@bongos/core 1.19.802 → 1.19.804

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.802",
-  "core_contract": "1.19.802",
-  "source_commit": "45efc6ff51adfc6e4910c9a985eea7d6d03a55b5",
+  "core_version": "1.19.804",
+  "core_contract": "1.19.804",
+  "source_commit": "992839692e5a396ca7655a00df02413a3300b72a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T02:33:54.490Z",
+  "built_at": "2026-09-17T03:35:15.794Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 487,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2188,
+    "functional_verbatim": 2191,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2700,
-  "tree_sha256": "4ee6d59590012d183002008d4e4cc2ebacb310dc098269f77c621e2d07a90df5",
+  "file_count": 2703,
+  "tree_sha256": "773756af73632e2824a78bf24ff19e17d3c1e2c077d511030de84bda409ed684",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2522,7 +2522,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "44af03bcfe197664d948053f26ed4af87c7b6fbe1a2a341d3ba3b02439357445"
+      "sha256": "5560da3dad24d04ba192d4cbcab9f7e669ebd6ead35bde8d92a222a763289a36"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2532,7 +2532,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6d176113a1a846ac31afbcab3dfcf8125ce4b90ce2f8308dd1d00b16da96490c"
+      "sha256": "b1b8571ef8f537feeffbca2a68ee1bb71b5d127bbfcfe1a45b3a3ac0d807e717"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5052,12 +5052,12 @@
     {
       "path": "modules/hall-ui/public/people.html",
       "mode": "0000644",
-      "sha256": "5e5c99eab08f89feb05ab4db5015d6db3a78324777ffad245aa03c91a633032e"
+      "sha256": "ee7118a1d61518750d4ec105d9965a92784ad1564f7e6b75496d412b9d54be85"
     },
     {
       "path": "modules/hall-ui/public/people.js",
       "mode": "0000644",
-      "sha256": "145f767f473b11c222bde97e5de519c9eb0a9be0ddb2f75969d35dff086b3e01"
+      "sha256": "8834c3f6ec31d669dafc268ffbc12c9375e9ca4a8b00c45b164aa2d103af8db9"
     },
     {
       "path": "modules/hall-ui/public/people.states.json",
@@ -7712,12 +7712,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "34cfc2b2ac517fd72eedb774df0e1f91e182f265bd29109af0a51a172fef6ca9"
+      "sha256": "95dd4df126fd7a7617f5a1bc84c6f0ad6403d59edb377102978beab0180f0dca"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ecd677de73f7be790d92bea1d0fc1d999d9ebfc43d6098810ce255eb9cb1d395"
+      "sha256": "8cfddd30203037f279a7c1d4e5205bfcda5b464b57022c5af3db7da4ac930e70"
     },
     {
       "path": "public-docs/index.html",
@@ -7834,6 +7834,11 @@
       "mode": "0000644",
       "sha256": "36dd5165b146e52b4dfc79eccda080f57e4eb72e67f2e691d347edd09c6d617d"
     },
+    {
+      "path": "scripts/gds/artifact-staleness.js",
+      "mode": "0000644",
+      "sha256": "af1ee2128e0009edb52cce9a416a8805ed954f78b763f1825d56cc476e179daa"
+    },
     {
       "path": "scripts/gds/audit-authorship.sh",
       "mode": "0000644",
@@ -9602,7 +9607,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fdcbeb75b3f63bb495547ba048fdce05ff4956c1e1fce9a79376dcfc78109734"
+      "sha256": "8778f98197e12eaa8fc397413c13584bc079d72bedb8737ba4a7db15109bb497"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9839,6 +9844,11 @@
       "mode": "0000644",
       "sha256": "d9e4b5363224b1aaf019c2edaacb47028ac1521896f901184e805a3923fc070a"
     },
+    {
+      "path": "tests/artifact_staleness.mjs",
+      "mode": "0000644",
+      "sha256": "8eaeb56d805615a65f30a62e32dd4d180f1b61d7ac084725bc9d9bde8a1d67d5"
+    },
     {
       "path": "tests/artist_gate.mjs",
       "mode": "0000644",
@@ -12119,6 +12129,11 @@
       "mode": "0000644",
       "sha256": "6c623a5abe9aadf4821ad8ca291fb5d7805a7a5bc874bfc3cd7e51e83de289d2"
     },
+    {
+      "path": "tests/people_directory_clip.mjs",
+      "mode": "0000644",
+      "sha256": "a7d4e29162194a67e2f1b948d0522f1ecdff11218d49fbd2b9d7eb0be1cc624c"
+    },
     {
       "path": "tests/permission_path.mjs",
       "mode": "0000644",
@@ -12207,7 +12222,7 @@
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
-      "sha256": "d70924dd2ddfc4e05c4b52d9763d76b0a68cf0ed16db6ffd1b07a1834bef0890"
+      "sha256": "ac7f07f4226ed410012ee2650e1870c109d0f3eb8b9142208d8a339ebff27e6c"
     },
     {
       "path": "tests/profile_ui_cross_project.mjs",

package/docs/file-map.md

@@ -443,6 +443,7 @@ tests/
 ```
 .claude/scheduled-tasks/
 ├── artifact-audit/SKILL.md            ← weekly artifact audit (task 1003200): every task at shipped/confirmed/completed that DECLARES a code artifact is checked against main's commit messages AND the content of its tracked files — both, because a fix can land under another branch and be cited only in a comment (task 1003212). Anything unproven is filed as a blocker, deduped on the finding set. Scoped to ships on/after the ship-assurance gate (2026-08-19, ADR 0184), before which a DB-only ship recorded no declaration and silence proves nothing. FIRED BY .github/workflows/artifact-audit.yml, Mondays 06:23 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/gds/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
+├── artifact-staleness/SKILL.md        ← freshness backstop for the gitignored deploy-generated navigation docs (task 1001930, ADR 0110 pt.5): docs/repo-map.md and docs/session-log-index.md are untracked, so no PR gate can see them and a broken deploy regen step leaves a stale or missing map with only a journald line as the alarm. Asks each artifact's own generator (--check-whole) whether it still matches the served commit, reports absent and stale separately, and posts findings to Discord #ship-news itself. INSTANCE-SIDE ONLY — a fresh CI clone legitimately lacks these files, so it declares no cadence and no workflow fires it; config/scheduled-routines.json records the intended daily cadence.
