@bongos/core 1.19.772 → 1.19.773

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.772",
-  "core_contract": "1.19.772",
-  "source_commit": "b760a843bd9ef9990658204a899ecdfbbb21984a",
+  "core_version": "1.19.773",
+  "core_contract": "1.19.773",
+  "source_commit": "a58cd0e0635965862bd715269833ceeb95f75229",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T15:47:40.573Z",
+  "built_at": "2026-09-16T15:57:38.889Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2129,
+    "functional_verbatim": 2131,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2637,
-  "tree_sha256": "42385d02b98d9325f196149f21e9a2fd17b345ea9deee3d2d8282ea0cfc7d76b",
+  "file_count": 2639,
+  "tree_sha256": "abe2f27e82d25368e2b9a578270d5b71dd9eb1a14e1f130be4ded50be1cbeb11",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f9b63223f5f1b08e1289d0e4c7161e15d0622ee0d35420e896c924fe9ec71118"
+      "sha256": "8e08eec750e9c463fc5bc71fd41fbedb782cc7f5a19f4ae735d1af390754bf6e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5477,7 +5477,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "381e3bf734537972e33bc7ca3f23097f3f264f42bf33d29cb0c5378b01459c68"
+      "sha256": "b26ba2c82bea0ee71e3db888bf531cee605aac90fa5ded2bcffe548cce650f4f"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5492,7 +5492,7 @@
     {
       "path": "modules/lifecycle/dead-deps.js",
       "mode": "0000644",
-      "sha256": "e083c4849b4f2e9e7fe25d6c0e7857c15412b7308bca7f5a8f74e71b5c36df84"
+      "sha256": "e379969ef290aab09abeef50f2e4996e2df2fa16e6d4ea9fbd268e23518b3147"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -5774,6 +5774,11 @@
       "mode": "0000644",
       "sha256": "9299590b71b194087174ff0212dc70f5f28fbafd5678923c81a3db13c6b78db5"
     },
+    {
+      "path": "modules/lifecycle/task-list-limits.js",
+      "mode": "0000644",
+      "sha256": "923a8116ce5ee7965a26d5d8534cbe4d19de52fbf9c4ea92d1f25d2f9eb6180b"
+    },
     {
       "path": "modules/lifecycle/task-recommendations.js",
       "mode": "0000644",
@@ -7577,12 +7582,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "eb46c35abaa5066936ca26fc582b1d89c48ba1d7f19ae954fcde8958e3f1b855"
+      "sha256": "44af4cb0a2f98b8943466ce51e7c00c534aa64c1eb345bf2c231a3c605a1eb40"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "097af55c66444a76588929a7bbdbc939325afaf82e405f241292b9bb0d3d75ac"
+      "sha256": "f627191fb5139a43b5d8e728d3d924e7f0316a00f104e5b5a615bd1be15599c2"
     },
     {
       "path": "public-docs/index.html",
@@ -7692,7 +7697,7 @@
     {
       "path": "scripts/gds/audit-deps.js",
       "mode": "0000644",
-      "sha256": "f0905213e5e8ba18ea4c3eab7e11bb7c00401a5653ac00990be15c65f361959d"
+      "sha256": "891aadcbea8ef257f68f20f140fa988c45ac06d4caa19802136c372d403db7ba"
     },
     {
       "path": "scripts/gds/audit-exports.js",
@@ -8772,7 +8777,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "4cb2edc48eb4a5693af7b63485ca9fe3cee2caa8cbbd86e3bd4b03d5b1f345dc"
+      "sha256": "ebf0f8c4e2dd7464e255c16ff1c0484acbb1a4e1047f64f08994950004a0ca3d"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -8827,7 +8832,7 @@
     {
       "path": "scripts/gds/ship-resume.js",
       "mode": "0000644",
-      "sha256": "20b91c52c75fae6355165941d1467081424614d46063f87137870ef291d442b9"
+      "sha256": "f86f6e8c0e9e45b7f6d8720a82cf0058f4142fa51c47cad628d47c92de817f2e"
     },
     {
       "path": "scripts/gds/ship-session-upload.js",
@@ -9417,7 +9422,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "99de59a938b51c3c1696a2b9396e55a7a819104d7e5c523d44fb965f4476a9f6"
+      "sha256": "47d80453ed17576c4c45c70e07de63093d4d4e420d266b634b07bddb62faf115"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12692,7 +12697,7 @@
     {
       "path": "tests/ship_resume.mjs",
       "mode": "0000644",
-      "sha256": "e5305fa140de31d7e646e328b4a3956f845f62b335bf14285a91cc38a20f8e0f"
+      "sha256": "68c8f499281fc99cce68c6abf63eba2b5221eca3bd0edb05158b2e7d46a404e9"
     },
     {
       "path": "tests/ship_smoke_gate.mjs",
@@ -12914,6 +12919,11 @@
       "mode": "0000644",
       "sha256": "bc89502f571659477178d68047098cf6098030491ac5c5a82b46802474a48387"
     },
+    {
+      "path": "tests/task_list_paging.mjs",
+      "mode": "0000644",
+      "sha256": "989f26372c7236e84601609966149133bae43f889084b153ea8c3d6b365b58c0"
+    },
     {
       "path": "tests/task_merge.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2018,5 +2018,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.770 with no explicit bump. run 35116254725. (task 1002620)
   1.19.772 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.771 with no explicit bump. run 35117652607. (task 1002620)
+  1.19.773 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.772 with no explicit bump. run 35118731311. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-tasks.js

