alone. A view that does not
+// survive that number is not a solution" — and `modules/lifecycle/goal-rollup.js`
+// exists because the Goals page broke it: **5,229,455 bytes for ~1,400 tasks, measured
+// 2026-08-25, to produce roughly forty small counter objects.**
+//
+// The same shape was still live on the page every builder lands on first. Home's
+// "Next up" card called `GET /tasks/claimable` — no limit, `SELECT v.*`, every
+// description on every claimable row — and then `.slice(0, 2)` to fill TWO lines. Its
+// triage card pulled the route's default fifty ideas to render five.
+//
+// So this pins the rule rather than the two instances: a Home card may not download a
+// feed and throw most of it away, and the limit it asks for must come back with a
+// total, or two rows are indistinguishable from "there are only two".
+//
+// Run:  node tests/home_bounded_reads.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const BUILDERS_JS = read('modules/hall-ui/public/builders.js');
+const WIDGETS_JS = read('modules/hall-ui/public/hall-widgets.js');
+const ROUTE = read('modules/lifecycle/routes/tasks.js');
+const DB_TASKS = read('modules/lifecycle/db-tasks.js');
+
+// Comments stripped before any "is the bad pattern gone" assertion — the same rule
+// scripts/gds/category-advisory-guard.js applies. A comment EXPLAINING the pattern that
+// was removed is documentation; matching it would make the fix un-documentable.
+const noComments = (src) => src.replace(/^\s*\/\/.*$/gm, '');
+
+const { test, summary } = makeRunner();
+
+// ---------------------------------------------------------------------------
+// 1. the rule, over Home's own boot reads
+// ---------------------------------------------------------------------------
+
+await test('no Home read downloads a feed and slices it in the browser', () => {
+  // The tell is a `.slice(0, N)` applied to a response body. Narrowing what is
+  // DISPLAYED is fine; narrowing what was FETCHED is the bug, and the two look
+  // identical at the call site — which is why this is a test and not a code review.
+  const src = noComments(BUILDERS_JS);
+  for (const fn of ['loadNextUp', 'loadTriageInbox']) {
+    const from = src.indexOf(`function ${fn}(`);
+    assert.ok(from > 0, `${fn} must exist`);
+    const body = src.slice(from, src.indexOf('\n  }\n', from));
+    const name = fn;
+    const url = body.match(/\$\{API\}\/[^`'"]+/);
+    assert.ok(url, `${name} must issue a request`);
+    assert.match(url[0], /[?&]limit=\d+/, `${name} must ask the server for its page size`);
+  }
+});
+
+await test('the two cards ask for exactly the rows they draw', () => {
+  assert.match(BUILDERS_JS, /\$\{API\}\/tasks\/claimable\?limit=2/, 'Next up draws two rows');
+  assert.match(BUILDERS_JS, /\$\{API\}\/inbox\?limit=5/, 'the triage card draws five');
+  // …and no longer re-slices what came back.
+  const src = noComments(BUILDERS_JS);
+  const from = src.indexOf('function loadNextUp(');
+  const body = src.slice(from, src.indexOf('\n  }\n', from));
+  assert.ok(body.length > 0, 'loadNextUp body found');
+  assert.doesNotMatch(body, /\.slice\(0,\s*2\)/, 'the client-side slice is gone');
+});
+
+// ---------------------------------------------------------------------------
+// 2. the limit is honest — it comes back with a total
+// ---------------------------------------------------------------------------
+
+await test('GET /tasks/claimable validates ?limit and answers with a total', () => {
+  assert.match(ROUTE, /posInt\(req\.query\.limit, 'bad_limit', 1000\)/, 'same validator as GET /tasks');
+  assert.match(ROUTE, /res\.fail\('bad_limit'/);
+  assert.match(ROUTE, /claimable_total: feed\.length/);
+  // The total must be the length of the very array the rows were sliced from. A
+  // companion count query would be a second copy of a filter chain that runs half in
+  // SQL and half in JS — the ADR 0197 failure, one release later.
+  assert.doesNotMatch(ROUTE, /countClaimableTasks/,
+    'no second count query: the sliced array reports its own length');
+  assert.match(ROUTE, /const claimable = claimLimit \? feed\.slice\(0, claimLimit\) : feed;/);
+});
+
+await test('the limit is OPT-IN — the Work Board and /builder-start are untouched', () => {
+  // Their whole job is the full feed. A default limit would silently truncate the board
+  // and the CLI's claim menu, which is a worse bug than the one being fixed. `posInt`
+  // returns undefined for an absent param, so `claimLimit ? … : feed` hands back
+  // everything exactly as before.