 ├── bfg/SKILL.md                       ← nightly BFG pass (MAS Phase 6, ADR 0026) — doc/memory hygiene + DB counter-vs-ledger drift (Part A), per-builder interaction scoring into transferable-practice suggestions (Part B), and the audited cross-builder memory write (Part C, OFF unless BFG_WRITE_ENABLED) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── bfg-session-eval/SKILL.md          ← nightly session-inefficiency evaluator (MAS Phase 6D, ADR 0027) — mines the session corpus for wasteful sessions and files the fixes as idea_inbox rows plus a docs/audits report (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── box-dormant-reclaim/SKILL.md       ← daily control-plane sweep that fully de-provisions dev boxes parked longer than BOX_DORMANT_DAYS, destroying the leftover snapshot and pinging the builder (ADR 0031 §5(a)); a no-op on an instance with no managed boxes (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)

package/docs/module-api-changelog.md

@@ -2078,5 +2078,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.800 with no explicit bump. run 35173442594. (task 1002620)
   1.19.802 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.801 with no explicit bump. run 35174865190. (task 1002620)
+  1.19.803 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.802 with no explicit bump. run 35175617185. (task 1002620)
+  1.19.804 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.803 with no explicit bump. run 35178689663. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/people.html

@@ -39,6 +39,10 @@
           <div id="people-body">
             <div class="profile__placeholder">Loading the directory…</div>
           </div>
+          <!-- task 1003110: the clipped-directory footnote. Hidden unless the
+               response came back FULL, which is the only truncation signal the
+               rollup offers; people.js writes it. -->
+          <p class="ledger__note" id="people-foot" hidden></p>
         </section>
       </main>
 

package/modules/hall-ui/public/people.js

@@ -25,6 +25,7 @@
   var body = document.getElementById('people-body');
   var sub = document.getElementById('people-sub');
   var countPill = document.getElementById('people-count');
+  var foot = document.getElementById('people-foot');
 
   function fmtRecency(iso) {
     if (!iso) return '—';
@@ -73,6 +74,23 @@
     }).join('') + '</span>';
   }
 
+  // THE DIRECTORY ASKS FOR THE ENDPOINT MAXIMUM, so a full response is the only
+  // truncation signal that exists. `GET /scouting` clamps at parsePagination
+  // maxLimit: 500, takes no offset, and `listScoutingRollup` returns rows with no
+  // count of the whole set — so `length === DIRECTORY_LIMIT` means "at least this
+  // many", never "exactly this many", and there is nothing else to read it from.
+  // ONE constant feeds the request AND every sentence written about it, so the
+  // number a reader is shown can never drift from the number that was asked for.
+  //
+  // This is part 1 of task 1003110 — the honest half, which removes the
+  // silent-lie property whatever the real count turns out to be. Part 2 is
+  // server-offset paging, and it is deliberately NOT here: the kit has carried
+  // the mode since task 1003281 (`makeLedger({ serverPager, onPage })`), but the
+  // ROUTE cannot serve it — no offset parameter, no total, a hard 500 ceiling —
+  // so paging this page is a server change first. Its trigger is a directory
+  // approaching ~400; a read on 2026-09-16 returned far fewer.
+  var DIRECTORY_LIMIT = 500;
+
   var all = [];
   var query = '';
   var craft = '';
@@ -143,10 +161,31 @@
         + 'and none are listed without it. Their work still shows on each project’s own ledger.');
       return;
     }
-    if (countPill) { countPill.textContent = String(all.length); countPill.hidden = false; }
+    // A FULL PAGE IS A CLIPPED PAGE. Every sentence below has to hedge when this
+    // is true, because each of them otherwise states a total the page cannot know.
+    var clipped = all.length >= DIRECTORY_LIMIT;
+    if (countPill) {
+      countPill.textContent = clipped ? fmtInt(DIRECTORY_LIMIT) + '+' : String(all.length);
+      countPill.hidden = false;
+    }
     if (sub) {
-      sub.textContent = fmtInt(all.length) + ' builder' + (all.length === 1 ? '' : 's') + ' listed across hosted projects, ranked by track record. '
-        + 'Descriptive only — cross-project numbers never carry authority here.';
+      sub.textContent = clipped
+        ? 'Showing the first ' + fmtInt(DIRECTORY_LIMIT) + ' builders across hosted projects, ranked by track record — there are more than this page can load. '
+          + 'Descriptive only — cross-project numbers never carry authority here.'
+        : fmtInt(all.length) + ' builder' + (all.length === 1 ? '' : 's') + ' listed across hosted projects, ranked by track record. '
+          + 'Descriptive only — cross-project numbers never carry authority here.';
+    }
+    // THE LENSES LIE HARDER THAN THE COUNT DOES, and that is worth its own
+    // sentence. Search, sort and the craft filter all re-order the set this page
+    // already loaded (see SORTS above) — so on a clipped directory "most karma"
+    // is the most karma AMONG THE TOP 500 BY TRACK RECORD, and a builder outside
+    // that 500 cannot be found by any of them. A reader who is told only that the
+    // list is long would still trust the search.
+    if (foot) {
+      foot.textContent = clipped
+        ? 'The directory is clipped at the first ' + fmtInt(DIRECTORY_LIMIT) + ' by track record. Search and the sort lenses only re-order what this page loaded, so a builder outside that ' + fmtInt(DIRECTORY_LIMIT) + ' will not appear in them.'