@@ -715,7 +715,13 @@ async function listTasks({ versionId, status, kind, discipline, goalId, createdB
             pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
        FROM tasks t` +
     (where.length ? ` WHERE ${where.join(' AND ')}` : '') +
-    ` ORDER BY priority NULLS LAST, created_at`;
+    // `id` is the tiebreak, not decoration (task 1003752): `priority, created_at`
+    // is not a TOTAL order — a planning session seeds many tasks inside one
+    // transaction, so they share both a priority and a created_at — and under
+    // LIMIT/OFFSET paging an undefined order between two rows can show the same
+    // row on two pages and no page at all to another. Same rule, same reason, as
+    // `ORDER BY started_at DESC NULLS LAST, id` in pickDefaultVersion.
+    ` ORDER BY priority NULLS LAST, created_at, t.id`;
   // BOUND, not interpolated. Both call sites validate to a finite non-negative
   // integer today, so string interpolation would not be exploitable — but a
   // query builder that is only safe because of who happens to call it is one

package/modules/lifecycle/dead-deps.js

@@ -72,8 +72,16 @@ function deadDepHint(deps, taskId = null) {
 // gated by an abandoned dependency? `tasks` are rows carrying { id, status,
 // title, blocked_by: [{ id, status, title }] } — the GET /tasks?include=deps
 // shape. A dependent that is itself terminal is NOT stranded (nothing is
-// waiting), which is why the live corpus reports zero today even though 17
-// abandoned tasks still carry dependents. Pure + exported for tests.
+// waiting) — which is the whole reason the count stays small.
+//
+// This comment used to say the live corpus 'reports zero today'. Nothing had
+// ever measured that: the only caller, audit-deps.js --stranded, asked for
+// limit=3000 against a route cap of 1000 and so 400'd on every run it ever
+// made (task 1003752). The first real measurement, once it could run, was
+// 2026-09-16: 3611 tasks scanned, ONE live task stranded (1001702, behind
+// abandoned 1001523), and 57 — not 17 — abandoned tasks still carrying
+// dependents. Treat any count written in this header as the date it carries,
+// not as a standing fact. Pure + exported for tests.
 const LIVE_STATUSES = new Set(['backlog', 'ready', 'active', 'blocked']);
 
 function findStrandedTasks(tasks) {

package/modules/lifecycle/task-list-limits.js

@@ -0,0 +1,44 @@
+'use strict';
+
+// modules/lifecycle/task-list-limits.js — the GET /tasks page bound, declared
+// once (task 1003752).
+//
+// THE DEFECT THIS EXISTS FOR. The cap was a bare `1000` inside the route and the
+// page size was a bare `3000` inside a script, and nothing connected them. So
+// `audit-deps.js --stranded` asked for 3000 against a cap of 1000 and every run
+// 400'd before reading a single task — for months, silently, because the only
+// thing that looks for tasks stranded behind an abandoned dependency could not
+// start. A number two files must agree on, written twice, is a bug waiting for
+// one of them to move; the task-status.js precedent applies here too.
+//
+// TWO THINGS A PAGER MUST KNOW, both learned the hard way on task 1003752:
+//
+//   1. `limit` is capped at TASK_LIST_MAX_LIMIT. Asking for more is a 400, not a
+//      silent clamp — so a caller that wants the whole table must PAGE, and the
+//      corpus is already well past one page (3610 rows on 2026-09-16).
+//
+//   2. `offset` must be STRICTLY POSITIVE. The route validates it with the same
+//      positive-integer helper as `limit`, so `offset=0` is rejected as
+//      `bad_offset` — the naive `offset = page * pageSize` pager 400s on its
+//      very first request. The first page must omit `offset` entirely, and
+//      buildTaskPageQuery() below is the one place that knows this.
+
+// The largest `limit` GET /tasks (and GET /tasks/claimable) will accept. The cap
+// is the point of the parameter: an unbounded limit is the whole-table read this
+// axis exists to stop.
+const TASK_LIST_MAX_LIMIT = 1000;
+
+// The query object for one page of a full-corpus read. Clamps `limit` to the cap
+// — a caller asking for more gets a page it can actually have rather than a 400
+// — and omits `offset` on the first page, because 0 is not a positive integer
+// and the route says so.
+function buildTaskPageQuery({ limit = TASK_LIST_MAX_LIMIT, offset = 0, ...rest } = {}) {
+  const asked = Number(limit);
+  const size = Number.isFinite(asked) && asked > 0 ? Math.min(asked, TASK_LIST_MAX_LIMIT) : TASK_LIST_MAX_LIMIT;
+  const q = { ...rest, limit: size };
+  const skip = Number(offset);
+  if (Number.isFinite(skip) && skip > 0) q.offset = skip;
+  return q;
+}
+
+module.exports = { TASK_LIST_MAX_LIMIT, buildTaskPageQuery };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.772",
+  "version": "1.19.773",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.772",
+      "version": "1.19.773",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.772",
+  "version": "1.19.773",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/audit-deps.js

