[finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes #13900

Closed
#14236
Closed
[finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes#13900
#14236
Assignees
os-justin
Labels
domain:skillspriority:p1High: required for production / M2

Description

@claude
claude
bot
opened on Aug 31, 2026

Filed unassigned by an os-dev seat (objectui #6521) while doing the pre-filing dedup search the dispatch contract requires. Grading is the triage seat's.

The defect

references/rest-channel.md prescribes, for a seat whose repo-scoped REST probe is green:

✓ 按标签/状态列卡:GET /repos/{o}/{r}/issues?state=open&labels=a,b&per_page=N

and references/platform-readings.md makes the REST list endpoint the primary dedup channel, explicitly preferred over MCP search_issues, with the standing warning that "不完整枚举比零结果更危险".

⚠️Following the Link: rel="next" header returned by that endpoint silently under-returns. Measured just now, one container, objectstack-ai/objectui:

how the population was walkeditems returned
per_page=100, then follow Link: rel="next" (a cursor, ...&after=Y3Vyc29yOnYyOpLP...)102
per_page=100&page=1,2,3 (classic page numbers)287
GET /repos/{o}/{r} -> open_issues_count (the authority)287

The cursor walk returned page 1 in full (100), then a 2-item page 2 with no further rel="next" — i.e. it reported itself exhausted at 102 of 287. Classic page-number pagination on the identical query returned 100 + 100 + 87 and matches open_issues_count exactly.

Why this is worth a card

Every failure property that makes this dangerous is present at once:

  1. It is the documented recipe. The reference tells a seat to use this endpoint for dedup and for "list by label/state". A cursor walk is the natural way to follow it.
  2. It is silent. No error, no 4xx, no truncation warning. The walk terminates the way an exhausted walk terminates.
  3. It fails toward the dangerous side. 64% of the backlog vanished. A dedup grep over the returned 102 answers "no duplicate" with total confidence, and the seat files a duplicate card — the exact outcome the search_issues false-zero discipline ([finding] MCP search_issues is returning FALSE ZEROS — reproduced on three seats across two repos, and it DEGRADED mid-session, so every dedup that rode on it passed vacuously #13326) exists to prevent, arriving through the channel that discipline names as the safe fallback.
  4. The existing control does not catch it. The prescribed positive control is a known-hit keyword. A known-hit card that happens to sit in the first 100 answers correctly, and the control goes green over a 64%-truncated corpus. ⇒ a keyword control cannot detect this class; only a count cross-check can.

Same shape as #13373 (the zero-quota payload channel silently dropping the newest timeline items) — a documented channel that under-returns without saying so — but a different channel and a different mechanism, so that card does not cover it.

Suggested repair

Two lines in references/rest-channel.md, on the list-cards row:

  • ⛔ Do not follow Link: rel="next" on GET /repos/{o}/{r}/issues. Walk &page=1,2,3,... until a page returns fewer than per_page.
  • Cross-check the total against open_issues_count from GET /repos/{o}/{r} (which counts issues and PRs, so subtract the open PR count) before treating any enumeration as complete. A dedup search over an unverified population is not a reading.

⚠️ Not measured, and worth knowing before the fix is written: whether the truncation is the GitHub API's own cursor behaviour or something the session egress proxy does to the Link header. Two observations on one container, one repo. The repair above is correct either way, because it removes the dependency on the header rather than explaining it.

Reproduction

curl -sSI -H "Authorization: Bearer $GH_TOKEN" \
"https://api.github.com/repos/objectstack-ai/objectui/issues?state=open&per_page=1" | grep -i '^link:'

returns a rel="next" whose URL carries &after= rather than &page=. Walk it to exhaustion, count, and compare with the page=N walk and with open_issues_count.

Refs: #13373 · #13326 · #12728.