+        : '';
+      foot.hidden = !clipped;
     }
     var crafts = [];
     all.forEach(function (b) {
@@ -194,7 +233,7 @@
     body.textContent = msg;
   }
 
-  fetch('/api/gds/scouting?limit=500', { headers: { Accept: 'application/json' } })
+  fetch('/api/gds/scouting?limit=' + DIRECTORY_LIMIT, { headers: { Accept: 'application/json' } })
     .then(function (r) {
       if (r.status === 403 || r.status === 401) { throw { gated: true }; }
       if (!r.ok) throw new Error('http ' + r.status);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.802",
+  "version": "1.19.804",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.802",
+      "version": "1.19.804",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.802",
+  "version": "1.19.804",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/artifact-staleness.js

@@ -0,0 +1,267 @@
+#!/usr/bin/env node
+// scripts/gds/artifact-staleness.js — are the gitignored generated artifacts on
+// THIS machine actually current with the commit it has checked out? (task 1001930,
+// ADR 0110 pt.5)
+//
+// WHY THIS EXISTS. ADR 0110 moved `docs/repo-map.md` and `docs/session-log-index.md`
+// off the git graph: they are 100%-generated, two parallel branches collided on them
+// constantly, so they became untracked files regenerated at deploy. That trade was
+// deliberate, and the ADR names the debt it took on in its own Consequences:
+//
+//   "A generator that breaks at deploy leaves a stale/absent file with no blocking
+//    backstop; the LOUD ::ERROR:: line is the alarm (mandatory, not optional)."
+//
+// That alarm is a line in the droplet's journald. Nobody reads journald. The per-PR
+// freshness gate cannot help either — the files are gitignored, so they never appear
+// in a diff for CI to check (`--check-whole`'s own comment says it plainly: "used by
+// nothing hard; deploy owns it"). So if the deploy regen step silently stops running,
+// every agent keeps reading a symbol map of a codebase that has moved on, and nothing
+// anywhere says so. This check is the backstop that posture depends on.
+//
+// WHAT IT COMPARES. For each registered artifact, its own generator's `--check-whole`
+// answers "would regenerating this file change it?" — run against the checkout that is
+// actually serving. A difference means the deploy generator did not run, or ran and
+// broke. Asking the generator rather than reimplementing the comparison is the point:
+// there is exactly one definition of "fresh" per artifact and it lives with the thing
+// that writes it, so this check cannot drift away from what deploy produces.
+//
+// ABSENT AND STALE ARE REPORTED SEPARATELY, and the split is operational, not cosmetic:
+// absent means the regen step never ran here at all (a deploy line was dropped, or a
+// fresh clone was never generated into), stale means it ran once and has not since.
+// Those send someone to two different places, so the report must not blur them.
+//
+// ── WHERE THIS MAY RUN — read before scheduling it anywhere new ───────────────
+//
+// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance, or a
+// dev box after its source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
+// has no `docs/repo-map.md` — it is gitignored, so it is not in the repository at all
+// — and this check would report it absent on every single run. A monitor that is red
+// every run teaches its reader to ignore it, which is the exact failure ADR 0110's
+// warn-only posture already has. That is why this ships as a scheduled routine on the
+// instance and NOT as a `.github/workflows/` job, unlike its sibling publish-watch.js
+// (which reads git and the registry, and so is true anywhere).
+//
+// THE MAIN GUARD. "Fresh" here means "matches what THIS commit generates". On a
+// deployed instance that commit is main, because deploy does `git reset --hard
+// origin/main` — so the question the caller actually wants ("does the served artifact
+// lag main's HEAD?") and the question `--check-whole` answers are the same question.
+// In a feature worktree they are NOT: the artifact would be compared against that
+// branch, and a pass or a fail would both be meaningless. So a checkout that is not at
+// origin/main is INCONCLUSIVE (exit 2), never a finding — a monitor that cannot tell
+// which question it just answered must say so rather than guess.
+'use strict';
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const GIT_TIMEOUT_MS = 15000;
+const CHECK_TIMEOUT_MS = 120000;
+
+// The gitignored, whole-file generated artifacts this check covers.
+//
+// MEMBERSHIP RULE — an artifact belongs here when all three hold: it is gitignored (so
+// no PR gate can see it), it is written by a deploy-time generator (so it can silently
+// stop being written), and its generator exposes `--check-whole` (so freshness has one
+// definition, owned by the writer). tests/artifact_staleness.mjs pins this list against
+// .gitignore and against the generators' real flags, so an artifact that gains a
+// `--check-whole` and is left out of here fails that test rather than going unwatched.
+//
+// DELIBERATELY NOT HERE, and each for a reason that is not "we forgot":
+//   • modules/hall-ui/public/atlas.json (gen-atlas.js, ADR 0094) — gitignored and
+//     deploy-generated, but its payload embeds `generatedAt: new Date()`, so a
+//     regenerate-and-compare differs on every run by construction. Checking it needs a
+//     comparison over `views` only, or a freshness-by-age test against the last deploy
+//     — a different mechanism, not this one. gen-atlas has no --check mode at all today.
+//   • docs/onboarding/diagrams/*.svg|png — rendering them needs a headless Chromium the
+//     droplet does not have (the reason ADR 0110 deferred the diagram half in the first
+//     place), so freshness cannot be evaluated where this runs. Their FACTS are already
+//     backstopped by the diagram-drift routine, which reads assertions.json instead.
+const ARTIFACTS = Object.freeze([
+  Object.freeze({
+    rel: 'docs/repo-map.md',
+    generator: 'gen-repo-map.js',
+    what: 'the symbol skeleton agents navigate the codebase by (ADR 0063)',
+  }),
+  Object.freeze({
+    rel: 'docs/session-log-index.md',
+    generator: 'gen-session-index.js',
+    what: 'the full session-log index the CLAUDE.md §13 snippet links out to (ADR 0062 §8)',
+  }),
+]);
+
+function git(args, run = spawnSync) {
+  const raw = gitRaw(args, run);
+  return raw === null ? null : raw.trim();
+}
+
+// Untrimmed, because `git status --porcelain` is column-significant: a line is
+// `XY<space>PATH` and an unstaged modification's X is a SPACE (" M path"). Trimming the
+// buffer eats that leading space on the FIRST line only, so a slice(3) then swallows the
+// path's first character — which is exactly how this printed "cripts/gds/…" until
+// tests/artifact_staleness.mjs caught it.