@@ -25,6 +25,8 @@ const { resolveDefaultVersion } = require('./version-select.js');
 // task 1003153 — the DEAD-edge detector core, shared with the claim refusal so
 // "abandoned dependency" means one thing across the CLI, the route and this audit.
 const { findStrandedTasks } = require('../../modules/lifecycle/dead-deps.js');
+// task 1003752 — the route's page bound + the first-page offset rule, declared once.
+const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
 
 // Lifecycle statuses that count as "open" (auditable) vs "an unshipped blocker".
 const OPEN = new Set(['ready', 'backlog', 'active', 'blocked']);
@@ -81,6 +83,34 @@ function findMissingDeps(tasks, { open = OPEN, isBlocker = isUnshippedBlocker }
   return out;
 }
 
+// Read the WHOLE task corpus, one allowed page at a time (task 1003752). This
+// was a single `limit: 3000` read, which GET /tasks caps at TASK_LIST_MAX_LIMIT
+// (1000) — so it 400'd on every run and the detector below never saw a single
+// task. Paging is not a nicety here: the corpus passed one page long ago (3610
+// rows on 2026-09-16), so even a legal `limit: 1000` would silently UNDER-read,
+// which in a detector is the same failure wearing a success exit code.
+//
+// `getPage(query)` is injected rather than closed over so the loop is testable
+// with no API; it returns the { ok, status, data } shape cliClient gives back.
+// Dedupes by id: listTasks orders by `priority NULLS LAST, created_at, id`, so
+// pages are stable — but a detector whose whole job is surfacing rows nobody
+// can see must not be the thing that loses one.
+async function fetchAllTasks(getPage, { query = {}, pageSize = TASK_LIST_MAX_LIMIT, maxPages = 100 } = {}) {
+  const byId = new Map();
+  let offset = 0;
+  for (let page = 0; page < maxPages; page++) {
+    const q = buildTaskPageQuery({ ...query, limit: pageSize, offset });
+    const r = await getPage(q);
+    if (!r || !r.ok) throw new Error(`HTTP ${r && r.status}`);
+    const rows = (r.data && r.data.tasks) || [];
+    for (const t of rows) byId.set(String(t.id), t);
+    // A short page is the end of the table. Compare against the CLAMPED size
+    // the route actually honoured, never the size the caller asked for.
+    if (rows.length < q.limit) return [...byId.values()];
+    offset += q.limit;
+  }
+  throw new Error(`more than ${maxPages} pages of tasks — refusing to loop forever`);
+}
 // --stranded (task 1003153): the INVERSE audit. findMissingDeps asks "which edge
 // is MISSING"; this asks "which existing edge is DEAD" — a live task gated by an
 // ABANDONED dependency. That edge can never satisfy (an abandoned task can never
@@ -91,9 +121,13 @@ function findMissingDeps(tasks, { open = OPEN, isBlocker = isUnshippedBlocker }
 // Exits 1 when anything is stranded, so a sweep or CI leg can gate on it.
 async function reportStranded({ asJson }) {
   const api = await cliClient();
-  const r = await api.tasks.getTasks({ query: { include: 'deps', limit: 3000 } });
-  if (!r.ok) { console.error(`audit-deps: could not list tasks (${r.status})`); process.exit(1); }
-  const all = r.data.tasks || [];
+  let all;
+  try {
+    all = await fetchAllTasks((query) => api.tasks.getTasks({ query }), { query: { include: 'deps' } });
+  } catch (e) {
+    console.error(`audit-deps: could not list tasks (${e.message})`);
+    process.exit(1);
+  }
   const stranded = findStrandedTasks(all);
 