+  assert.match(ROUTE, /claimLimit \? feed\.slice/);
+  assert.doesNotMatch(DB_TASKS, /listClaimableTasks\([^)]*limit/,
+    'the db helper gained no limit — nothing below the route changed');
+});
+
+await test('every db.* the claimable handler calls actually exists', () => {
+  // The bug this catches, caught the hard way: an earlier cut pushed the limit into the
+  // db layer, was reverted, and left the route calling `db.listClaimableTasksPaged` — a
+  // function that no longer existed. Every assertion in this file is source text, and
+  // source text cannot see a missing symbol; a neighbouring suite found it instead.
+  const from = ROUTE.indexOf("router.get('/tasks/claimable'");
+  const body = ROUTE.slice(from, ROUTE.indexOf('res.json({ claimable', from));
+  const called = [...new Set([...body.matchAll(/\bdb\.([A-Za-z0-9_]+)\s*\(/g)].map((m) => m[1]))];
+  assert.ok(called.length > 0, 'the handler calls the db layer');
+  const dbExports = read('modules/lifecycle/db.js');
+  const block = dbExports.slice(dbExports.lastIndexOf('module.exports'));
+  for (const fn of called) {
+    assert.ok(new RegExp(`\\b${fn}\\b`).test(block), `db.js must export ${fn} — the route calls it`);
+  }
+});
+
+await test('the db layer is untouched: no new export, no second feed function', () => {
+  // The first cut pushed the limit into db-tasks.js and exported a paged twin. It
+  // bought nothing — a SQL LIMIT is unsafe here either way, so the query does the same
+  // work — and it widened the hand-mirrored export lists in db.js/db-tasks.js until
+  // they shared a 30-line run and tripped the duplication ratchet. The wire is the
+  // thing being saved, and the route is where the wire is.
+  assert.doesNotMatch(DB_TASKS, /listClaimableTasksPaged/);
+  assert.doesNotMatch(read('modules/lifecycle/db.js'), /listClaimableTasksPaged/);
+});
+
+// ---------------------------------------------------------------------------
+// 3. the trap a SQL LIMIT would have walked into
+// ---------------------------------------------------------------------------
+
+await test('the limit is applied AFTER the JS post-filters, not as a SQL LIMIT', () => {
+  // listClaimableTasks filters twice in JS after the query returns: the autonomous
+  // runner's protected-path + membership drops, and capNewcomerTasks' display cap.
+  // `LIMIT 2` in SQL can hand back two rows that both get dropped, leaving an empty
+  // feed with claimable work sitting right behind it. Slicing the RETURNED feed is
+  // what makes the limit safe, and it is why the query is unchanged.
+  const fn = DB_TASKS.slice(
+    DB_TASKS.indexOf('async function listClaimableTasks('),
+    DB_TASKS.indexOf('function taskTouchesProtectedPath(')
+  );
+  assert.ok(fn.length > 0, 'found listClaimableTasks');
+  assert.doesNotMatch(fn, /LIMIT \$/, 'no SQL LIMIT in the claimable query');
+  assert.match(fn, /return capNewcomerTasks\(rows\);/, 'the JS post-filters still have the last word');
+  const routeFrom = ROUTE.indexOf("router.get('/tasks/claimable'");
+  const routeBody = ROUTE.slice(routeFrom, ROUTE.indexOf('res.json({ claimable', routeFrom));
+  assert.match(routeBody, /feed\.slice\(0, claimLimit\)/, 'the slice happens on the finished feed');
+});
+
+// ---------------------------------------------------------------------------
+// 4. what the reader sees
+// ---------------------------------------------------------------------------
+
+await test('the foot names the queue the two rows came off', () => {
+  assert.match(WIDGETS_JS, /id="home-next-foot"/, 'the link has an id to write into');
+  assert.match(BUILDERS_JS, /See all \$\{fmtNum\(total\)\} ready work/);
+  // Silent rather than wrong when the count is missing or not larger than what is
+  // shown: "See all 2" under two rows is noise, and a guessed number is worse.
+  assert.match(BUILDERS_JS, /Number\.isFinite\(total\) && total > rows\.length/);
+});
+
+summary();

package/tests/my_projects_surface.mjs

@@ -0,0 +1,112 @@
+// tests/my_projects_surface.mjs
+//
+// GUARD (task 1003448): pins the three answers the "/my-projects is unreachable"
+// audit finding actually has, so that none of them is a claim in a session log
+// that the next reader has to take on faith.
+//
+// The audit (2026-08-30) reported the hall's my-projects page as unreachable and
+// ungated, and flagged the second half as "NOT CONFIRMED AS A LEAK — check the
+// API gates first, then decide whether the fix is a gate, a nav entry, or both".
+// By the time the task was worked, the answer to "a gate or a nav entry" had
+// become "neither":
+//
+//   1. WHERE THE PAGE WENT. Task 1003308 deleted it on an owner decision — "my
+//      projects" is a user-level page the hub already owns, so the hall ships no
+//      page, no link and no redirect. A nav entry would reverse that decision and
+//      a page gate would guard a URL that resolves to no file. (The deletion
+//      itself is pinned by tests/hall_settings_world.mjs; the gate map's row for
+//      it by tests/hall_page_gate_map.mjs.)