+function gitRaw(args, run = spawnSync) {
+  const r = run('git', args, { cwd: REPO_ROOT, encoding: 'utf8', timeout: GIT_TIMEOUT_MS });
+  if (!r || r.error || r.status !== 0) return null;
+  return String(r.stdout || '');
+}
+
+// The paths in a porcelain listing, status columns removed.
+function porcelainPaths(raw) {
+  return raw.split('\n').filter((l) => l.length > 3).map((l) => l.slice(3).trim()).filter(Boolean);
+}
+
+// Is this checkout a fair thing to compare the artifacts against — at origin/main AND
+// clean? Returns { ok } or { ok:false, reason }; git being unable to answer is equally
+// inconclusive.
+//
+// The CLEAN half is not belt-and-braces, and it was found by running this check against
+// its own uncommitted source file: a generator regenerates from the WORKING TREE, so one
+// uncommitted file that moves a symbol makes repo-map.md "stale" against a main it in
+// fact matches. On the droplet the tree is clean by construction (deploy does
+// `git reset --hard`), so requiring it costs a correct run nothing — while without it
+// every hand-run from a working checkout invents a finding, which is precisely how a
+// monitor teaches its reader to ignore it. Gitignored files (the artifacts themselves)
+// never appear in `--porcelain`, so they cannot trip this.
+function atMain(run = spawnSync) {
+  const head = git(['rev-parse', 'HEAD'], run);
+  const main = git(['rev-parse', 'origin/main'], run);
+  if (!head) return { ok: false, reason: 'could not read HEAD (not a git checkout?)' };
+  if (!main) return { ok: false, reason: 'could not read origin/main (no remote ref here?)' };
+  if (head !== main) {
+    const branch = git(['rev-parse', '--abbrev-ref', 'HEAD'], run) || '(detached)';
+    return { ok: false, reason: `checkout is at ${branch} ${head.slice(0, 8)}, not origin/main ${main.slice(0, 8)}` };
+  }
+  const dirty = gitRaw(['status', '--porcelain'], run);
+  if (dirty === null) return { ok: false, reason: 'could not read the working tree state' };
+  const paths = porcelainPaths(dirty);
+  if (paths.length) {
+    const shown = paths.slice(0, 3).join(', ');
+    const more = paths.length > 3 ? `, +${paths.length - 3} more` : '';
+    return { ok: false, reason: `working tree is not clean (${shown}${more}) — the generators would compare against those edits, not main` };
+  }
+  return { ok: true, sha: head };
+}
+
+// Ask ONE artifact's own generator whether it is current.
+//   fresh    exit 0 — regenerating would change nothing
+//   stale    exit 2 — it would (absent counts as stale; `present` says which)
+//   unknown  anything else — the generator itself could not answer, which is not a
+//            finding about the artifact and must never be reported as one.
+function checkArtifact(a, { root = REPO_ROOT, run = spawnSync, exists = fs.existsSync } = {}) {
+  const present = exists(path.join(root, a.rel));
+  const r = run(process.execPath, [path.join(root, 'scripts', 'gds', a.generator), '--check-whole'],
+    { cwd: root, encoding: 'utf8', timeout: CHECK_TIMEOUT_MS });
+  if (!r || r.error) {
+    return { ...a, state: 'unknown', present, detail: r && r.error ? r.error.message : 'generator did not run' };
+  }
+  if (r.status === 0) return { ...a, state: 'fresh', present };
+  if (r.status === 2) return { ...a, state: present ? 'stale' : 'absent', present };
+  const said = String(r.stderr || r.stdout || '').trim().split('\n').pop() || `exit ${r.status}`;
+  return { ...a, state: 'unknown', present, detail: said };
+}
+
+function check({ root = REPO_ROOT, run = spawnSync, exists = fs.existsSync, artifacts = ARTIFACTS, requireMain = true } = {}) {
+  if (requireMain) {
+    const m = atMain(run);
+    if (!m.ok) { const e = new Error(m.reason); e.inconclusive = true; throw e; }
+  }
+  const results = artifacts.map((a) => checkArtifact(a, { root, run, exists }));
+  return {
+    results,
+    fresh: results.filter((r) => r.state === 'fresh'),
+    stale: results.filter((r) => r.state === 'stale'),
+    absent: results.filter((r) => r.state === 'absent'),
+    unknown: results.filter((r) => r.state === 'unknown'),
+  };
+}
+
+// Plain language: this lands in Discord #ship-news, where the audience is the owner,
+// not whoever wrote the generator.
+function report(r) {
+  const bad = [...r.absent, ...r.stale];
+  if (!bad.length && !r.unknown.length) {
+    return `Generated navigation docs are current — ${r.fresh.length} artifact(s) match this commit.`;
+  }
+  const lines = [];
+  if (bad.length) {
+    lines.push(`⚠ ${bad.length} generated file(s) on this instance no longer match the code being served.`);
+    lines.push('');
+    for (const a of r.absent) lines.push(`  • ${a.rel} — MISSING entirely. Nothing has generated it here. It is ${a.what}.`);
+    for (const a of r.stale) lines.push(`  • ${a.rel} — out of date: it no longer matches what this commit would produce. It is ${a.what}.`);
+    lines.push('');
+    lines.push('These are rebuilt by the deploy step, so this means that step stopped running or broke.');
+    lines.push('Nothing blocks on them, which is why it went unreported until now — anyone reading these');
+    lines.push('files is being given an out-of-date picture. Check the deploy log for its regen lines');
+    lines.push('(they print ::ERROR:: when a generator fails).');
+  }
+  if (r.unknown.length) {
+    if (bad.length) lines.push('');
+    lines.push(`Could not check ${r.unknown.length} artifact(s):`);
+    for (const a of r.unknown) lines.push(`  • ${a.rel} — ${a.detail}`);
+  }
+  return lines.join('\n');
+}
+
+// Deliver the finding here rather than through run-routine.js's `sink: discord`.
+// run-routine treats a non-zero step as a FAILED step and aborts BEFORE it routes
+// stdout, so exiting 1 on a finding would throw that finding away. publish-watch.js
+// and artifact-audit.js carry the same shape for the same reason; their routine steps
+// all stay `sink: none` and the script performs its own side effect.