   // Context worth stating even at zero: abandoned tasks that still CARRY
@@ -174,7 +208,7 @@ async function main() {
   console.log('NB: advisory only. Backfill `high` edges by hand (POST /tasks/:id/dependencies) after reading both tasks; a wrong edge gates the dependent.');
 }
 
-module.exports = { findMissingDeps, classify, OPEN, isUnshippedBlocker, HOTSPOTS, reportStranded };
+module.exports = { findMissingDeps, classify, OPEN, isUnshippedBlocker, HOTSPOTS, reportStranded, fetchAllTasks };
 
 if (require.main === module) {
   main().catch((e) => { console.error('audit-deps:', e.message); process.exit(1); });

package/scripts/gds/ship-flow.js

@@ -865,7 +865,16 @@ async function regradeMain() {
     // nothing to read, so there is no verdict to dodge. Confirming is additionally
     // permission-gated server-side on task.confirm.grade_bypass, so this widens
     // no authority — it only stops the ONE shape that had no exit at all.
-    if (shouldConfirmWithoutGrade({ committedFileCount: committedFiles.length, args })) {
+    // task 1003944: the porcelain is MEASURED here and handed to the decision, so a
+    // re-grade weighs the same evidence a first ship does. Without it the guard saw
+    // only the flag and the (empty) committed diff, and an UNTRACKED deliverable —
+    // invisible to preflight's trackedDirty — confirmed straight through to shipped.
+    const emptyShip = shouldConfirmWithoutGrade({
+      committedFileCount: committedFiles.length,
+      porcelain: gitOk('git status --porcelain'),
+      args,
+    });
+    if (emptyShip.confirm) {
       console.log('');
       console.log(`Nothing to grade (the committed diff vs ${graderBaseline || 'baseline'} is empty) and this ship`);
       console.log('declares itself artifact-free — manual-confirming via POST /tasks/:id/confirm.');
@@ -906,6 +915,19 @@ async function regradeMain() {
       });
       return;
     }
+    // task 1003944: the two refusals are DIFFERENT advice. 'uncommitted-work' means
+    // the deliverable exists and was never committed — offering --allow-empty there
+    // would be telling the builder to assert the opposite of what the tree shows,
+    // which is how task 1363 shipped nothing and called it done. Only the genuinely
+    // clean tree gets pointed at the flag.
+    if (emptyShip.reason === 'uncommitted-work') {
+      console.error('Nothing to grade: nothing is committed on this branch, but your working tree has uncommitted changes:');
+      for (const f of emptyShip.uncommitted) console.error(`    - ${f}`);
+      console.error('');
+      console.error('Your work was never committed — confirming now would mark the task "shipped" with NO artifact on main (the ledger would lie).');
+      console.error('Stage + commit your work (e.g. `git add -A && git commit`), then re-run --regrade.');
+      process.exit(1);
+    }
     console.error(`Nothing to grade: the committed diff vs ${graderBaseline || 'baseline'} is empty.`);
     console.error('The grader reads committed history, not the working tree — commit your fixes on this branch, then re-run --regrade.');
     console.error('If this task is DELIBERATELY artifact-free (a DB-only close, an ops verification), say so:');

package/scripts/gds/ship-resume.js

@@ -9,6 +9,7 @@
 'use strict';
 