Generated by Claude Code

Metadata

Metadata

Assignees

Labels

domain:skillspriority:p1High: required for production / M2

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes #13900
    Closed
    #14236
    Closed
    [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes#13900
    #14236
    Assignees
    os-justin
    Labels
    domain:skillspriority:p1High: required for production / M2
    Description
    @claude
    claude
    bot
    opened on Aug 31, 2026
    Filed unassigned by an os-dev seat (objectui #6521) while doing the pre-filing dedup search the dispatch contract requires. Grading is the triage seat's.
    The defect
    references/rest-channel.md prescribes, for a seat whose repo-scoped REST probe is green:
    ✓ 按标签/状态列卡:GET /repos/{o}/{r}/issues?state=open&labels=a,b&per_page=N
    and references/platform-readings.md makes the REST list endpoint the primary dedup channel, explicitly preferred over MCP search_issues, with the standing warning that "不完整枚举比零结果更危险".
    ⚠️Following the Link: rel="next" header returned by that endpoint silently under-returns. Measured just now, one container, objectstack-ai/objectui:
    how the population was walkeditems returned
    per_page=100, then follow Link: rel="next" (a cursor, ...&after=Y3Vyc29yOnYyOpLP...)102
    per_page=100&page=1,2,3 (classic page numbers)287
    GET /repos/{o}/{r} -> open_issues_count (the authority)287
    The cursor walk returned page 1 in full (100), then a 2-item page 2 with no further rel="next" — i.e. it reported itself exhausted at 102 of 287. Classic page-number pagination on the identical query returned 100 + 100 + 87 and matches open_issues_count exactly.
    Why this is worth a card
    Every failure property that makes this dangerous is present at once:
    1. It is the documented recipe. The reference tells a seat to use this endpoint for dedup and for "list by label/state". A cursor walk is the natural way to follow it.
    2. It is silent. No error, no 4xx, no truncation warning. The walk terminates the way an exhausted walk terminates.
    3. It fails toward the dangerous side. 64% of the backlog vanished. A dedup grep over the returned 102 answers "no duplicate" with total confidence, and the seat files a duplicate card — the exact outcome the search_issues false-zero discipline ([finding] MCP search_issues is returning FALSE ZEROS — reproduced on three seats across two repos, and it DEGRADED mid-session, so every dedup that rode on it passed vacuously #13326) exists to prevent, arriving through the channel that discipline names as the safe fallback.
    4. The existing control does not catch it. The prescribed positive control is a known-hit keyword. A known-hit card that happens to sit in the first 100 answers correctly, and the control goes green over a 64%-truncated corpus. ⇒ a keyword control cannot detect this class; only a count cross-check can.
    Same shape as #13373 (the zero-quota payload channel silently dropping the newest timeline items) — a documented channel that under-returns without saying so — but a different channel and a different mechanism, so that card does not cover it.
    Suggested repair
    Two lines in references/rest-channel.md, on the list-cards row:
    • ⛔ Do not follow Link: rel="next" on GET /repos/{o}/{r}/issues. Walk &page=1,2,3,... until a page returns fewer than per_page.
    • Cross-check the total against open_issues_count from GET /repos/{o}/{r} (which counts issues and PRs, so subtract the open PR count) before treating any enumeration as complete. A dedup search over an unverified population is not a reading.
    ⚠️ Not measured, and worth knowing before the fix is written: whether the truncation is the GitHub API's own cursor behaviour or something the session egress proxy does to the Link header. Two observations on one container, one repo. The repair above is correct either way, because it removes the dependency on the header rather than explaining it.
    Reproduction
    curl -sSI -H "Authorization: Bearer $GH_TOKEN" \
"https://api.github.com/repos/objectstack-ai/objectui/issues?state=open&per_page=1" | grep -i '^link:'