+async function deliver(text) {
+  const { postWebhook } = require(path.join(__dirname, '..', 'discord', 'lib.js'));
+  await postWebhook('ship_news', text);
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  const json = argv.includes('--json');
+
+  let r;
+  try {
+    r = check({ requireMain: !argv.includes('--any-ref') });
+  } catch (err) {
+    // Exit 2 = COULD NOT RUN, kept distinct from 1 (ran, found something) so a
+    // scheduler can go red on the former and merely report the latter.
+    console.error(`artifact-staleness could not complete: ${err && err.message ? err.message : err}`);
+    if (err && err.inconclusive) {
+      console.error('  Freshness is only meaningful against the commit being served. Re-run on the');
+      console.error('  deployed instance, or pass --any-ref to compare against whatever is checked out.');
+    }
+    process.exit(2);
+  }
+
+  const text = report(r);
+  const found = r.stale.length + r.absent.length;
+
+  if (json) { console.log(JSON.stringify(r, null, 2)); process.exit(found ? 1 : 0); }
+
+  // A healthy run is deliberately quiet — it tells a person who ran it by hand
+  // (stderr) and posts nothing. A daily "all fine" is how a channel becomes wallpaper.
+  if (!found) {
+    console.error(text);
+    // An artifact we could not check is not a finding, but it must not be silent
+    // either: a permanently-unknown artifact is unwatched without anyone deciding so.
+    process.exit(r.unknown.length ? 2 : 0);
+  }
+
+  console.log(text);
+  if (argv.includes('--no-post')) process.exit(1);
+
+  try {
+    await deliver(text);
+    console.error('posted the finding to Discord #ship-news.');
+    process.exit(1);
+  } catch (err) {
+    // Found something and could not say it — the original defect one layer down, so
+    // it is the LOUDEST outcome: exit 3 is >= 2, which turns the scheduled run red.
+    console.error(`\nFOUND STALE ARTIFACTS AND COULD NOT DELIVER THE FINDING: ${err && err.message ? err.message : err}`);
+    console.error('The finding is above. Set DISCORD_SHIP_NEWS_WEBHOOK so this reaches #ship-news.');
+    process.exit(3);
+  }
+}
+
+if (require.main === module) main();
+
+module.exports = { ARTIFACTS, atMain, checkArtifact, check, report };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.802'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.804'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/artifact_staleness.mjs

@@ -0,0 +1,202 @@
+// tests/artifact_staleness.mjs
+//
+// Covers scripts/gds/artifact-staleness.js (task 1001930, ADR 0110 pt.5) — the backstop
+// for the gitignored, deploy-generated navigation docs.
+//
+// ADR 0110 untracked docs/repo-map.md + docs/session-log-index.md to kill a merge-collision
+// class, and accepted a debt in writing: a deploy generator that breaks leaves a stale or
+// absent file with no blocking gate, alarming only via a ::ERROR:: line in journald. This
+// check is that backstop, so the properties worth pinning are the ones that decide whether
+// anyone will still be reading it in six months:
+//
+//   1. it distinguishes CANNOT-CHECK from FOUND-SOMETHING (a monitor that cries wolf when
+//      it is merely in the wrong place is one nobody reads — the exact ADR 0110 failure);
+//   2. absent and stale stay separate (they send a reader to two different places);
+//   3. the registry cannot silently fall behind the set of gitignored artifacts.
+//
+// `run`/`exists` are injected throughout, so nothing here touches a real generator, git
+// repo, or network. The end-to-end behaviour against the REAL generators was verified by
+// hand at ship time (fresh / absent / stale / both), which fakes cannot prove.
+//
+// Run:  node --test tests/artifact_staleness.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { readFileSync, readdirSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const { ARTIFACTS, atMain, checkArtifact, check, report } = require('../scripts/gds/artifact-staleness.js');
+
+const SHA = 'a'.repeat(40);
+const OTHER = 'b'.repeat(40);
+
+// A fake `run` for git: a table keyed by the git subcommand+args it is asked.
+function fakeGit({ head = SHA, main = SHA, porcelain = '', branch = 'main', fail = null } = {}) {
+  return (cmd, args) => {
+    const key = args.join(' ');
+    if (fail && key.includes(fail)) return { status: 1, stdout: '', stderr: 'boom' };
+    if (key === 'rev-parse HEAD') return { status: 0, stdout: `${head}\n` };
+    if (key === 'rev-parse origin/main') return { status: 0, stdout: `${main}\n` };
+    if (key === 'rev-parse --abbrev-ref HEAD') return { status: 0, stdout: `${branch}\n` };
+    if (key === 'status --porcelain') return { status: 0, stdout: porcelain };
+    return { status: 0, stdout: '' };
+  };
+}
+
+// ── the guard: when is a comparison even meaningful? ────────────────────────────
+
+test('at origin/main with a clean tree is comparable', () => {
+  assert.equal(atMain(fakeGit()).ok, true);
+});
+
+test('a feature branch is INCONCLUSIVE — the artifact would be judged against the wrong code', () => {
+  const r = atMain(fakeGit({ head: OTHER, branch: 'claude/some-task' }));
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /claude\/some-task/);
+  assert.match(r.reason, /not origin\/main/);
+});
+
+test('a DIRTY tree is inconclusive — a generator regenerates from the working tree, not from main', () => {
+  // The real bug this caught: running the check against its own uncommitted source file
+  // reported repo-map.md stale when it in fact matched main.
+  const r = atMain(fakeGit({ porcelain: ' M scripts/gds/artifact-staleness.js\n' }));
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /not clean/);
+  assert.match(r.reason, /scripts\/gds\/artifact-staleness\.js/);
+});
+
+test('every porcelain status column is parsed whole — an unstaged " M" must not lose its first letter', () => {
+  // The SECOND bug this file caught: the reader trimmed the buffer, and an unstaged
+  // modification's leading space is significant, so the first line printed "cripts/…".
+  // One case per column shape, first-line position included, since only the first line
+  // was ever affected.