 const { cliClient } = require('./cli-lib');
+const { classifyEmptyShip } = require('../../modules/lifecycle/ship-preflight');
 const { preflight } = require('./ship-preflight-steps.js');
 const { playShipBell } = require('./ship-io.js');
 const { strandNextStep } = require('./ship-land.js');
@@ -121,10 +122,37 @@ function evaluateResumeAction({ task, lastClaim, builder }) {
 // A bare re-run (neither flag) keeps dead-ending, deliberately: the overwhelmingly
 // common cause of an empty diff is uncommitted work, and silently confirming that
 // would ship nothing while reporting success.
-function shouldConfirmWithoutGrade({ committedFileCount, args = [] }) {
-  const emptyDiff = Number(committedFileCount) === 0;
-  const declaredNoArtifact = args.includes('--allow-empty') || args.includes('--skip-grade');
-  return emptyDiff && declaredNoArtifact;
+//
+// task 1003944 — THE FIRST CUT ASKED THE WRONG TWO QUESTIONS, and both answers let
+// the task-1363 phantom ship back in on this path:
+//
+//   (a) It never looked at the WORKING TREE. The only tree check a re-grade runs is
+//       preflight(), which uses trackedDirty and — by its own comment — deliberately
+//       ignores UNTRACKED files. So a deliverable that was never `git add`ed is
+//       invisible to both, and `--allow-empty` confirmed it, awarded credits, and
+//       (via finishShip's hardcoded dbOnly) landed the row at SHIPPED with HEAD
+//       never moved. That is task 1363 exactly: the ledger lying, CLAUDE.md §8.
+//       classifyEmptyShip already states the rule this violated — a dirty tree
+//       refuses EVEN UNDER --allow-empty, because the flag asserts there is no
+//       artifact and the tree proves there is one.
+//
+//   (b) It accepted `--skip-grade` as the declaration. That flag declares nothing
+//       about artifacts — ship.js's usage block documents it as a grader-outage
+//       override, "NOT a routine flag" — and task 1365 had already REMOVED it from
+//       the first-ship empty-diff decision for precisely that reason. Task 1003146's
+//       recovery is unaffected: `--allow-empty` is the flag both refusal messages
+//       prescribe, and it still works.
+//
+// So this no longer carries a second, weaker copy of the rule: it hands the
+// measured tree to classifyEmptyShip — the SAME function the first ship calls — and
+// returns its verdict, so the two paths cannot drift apart again. `porcelain` is
+// `git status --porcelain` output, passed in by the caller to keep this pure.
+// `reason` is classifyEmptyShip's ('uncommitted-work' | 'nothing-to-ship' |
+// 'allow-empty'), plus 'has-diff' when there is real committed work to grade.
+function shouldConfirmWithoutGrade({ committedFileCount, porcelain = '', args = [] }) {
+  if (Number(committedFileCount) !== 0) return { confirm: false, reason: 'has-diff', uncommitted: [] };
+  const verdict = classifyEmptyShip(porcelain, { allowEmpty: args.includes('--allow-empty') });
+  return { confirm: !verdict.refuse, reason: verdict.reason, uncommitted: verdict.uncommitted || [] };
 }
 
 // task 941: resume a `confirmed`-but-unshipped task — the merge/deploy leg only

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.772'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.773'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ship_resume.mjs

@@ -133,25 +133,88 @@ test('completed + owner with low rank still resumes (ownership, not rank)', () =
 // 'completed' task into the re-grade before reading a flag. The manual-confirm
 // path a no-artifact task needs is unreachable from 'completed' any other way.
 
-test('empty diff + --allow-empty → confirm instead of bailing (the 1003146 shape)', () => {
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--allow-empty'] }), true);
-});
-
-test('empty diff + --skip-grade → confirm (the other documented no-artifact flag)', () => {
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--skip-grade'] }), true);
+test('empty diff + --allow-empty + a CLEAN tree → confirm instead of bailing (the 1003146 shape)', () => {
+  const v = shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: '', args: ['1003146', '--allow-empty'] });
+  assert.equal(v.confirm, true);
+  assert.equal(v.reason, 'allow-empty');
 });
 
 test('a REAL diff + --allow-empty still grades — the flag is not a grader bypass', () => {
   // The hole this guard exists to avoid: if a declaration alone were enough, a task
   // whose grade FAILED could dodge the verdict by re-running with --allow-empty.
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 3, args: ['1003146', '--allow-empty'] }), false);
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 1, args: ['1003146', '--skip-grade'] }), false);
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 3, porcelain: '', args: ['1003146', '--allow-empty'] }).confirm, false);
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 1, porcelain: '', args: ['1003146', '--allow-empty'] }).reason, 'has-diff');
 });
 