+//   2. WHETHER ANYTHING LEAKED. No: every /my-projects* route is sign-in-gated
+//      and reads the caller's OWN identity off the session. This is the half the
+//      audit could not confirm, so it is asserted here rather than described.
+//   3. WHAT IS STILL MISSING. The invitations half has no caller anywhere — no
+//      surface fetches the invite list, so a builder holding an invitation still
+//      cannot act on it. That is tracked work (task 1002970, idea 1000903), and
+//      pinning it keeps a known gap from decaying back into an unknown one.
+//
+// Static reads only (no import of the app, no DB) → runs in the `unit` gate.
+//
+// Run:  node --test --test-reporter=tap tests/my_projects_surface.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+const ROUTES = 'modules/platform-identity/routes/my-projects.js';
+
+// ── 1. the page is gone from the hall, by decision ──────────────────────────
+// Kept to the ONE fact this file's other assertions lean on: there is no hall
+// page, so "unreachable from the hall" is a decision to honour and not a defect
+// to fix. tests/hall_settings_world.mjs owns the full deletion pin.
+test('the hall ships no my-projects page, so there is nothing to link or gate', () => {
+  const dir = path.join(ROOT, 'modules/hall-ui/public');
+  const strays = fs.readdirSync(dir).filter((f) => f.startsWith('my-projects'));
+  assert.deepEqual(strays, [],
+    'task 1003308 removed the hall page (the hub owns "my projects") — if it is back, that decision changed and this file, the nav and the page gate all need revisiting');
+});
+
+// ── 2. the "not confirmed as a leak" half, confirmed ────────────────────────
+// The audit's worry was a shell served to anyone who asked. The shell is gone,
+// but the routes behind it outlived it, so the gate is what matters now.
+const MY_PROJECTS_ROUTES = [
+  "router.get('/my-projects'",
+  "router.post('/my-projects/join'",
+  "router.get('/my-projects/invites'",
+  "router.post('/my-projects/invites/:clientId/accept'",
+  "router.post('/my-projects/invites/:clientId/decline'",
+  "router.post('/my-projects/:clientId/leave'",
+];
+
+test('every /my-projects route is sign-in gated', () => {
+  const src = read(ROUTES);
+  for (const decl of MY_PROJECTS_ROUTES) {
+    const at = src.indexOf(decl);
+    assert.notEqual(at, -1, `${decl} — route missing; this list is stale`);
+    // The gate is the argument immediately after the path, so read the rest of
+    // that line rather than the whole file: a requireBuilder somewhere else in
+    // the module must not vouch for a route that carries no gate of its own.
+    const line = src.slice(at, src.indexOf('\n', at));
+    assert.match(line, /,\s*requireBuilder\s*,/,
+      `${decl} must carry requireBuilder — an ungated route here exposes cross-project membership`);
+  }
+});
+
+test('every /my-projects handler reads the caller identity from the session', () => {
+  // The gate only proves SOMEONE is signed in. What keeps one builder out of
+  // another's projects is that the github_id comes off req.builder and is never
+  // accepted from the caller — no :githubId param, no body-supplied account.
+  const src = read(ROUTES);
+  assert.ok(src.includes('req.builder.github_id'), 'identity must come off the session');
+  assert.doesNotMatch(src, /\/my-projects[^']*:githubId/,
+    'no /my-projects route may take an account id as a path parameter');
+  assert.doesNotMatch(src, /githubId:\s*(?:req\.body|req\.query)/,
+    'no /my-projects handler may take the account id from the request body or query');
+});
+
+// ── 3. the gap that is left, named and tracked ─────────────────────────────
+test('the invitations API still has no caller — the tracked gap, pinned', () => {
+  // Deliberately asserts a MISSING feature. Task 1003308 removed the only
+  // surface that fetched invitations, so a builder who holds one has nowhere to
+  // accept or decline it. Task 1002970 (blocked on task 1002969) and idea
+  // 1000903 own the replacement; this pin exists so the gap stays visible until
+  // one of them lands, and so it is impossible to close this quietly.
+  const surfaces = [];
+  const modules = path.join(ROOT, 'modules');
+  for (const key of fs.readdirSync(modules)) {
+    const pub = path.join(modules, key, 'public');
+    if (!fs.existsSync(pub)) continue;
+    for (const f of fs.readdirSync(pub)) {
+      if (!/\.(js|html)$/.test(f)) continue;
+      if (fs.readFileSync(path.join(pub, f), 'utf8').includes('/my-projects/invites')) {
+        surfaces.push(`modules/${key}/public/${f}`);
+      }
+    }
+  }
+  assert.deepEqual(surfaces, [],
+    `an invitations surface exists now (${surfaces.join(', ')}) — good: delete this pin and close task 1002970 / idea 1000903`);
+});