+  for (const line of [' M scripts/gds/artifact-staleness.js', 'M  scripts/gds/artifact-staleness.js', '?? scripts/gds/artifact-staleness.js', 'A  scripts/gds/artifact-staleness.js']) {
+    const r = atMain(fakeGit({ porcelain: `${line}\n` }));
+    assert.match(r.reason, /\(scripts\/gds\/artifact-staleness\.js\)/, `mangled the path for "${line}"`);
+  }
+});
+
+test('a long dirty list is truncated with a count rather than dumped', () => {
+  const porcelain = [' M a.js', ' M b.js', ' M c.js', ' M d.js', ' M e.js'].join('\n') + '\n';
+  const r = atMain(fakeGit({ porcelain }));
+  assert.match(r.reason, /a\.js, b\.js, c\.js, \+2 more/);
+});
+
+test('git being unable to answer is inconclusive, never a pass', () => {
+  assert.equal(atMain(fakeGit({ fail: 'rev-parse origin/main' })).ok, false);
+  assert.equal(atMain(fakeGit({ fail: 'status --porcelain' })).ok, false);
+  assert.equal(atMain(fakeGit({ fail: 'rev-parse HEAD' })).ok, false);
+});
+
+test('check() REFUSES rather than reporting a finding when the checkout is not comparable', () => {
+  assert.throws(
+    () => check({ run: fakeGit({ head: OTHER }), exists: () => true }),
+    (e) => e.inconclusive === true,
+    'an inconclusive run must be distinguishable from a finding',
+  );
+});
+
+// ── one artifact's verdict ──────────────────────────────────────────────────────
+
+const A = { rel: 'docs/repo-map.md', generator: 'gen-repo-map.js', what: 'the symbol skeleton' };
+const gen = (status, extra = {}) => () => ({ status, stdout: '', stderr: '', ...extra });
+
+test('generator exit 0 → fresh', () => {
+  assert.equal(checkArtifact(A, { run: gen(0), exists: () => true }).state, 'fresh');
+});
+
+test('generator exit 2 + file present → stale; + file absent → absent', () => {
+  assert.equal(checkArtifact(A, { run: gen(2), exists: () => true }).state, 'stale');
+  assert.equal(checkArtifact(A, { run: gen(2), exists: () => false }).state, 'absent');
+});
+
+test('a generator that cannot answer is UNKNOWN, never stale — it is not a finding about the artifact', () => {
+  const crashed = checkArtifact(A, { run: gen(1, { stderr: 'SyntaxError: bad\n' }), exists: () => true });
+  assert.equal(crashed.state, 'unknown');
+  assert.match(crashed.detail, /SyntaxError/);
+  const spawnFailed = checkArtifact(A, { run: () => ({ error: new Error('ENOENT') }), exists: () => true });
+  assert.equal(spawnFailed.state, 'unknown');
+});
+
+// ── the report a human actually reads ───────────────────────────────────────────
+
+const runFor = (byGenerator) => (cmd, args) => {
+  if (cmd === 'git') return fakeGit()(cmd, args);
+  const which = String(args[0] || '').split('/').pop();
+  return { status: byGenerator[which], stdout: '', stderr: '' };
+};
+
+test('all fresh → one quiet line, and no alarm language', () => {
+  const r = check({ run: runFor({ 'gen-repo-map.js': 0, 'gen-session-index.js': 0 }), exists: () => true });
+  assert.equal(r.stale.length + r.absent.length, 0);
+  const text = report(r);
+  assert.match(text, /current/);
+  assert.ok(!text.includes('⚠'), 'a healthy run must not look like a finding');
+});
+
+test('absent and stale are reported as different things, not one blurred count', () => {
+  const r = check({
+    run: runFor({ 'gen-repo-map.js': 2, 'gen-session-index.js': 2 }),
+    exists: (p) => !String(p).endsWith('repo-map.md'), // repo-map gone, session-index present
+  });
+  assert.deepEqual(r.absent.map((a) => a.rel), ['docs/repo-map.md']);
+  assert.deepEqual(r.stale.map((a) => a.rel), ['docs/session-log-index.md']);
+  const text = report(r);
+  assert.match(text, /docs\/repo-map\.md — MISSING entirely/);
+  assert.match(text, /docs\/session-log-index\.md — out of date/);
+  assert.match(text, /deploy step/, 'the report must say where to go look');
+});
+
+test('an unchecked artifact is surfaced even when nothing is stale — unwatched must not read as healthy', () => {
+  const r = check({ run: runFor({ 'gen-repo-map.js': 0, 'gen-session-index.js': 1 }), exists: () => true });
+  assert.equal(r.stale.length + r.absent.length, 0);
+  assert.equal(r.unknown.length, 1);
+  assert.match(report(r), /Could not check 1 artifact/);
+});
+
+// ── the registry cannot fall behind reality ─────────────────────────────────────
+
+test('every registered artifact is really gitignored — a tracked file belongs to the PR gate instead', () => {
+  const ignore = readFileSync(new URL('../.gitignore', import.meta.url), 'utf8')
+    .split('\n').map((l) => l.trim());
+  for (const a of ARTIFACTS) {
+    assert.ok(ignore.includes(a.rel), `${a.rel} must be gitignored to belong in this check`);
+  }
+});
+
+test('every registered generator really exposes --check-whole — the contract this check is built on', () => {
+  for (const a of ARTIFACTS) {
+    const src = readFileSync(new URL(`../scripts/gds/${a.generator}`, import.meta.url), 'utf8');
+    assert.match(src, /--check-whole/, `${a.generator} must support --check-whole`);
+  }
+});
+
+test('the two ADR 0110 artifacts are both covered, and the known exclusions stay deliberate', () => {
+  assert.deepEqual(ARTIFACTS.map((a) => a.rel).sort(), ['docs/repo-map.md', 'docs/session-log-index.md']);
+  // atlas.json and the diagram renders are gitignored + deploy-generated too, but neither
+  // can be answered by this mechanism (a timestamped payload; a render needing Chromium).
+  // The reasons are written out at ARTIFACTS — this asserts they were a decision, so that
+  // adding either later is a deliberate act rather than a silent widening.