 test('empty diff with NO flag keeps dead-ending — uncommitted work must not "ship"', () => {
   // The overwhelmingly common cause of an empty diff is forgetting to commit.
   // Confirming that silently would report success having shipped nothing.
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146'] }), false);
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: '', args: ['1003146'] }).confirm, false);
+});
+
+// ---- task 1003944: the same guard had re-opened the task-1363 phantom ship ----
+// The first cut asked only "is the diff empty?" and "was a flag passed?", which is
+// strictly WEAKER than the decision the FIRST-ship path makes at the same moment.
+// Two consequences, both reachable in one command, both fixed here.
+
+test('an UNTRACKED deliverable is refused even under --allow-empty (task 1363)', () => {
+  // The whole point of task 1363: a new file left untracked is invisible to
+  // preflight (trackedDirty ignores untracked), so this decision was the ONLY thing
+  // standing between "you forgot to commit" and a row marked shipped with HEAD
+  // never moved. --allow-empty asserts there is no artifact; the tree proves there
+  // is one, and the tree wins.
+  const v = shouldConfirmWithoutGrade({
+    committedFileCount: 0, porcelain: '?? docs/the-deliverable.md', args: ['1003146', '--allow-empty'],
+  });
+  assert.equal(v.confirm, false, 'an untracked deliverable must never manual-confirm');
+  assert.equal(v.reason, 'uncommitted-work');
+  assert.deepEqual(v.uncommitted, ['docs/the-deliverable.md'], 'and the builder is told WHICH file');
+});
+
+test('a tracked-but-uncommitted edit is refused under --allow-empty too', () => {
+  const v = shouldConfirmWithoutGrade({
+    committedFileCount: 0, porcelain: ' M scripts/gds/ship.js', args: ['1003146', '--allow-empty'],
+  });
+  assert.equal(v.confirm, false);
+  assert.equal(v.reason, 'uncommitted-work');
+});
+
+test('--skip-grade is NOT an artifact declaration — it declares nothing about artifacts', () => {
+  // ship.js documents it as a grader-outage override, "NOT a routine flag", and
+  // task 1365 removed it from the first-ship empty-diff decision for exactly this
+  // reason. Accepting it here re-opened the half of task 1363 that fix had closed.
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: '', args: ['1003146', '--skip-grade'] }).confirm,
+    false, '--skip-grade must not confirm an empty ship on its own');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: '', args: ['1003146', '--skip-grade', '--allow-empty'] }).confirm,
+    true, 'but it must not BLOCK a properly declared one either');
+});
+
+test('the refusal names the PATH, not the porcelain status codes', () => {
+  // A rename line is "R  old -> new" and a quoted path is wrapped in "…". The
+  // builder has to be told which file to commit, so the reported name must be the
+  // path. (.gitignored files never reach here at all: `git status --porcelain`
+  // omits them unless --ignored is passed, which the call site does not pass — the
+  // call-site test below pins the exact command.)
+  const v = shouldConfirmWithoutGrade({
+    committedFileCount: 0, porcelain: 'R  docs/old.md -> docs/new.md\n?? "docs/a b.md"', args: ['1003146', '--allow-empty'],
+  });
+  assert.equal(v.confirm, false);
+  assert.deepEqual(v.uncommitted, ['docs/new.md', 'docs/a b.md']);
+});
+
+test('the re-grade decision and the FIRST-ship decision agree on the same tree', () => {
+  // The defect was a second, weaker copy of one rule. This asserts they are the
+  // same rule: for every tree, the re-grade verdict must equal what classifyEmptyShip
+  // — the function the first ship calls — says about it. A re-divergence reds here.
+  const { classifyEmptyShip } = require('../modules/lifecycle/ship-preflight');
+  for (const porcelain of ['', '?? docs/new.md', ' M scripts/gds/ship.js', '!! node_modules/x', 'A  a.js\n?? b.js']) {
+    for (const args of [['--allow-empty'], []]) {
+      const first = classifyEmptyShip(porcelain, { allowEmpty: args.includes('--allow-empty') });
+      const resume = shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain, args });
+      assert.equal(resume.confirm, !first.refuse, `divergence on ${JSON.stringify(porcelain)} ${JSON.stringify(args)}`);
+      assert.equal(resume.reason, first.reason, `reason divergence on ${JSON.stringify(porcelain)}`);
+    }
+  }
 });
 
 test('the empty-diff guard is actually WIRED to the decision, not just exporting it', () => {
@@ -171,10 +234,21 @@ test('the empty-diff guard is actually WIRED to the decision, not just exporting
     'and reaching it must land on the manual-confirm route a no-artifact task needs');
 });
 
+test('the call site MEASURES the working tree — the truth table alone cannot prove this', () => {
+  // task 1003944, and the reason this assertion is separate from the wiring test
+  // above: `porcelain` DEFAULTS to '' — a clean tree. Drop the argument at the call
+  // site and every truth-table case above stays green while the real ship goes back
+  // to confirming untracked work. The evidence has to be shown to be COLLECTED.
+  const src = shipCliSource();
+  assert.match(src, /shouldConfirmWithoutGrade\(\{[^}]*porcelain:\s*gitOk\('git status --porcelain'\)/,
+    'the re-grade guard must pass the REAL `git status --porcelain`, not fall back to the clean-tree default');
+});
+
 test('shouldConfirmWithoutGrade: defaults and odd inputs never throw', () => {
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0 }), false, 'no args → no declaration');
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: '0', args: ['--allow-empty'] }), true, 'a numeric string still counts as empty');
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: undefined, args: ['--allow-empty'] }), false, 'an unknown count is not an empty one');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0 }).confirm, false, 'no args → no declaration');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: '0', args: ['--allow-empty'] }).confirm, true, 'a numeric string still counts as empty');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: undefined, args: ['--allow-empty'] }).confirm, false, 'an unknown count is not an empty one');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: null, args: ['--allow-empty'] }).confirm, true, 'a null porcelain reads as a clean tree');
 });
 
 console.log('');

package/tests/task_list_paging.mjs

@@ -0,0 +1,178 @@
+// tests/task_list_paging.mjs — the GET /tasks page bound, and the pager that
+// has to respect it (task 1003752).
+//
+// THE BUG THIS PINS. audit-deps.js --stranded asked for `limit: 3000` against a
+// route that caps `limit` at 1000. Every run 400'd before reading one task, so
+// the ONLY detector for work stranded behind an abandoned dependency had never
+// once produced a result — silently, for months, because a 400 on a read looks
+// exactly like a clean report to anyone not reading the exit code.
+//
+// So this file covers the CLASS, not just the instance:
+//   - the cap the route enforces and the page size the client asks for are held
+//     equal, so they cannot drift apart again (routes/tasks.js is a NEEDS_TRUST
+//     gate surface and the route was never the bug, so the pin lives here);
+//   - the fake here enforces the route's real rules (cap, and `offset` must be
+//     strictly positive — `offset=0` is a 400, the landmine under every naive
+//     `page * size` pager), so a pager that would 400 in production fails here;
+//   - the pager is driven with MORE than one page of rows, because a limit bug
+//     is invisible against a fixture that fits in a single page.
+//
+// Hermetic: no DB, no API, no network. Run: node tests/task_list_paging.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../modules/lifecycle/task-list-limits.js');
+const { fetchAllTasks } = require('../scripts/gds/audit-deps.js');
+
+let passed = 0, failed = 0;
+const t = async (n, f) => {
+  try { await f(); passed++; console.log(`  PASS  ${n}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); }
+};
+
+// A stand-in for GET /tasks that refuses everything the real route refuses.
+// `rows` is the whole corpus; the fake slices it the way listTasks does.
+function fakeRoute(rows, { cap = TASK_LIST_MAX_LIMIT } = {}) {
+  const calls = [];
+  const get = async (query) => {
+    calls.push({ ...query });
+    const { limit, offset } = query;
+    // routes/tasks.js: posInt(limitRaw, 'bad_limit', cap)
+    if (limit === undefined || !Number.isInteger(limit) || limit <= 0 || limit > cap) {
+      return { ok: false, status: 400, data: { error: { code: 'bad_limit' } } };
+    }
+    // routes/tasks.js: posInt(offsetRaw, 'bad_offset') — POSITIVE, so 0 is bad.
+    if (offset !== undefined && (!Number.isInteger(offset) || offset <= 0)) {
+      return { ok: false, status: 400, data: { error: { code: 'bad_offset' } } };
+    }
+    const start = offset || 0;
+    return { ok: true, status: 200, data: { tasks: rows.slice(start, start + limit) } };
+  };
+  return { get, calls };
+}
+
+const corpus = (n, from = 1) => Array.from({ length: n }, (_, i) => ({ id: from + i, status: 'ready' }));
+
+// ---------------------------------------------------------------- the cap
+
+await t('the shared cap is the number the route actually enforces', () => {
+  const routeSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+
+  // routes/tasks.js is a NEEDS_TRUST gate surface, so this fix does not edit it
+  // — the route was never wrong, the client was. That leaves the cap written in
+  // two files, which is what let them drift in the first place, so the drift is
+  // pinned HERE instead: change the cap in the route and this test reds until
+  // task-list-limits.js is changed to match.
+  //
+  // Both reads are guarded against going blind. A source scan fails by quietly
+  // matching nothing, and a green test over a pattern that no longer matches is
+  // a false claim of coverage, not coverage.
+  const capM = routeSrc.match(/posInt\(limitRaw, 'bad_limit', (\d+)\)/);
+  assert.ok(capM, 'BLIND SCAN: the GET /tasks limit cap no longer matches this pattern — fix the pattern, do not delete the test');
+  assert.equal(Number(capM[1]), TASK_LIST_MAX_LIMIT,
+    `route caps limit at ${capM && capM[1]} but TASK_LIST_MAX_LIMIT is ${TASK_LIST_MAX_LIMIT} — the pager will 400 or under-read`);
+
+  // The 400 message is what a human debugging this actually reads, so it has to
+  // carry the same number the validator enforces.
+  const msgM = routeSrc.match(/limit must be a positive integer up to (\d+)\./);
+  assert.ok(msgM, 'BLIND SCAN: the bad_limit message no longer matches this pattern');
+  assert.equal(Number(msgM[1]), TASK_LIST_MAX_LIMIT, 'the error message must quote the cap it enforces');
+
+  // And `offset` must still be the STRICTLY-positive validator the pager is