+  const src = readFileSync(new URL('../scripts/gds/artifact-staleness.js', import.meta.url), 'utf8');
+  assert.match(src, /atlas\.json/, 'the atlas exclusion must stay documented');
+  assert.match(src, /diagrams/, 'the diagram-render exclusion must stay documented');
+});
+
+test('this check must NOT be wired into CI — a fresh clone legitimately has none of these files', () => {
+  // The artifacts are gitignored, so a CI checkout never has them and this would be red on
+  // every single run — the "monitor nobody reads" failure ADR 0110 already has once. The
+  // mistake is an easy one to make by analogy with publish-watch.js, which IS a workflow
+  // (it reads git + the registry, so it is true anywhere). Assert no workflow invokes it.
+  const src = readFileSync(new URL('../scripts/gds/artifact-staleness.js', import.meta.url), 'utf8');
+  assert.match(src, /NEVER in CI/, 'the file must state where it may run');
+
+  let names = [];
+  try { names = readdirSync(new URL('../.github/workflows', import.meta.url)); } catch { names = []; }
+  const callers = names.filter((n) => {
+    try {
+      return readFileSync(new URL(`../.github/workflows/${n}`, import.meta.url), 'utf8').includes('artifact-staleness');
+    } catch { return false; }
+  });
+  assert.deepEqual(callers, [], `no workflow may run this check; found: ${callers.join(', ')}`);
+});

package/tests/people_directory_clip.mjs

@@ -0,0 +1,219 @@
+// tests/people_directory_clip.mjs — the People directory says so when it is
+// clipped (task 1003110, goal 1000095).
+//
+// WHY THIS FILE EXISTS. `people.js` asks `GET /scouting` for 500 rows, which is
+// that route's HARD CEILING (parsePagination maxLimit: 500). The rollup returns
+// no count of the whole set and the route takes no offset, so a response that
+// comes back FULL is the only truncation signal the page will ever get — and
+// until this task the page simply printed "500 builders listed" and said nothing
+// else. A directory that lies by omission is worse than one that admits it is
+// incomplete.
+//
+// It runs the REAL people.js in a vm against a stub DOM and a fake fetch, so
+// what is asserted is the sentence a reader actually sees, not a regex agreeing
+// with a regex. A source-text assertion would have passed just as happily with
+// the comparison written the wrong way round.
+//
+// The four behaviours:
+//   1. the page asks for exactly the number its copy then names (no drift)
+//   2. a SHORT response is not hedged — the exact count is the honest one
+//   3. a FULL response hedges every sentence that states a total: the pill, the
+//      subtitle, and a footnote about the lenses
+//   4. one row short of the ceiling is NOT clipped (the boundary, in the
+//      direction that would otherwise cry wolf on every load)
+//
+// Run:  node tests/people_directory_clip.mjs
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const KIT_JS = read('modules/hall-ui/public/hall-kit.js');
+const PEOPLE_JS = read('modules/hall-ui/public/people.js');
+const PEOPLE_HTML = read('modules/hall-ui/public/people.html');
+
+// The route's ceiling, spelled here as the CONTRACT rather than read out of the
+// page — a test that imports the page's own constant cannot notice it changing.
+const CEILING = 500;
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+function makeEl(id) {
+  return {
+    id,
+    innerHTML: '', textContent: '', value: '',
+    hidden: false, disabled: false, className: '',
+    options: [], style: {}, dataset: {},
+    classList: { add() {}, remove() {}, toggle() {}, contains: () => false },
+    appendChild() {}, setAttribute() {}, removeAttribute() {},
+    addEventListener() {},
+    querySelector() { return makeEl(); },
+    querySelectorAll() { return []; },
+  };
+}
+
+// `count` builders, each distinct enough that a filter lens has something to bite.
+function buildersFor(count) {
+  return Array.from({ length: count }, (_, i) => ({
+    github_id: 1000 + i,
+    github_login: `builder${i}`,
+    display_name: `Builder ${i}`,
+    avatar_url: null,
+    project_count: 1,
+    total_credits: count - i,
+    total_tasks_shipped: 1,
+    total_karma: 1,
+    last_active: '2026-09-01T00:00:00Z',
+    disciplines: ['engineer'],
+  }));
+}
+
+function harness({ count }) {
+  const els = new Map();
+  const getEl = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+  const documentObj = {
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    getElementById: getEl,
+    querySelector(sel) { return getEl(String(sel).replace(/^#/, '')); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+  };
+
+  const requests = [];
+  const store = new Map();
+  const windowObj = {
+    location: { assign() {}, href: '/people' },
+    localStorage: {
+      getItem: (k) => (store.has(k) ? store.get(k) : null),
+      setItem: (k, v) => store.set(k, String(v)),
+      removeItem: (k) => store.delete(k),
+    },
+    scrollTo() {},
+    addEventListener() {},
+    matchMedia: () => ({ matches: false, addEventListener() {}, addListener() {} }),
+    OTBBranding: { currencyLabel: () => 'Credits' },
+    OTB: {
+      escapeHtml: (s) => String(s == null ? '' : s),
+      $: (sel) => documentObj.querySelector(sel),
+      num: (n) => Number(n) || 0,
+      fmtInt: (n) => String(Number(n) || 0),
+      fmtCompact: (n) => String(Number(n) || 0),
+      fmtDate: (iso) => String(iso ?? '').slice(0, 10),
+      rankLabel: (r) => String(r ?? ''),
+      toast() {},
+    },
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console: { error() {}, warn() {}, log() {} },
+    setTimeout, clearTimeout, URLSearchParams, encodeURIComponent, Date, Math, JSON,
+    fetch: (url) => {
+      requests.push(String(url));
+      return Promise.resolve({
+        ok: true,
+        status: 200,
+        json: () => Promise.resolve({ builders: buildersFor(count) }),
+      });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  // The real kit, for the same reason sessions_kit_pager.mjs runs it: the page is
+  // held to the shipped contract, not to a stub that agrees with it.