+  // built around — if the route ever starts accepting offset=0, the first-page
+  // special case below becomes dead weight rather than a requirement.
+  assert.match(routeSrc, /posInt\(offsetRaw, 'bad_offset'\)/,
+    'offset is validated with no cap and must stay positive-only — buildTaskPageQuery depends on it');
+});
+
+await t('no page this pager requests can exceed the route cap', async () => {
+  // The literal regression: ask for 3000, the number that 400'd for months.
+  const q = buildTaskPageQuery({ limit: 3000 });
+  assert.ok(q.limit <= TASK_LIST_MAX_LIMIT, `asked ${q.limit}, cap ${TASK_LIST_MAX_LIMIT}`);
+  const { get, calls } = fakeRoute(corpus(10));
+  await fetchAllTasks(get, { pageSize: 3000 });
+  assert.ok(calls.length > 0, 'the fake must actually have been called');
+  for (const c of calls) {
+    assert.ok(c.limit <= TASK_LIST_MAX_LIMIT, `page asked for limit=${c.limit}`);
+  }
+});
+
+// ------------------------------------------------------- the offset landmine
+
+await t('the FIRST page omits offset entirely (offset=0 is a 400)', () => {
+  const q = buildTaskPageQuery({ offset: 0 });
+  assert.ok(!('offset' in q), 'offset=0 must not be sent — the route rejects it');
+  assert.equal(buildTaskPageQuery({ offset: 1000 }).offset, 1000, 'a real offset is sent');
+});
+
+await t('a full-corpus read never trips bad_offset', async () => {
+  const { get, calls } = fakeRoute(corpus(2500));
+  await fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT });
+  assert.ok(!('offset' in calls[0]), 'first page must omit offset');
+  assert.ok(calls.slice(1).every((c) => c.offset > 0), 'later pages send a positive offset');
+});
+
+// --------------------------------------------------------------- the paging
+
+await t('reads EVERY row when the corpus is several pages long', async () => {
+  const rows = corpus(2500);
+  const { get, calls } = fakeRoute(rows);
+  const out = await fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT });
+  assert.equal(out.length, 2500, 'every row comes back');
+  assert.equal(new Set(out.map((r) => String(r.id))).size, 2500, 'no duplicates');
+  assert.equal(calls.length, 3, '1000 + 1000 + 500');
+});
+
+await t('an exact multiple of the page size still terminates', async () => {
+  const { get, calls } = fakeRoute(corpus(2000));
+  const out = await fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT });
+  assert.equal(out.length, 2000);
+  assert.equal(calls.length, 3, 'the third page comes back empty and ends the loop');
+});
+
+await t('a duplicated row across pages is collapsed, not double-counted', async () => {
+  // What an ordering tie does under LIMIT/OFFSET: one row served twice.
+  const rows = [...corpus(1000), ...corpus(1, 1000)];
+  const { get } = fakeRoute(rows);
+  const out = await fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT });
+  assert.equal(out.length, 1000, 'the repeat of id 1000 is deduped by id');
+});
+
+await t('the ORDER BY is a TOTAL order, so pages cannot drop a row', () => {
+  const dbSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/db-tasks.js'), 'utf8');
+  assert.match(dbSrc, /ORDER BY priority NULLS LAST, created_at, t\.id/,
+    'listTasks must tiebreak on id — priority+created_at tie inside one seeding transaction');
+});
+
+// ------------------------------------------------------------- the failures
+
+await t('a failing page THROWS rather than returning a short corpus', async () => {
+  // The original defect dressed as success: a detector that reports "nothing
+  // found" because its read failed is worse than one that crashes.
+  const get = async () => ({ ok: false, status: 400, data: {} });
+  await assert.rejects(() => fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT }), /400/);
+});
+
+await t('a mid-corpus failure does not silently truncate', async () => {
+  const rows = corpus(2500);
+  const real = fakeRoute(rows);
+  let n = 0;
+  const get = async (q) => (++n === 2 ? { ok: false, status: 500, data: {} } : real.get(q));
+  await assert.rejects(() => fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT }), /500/);
+});
+
+await t('a route that never returns a short page cannot spin forever', async () => {
+  const get = async (q) => ({ ok: true, status: 200, data: { tasks: corpus(q.limit) } });
+  await assert.rejects(() => fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT, maxPages: 5 }),
+    /refusing to loop forever/);
+});
+
+console.log(`\ntask_list_paging: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);