+  vm.runInContext(KIT_JS, sandbox, { filename: 'hall-kit.js' });
+  vm.runInContext(PEOPLE_JS, sandbox, { filename: 'people.js' });
+
+  return { getEl, requests };
+}
+
+// ---------------------------------------------------------------------------
+
+await test('the page markup carries the footnote slot, hidden until the page writes it', () => {
+  assert.match(PEOPLE_HTML, /id="people-foot"/, 'the clipped-directory footnote has a mount');
+  const tag = PEOPLE_HTML.match(/<p[^>]*id="people-foot"[^>]*>/);
+  assert.ok(tag, 'the footnote is a <p>');
+  assert.match(tag[0], /\bhidden\b/, 'it starts hidden — an empty note is still a visible gap');
+  assert.match(tag[0], /class="ledger__note"/, "the shell's ledger footnote class, not a bespoke one");
+});
+
+await test('the page asks for exactly the ceiling, and asks for it ONCE', async () => {
+  const h = harness({ count: 3 });
+  await tick(); await tick();
+  assert.equal(h.requests.length, 1, 'one directory read');
+  assert.match(h.requests[0], /\/api\/gds\/scouting\?limit=/);
+  const limit = Number(new URLSearchParams(h.requests[0].split('?')[1]).get('limit'));
+  assert.equal(limit, CEILING, `the page must ask for the route ceiling (${CEILING})`);
+});
+
+await test('a SHORT directory is not hedged — the exact count is the honest one', async () => {
+  const h = harness({ count: 3 });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-count').textContent, '3', 'the pill states the real count');
+  assert.equal(h.getEl('people-count').hidden, false);
+  assert.match(h.getEl('people-sub').textContent, /^3 builders listed/, 'the subtitle states the real count');
+  assert.doesNotMatch(h.getEl('people-sub').textContent, /first|more than/i,
+    'nothing is clipped, so nothing may suggest it is');
+  assert.equal(h.getEl('people-foot').hidden, true, 'no footnote on a complete directory');
+  assert.equal(h.getEl('people-foot').textContent, '', 'and no stale text left behind it');
+});
+
+await test('a FULL response hedges the pill, the subtitle AND the lenses', async () => {
+  const h = harness({ count: CEILING });
+  await tick(); await tick();
+
+  const pill = h.getEl('people-count').textContent;
+  assert.equal(pill, `${CEILING}+`, 'the pill may not state a total the page cannot know');
+
+  const sub = h.getEl('people-sub').textContent;
+  assert.match(sub, new RegExp(`first ${CEILING}\\b`), 'the subtitle says which slice this is');
+  assert.match(sub, /more than this page can load/, 'and says the directory is larger');
+  assert.doesNotMatch(sub, new RegExp(`^${CEILING} builders listed`),
+    'the old sentence claimed the slice was the whole set');
+
+  const foot = h.getEl('people-foot');
+  assert.equal(foot.hidden, false, 'the footnote is shown');
+  // THE LENSES ARE THE SHARPER LIE. Search/sort/craft re-order only the loaded
+  // set, so on a clipped directory a builder outside the top 500 cannot be found
+  // by any of them — a reader told only "the list is long" would still trust the
+  // search box.
+  assert.match(foot.textContent, /search/i, 'the footnote names the search');
+  assert.match(foot.textContent, /sort/i, 'and the sort lenses');
+  assert.match(foot.textContent, new RegExp(`will not appear`),
+    'and says plainly that a builder outside the slice is unreachable through them');
+});
+
+await test('one row short of the ceiling is NOT clipped', async () => {
+  const h = harness({ count: CEILING - 1 });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-count').textContent, String(CEILING - 1),
+    'a nearly-full page is still a complete one');
+  assert.equal(h.getEl('people-foot').hidden, true, 'crying wolf here would train the notice away');
+});
+
+await test('every number in the clipped copy is the number that was requested', async () => {
+  const h = harness({ count: CEILING });
+  await tick(); await tick();
+  const limit = new URLSearchParams(h.requests[0].split('?')[1]).get('limit');
+  // The drift this guards: someone raises the request to 1000 and leaves "500"
+  // written in three sentences. Every integer the clipped copy prints must be
+  // the one the request carried.
+  const copy = [h.getEl('people-count').textContent, h.getEl('people-sub').textContent,
+    h.getEl('people-foot').textContent].join(' ');
+  const printed = copy.match(/\d+/g) || [];
+  assert.ok(printed.length >= 3, 'the clipped copy states the number more than once');
+  for (const n of printed) {
+    assert.equal(n, limit, `copy prints ${n} but the page requested ${limit}`);
+  }
+});
+
+summary();

package/tests/profile_route.mjs

@@ -651,8 +651,19 @@ await t('R06.3 GET /scouting drops the hidden, the provisional AND the private b
 await t('R06.3 the /people page reads /scouting and nothing else', async () => {
   // /people is the hall's render of the same endpoint, so whatever /scouting
   // drops, /people drops. Pin that it has no second data source.
-  const endpoints = [...sourceOf('modules/hall-ui/public/people.js').matchAll(/fetch\(\s*'([^']+)'/g)].map((m) => m[1]);
-  assert.deepEqual(endpoints, ['/api/gds/scouting?limit=500'], '/people has exactly one data source');
+  //
+  // MATCHED AS AN EXPRESSION, NOT A STRING LITERAL. This used to capture the
+  // whole URL out of `fetch('…')` and compare it to one hardcoded string, which
+  // pinned the row limit as a side effect of pinning the ENDPOINT — so task
+  // 1003110 naming that limit (`DIRECTORY_LIMIT`, the one constant that feeds
+  // both the request and the "showing the first N" copy) failed a test about
+  // data sources. What is load-bearing here is the count and the destination:
+  // ONE read, and it goes to the scouting rollup. How the query string is
+  // assembled is the page's business.
+  const args = [...sourceOf('modules/hall-ui/public/people.js').matchAll(/\bfetch\(\s*([^,)]+)/g)].map((m) => m[1].trim());
+  assert.equal(args.length, 1, '/people has exactly one data source');
+  assert.match(args[0], /^'\/api\/gds\/scouting\?limit='/,
+    'and it is the scouting rollup — nothing may re-enter through a second endpoint');
 });
 
 scout.server.close();