    returns a rel="next" whose URL carries &after= rather than &page=. Walk it to exhaustion, count, and compare with the page=N walk and with open_issues_count.
    Refs: #13373 · #13326 · #12728.
    Generated by Claude Code
    Metadata
    Metadata
    Assignees
    Labels
    domain:skillspriority:p1High: required for production / M2
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes #13900
      Closed
      #14236
      Closed
      [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes#13900
      #14236
      Assignees
      os-justin
      Labels
      domain:skillspriority:p1High: required for production / M2
      Description
      @claude
      claude
      bot
      opened on Aug 31, 2026
      Filed unassigned by an os-dev seat (objectui #6521) while doing the pre-filing dedup search the dispatch contract requires. Grading is the triage seat's.
      The defect
      references/rest-channel.md prescribes, for a seat whose repo-scoped REST probe is green:
      ✓ 按标签/状态列卡:GET /repos/{o}/{r}/issues?state=open&labels=a,b&per_page=N
      and references/platform-readings.md makes the REST list endpoint the primary dedup channel, explicitly preferred over MCP search_issues, with the standing warning that "不完整枚举比零结果更危险".
      ⚠️Following the Link: rel="next" header returned by that endpoint silently under-returns. Measured just now, one container, objectstack-ai/objectui:
      how the population was walkeditems returned
      per_page=100, then follow Link: rel="next" (a cursor, ...&after=Y3Vyc29yOnYyOpLP...)102
      per_page=100&page=1,2,3 (classic page numbers)287
      GET /repos/{o}/{r} -> open_issues_count (the authority)287
      The cursor walk returned page 1 in full (100), then a 2-item page 2 with no further rel="next" — i.e. it reported itself exhausted at 102 of 287. Classic page-number pagination on the identical query returned 100 + 100 + 87 and matches open_issues_count exactly.
      Why this is worth a card
      Every failure property that makes this dangerous is present at once:
      1. It is the documented recipe. The reference tells a seat to use this endpoint for dedup and for "list by label/state". A cursor walk is the natural way to follow it.
      2. It is silent. No error, no 4xx, no truncation warning. The walk terminates the way an exhausted walk terminates.
      3. It fails toward the dangerous side. 64% of the backlog vanished. A dedup grep over the returned 102 answers "no duplicate" with total confidence, and the seat files a duplicate card — the exact outcome the search_issues false-zero discipline ([finding] MCP search_issues is returning FALSE ZEROS — reproduced on three seats across two repos, and it DEGRADED mid-session, so every dedup that rode on it passed vacuously #13326) exists to prevent, arriving through the channel that discipline names as the safe fallback.
      4. The existing control does not catch it. The prescribed positive control is a known-hit keyword. A known-hit card that happens to sit in the first 100 answers correctly, and the control goes green over a 64%-truncated corpus. ⇒ a keyword control cannot detect this class; only a count cross-check can.
      Same shape as #13373 (the zero-quota payload channel silently dropping the newest timeline items) — a documented channel that under-returns without saying so — but a different channel and a different mechanism, so that card does not cover it.
      Suggested repair
      Two lines in references/rest-channel.md, on the list-cards row:
      • ⛔ Do not follow Link: rel="next" on GET /repos/{o}/{r}/issues. Walk &page=1,2,3,... until a page returns fewer than per_page.
      • Cross-check the total against open_issues_count from GET /repos/{o}/{r} (which counts issues and PRs, so subtract the open PR count) before treating any enumeration as complete. A dedup search over an unverified population is not a reading.
      ⚠️ Not measured, and worth knowing before the fix is written: whether the truncation is the GitHub API's own cursor behaviour or something the session egress proxy does to the Link header. Two observations on one container, one repo. The repair above is correct either way, because it removes the dependency on the header rather than explaining it.
      Reproduction
      curl -sSI -H "Authorization: Bearer $GH_TOKEN" \
"https://api.github.com/repos/objectstack-ai/objectui/issues?state=open&per_page=1" | grep -i '^link:'

      returns a rel="next" whose URL carries &after= rather than &page=. Walk it to exhaustion, count, and compare with the page=N walk and with open_issues_count.
      Refs: #13373 · #13326 · #12728.
      Generated by Claude Code
      Metadata
      Metadata
      Assignees
      Labels
      domain:skillspriority:p1High: required for production / M2
      Type
      No type
      Projects
      No projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes #13900
        Closed
        #14236
        Closed
        [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes#13900
        #14236
        Assignees
        os-justin
        Labels
        domain:skillspriority:p1High: required for production / M2
        Description
        @claude
        claude
        bot
        opened on Aug 31, 2026
        Filed unassigned by an os-dev seat (objectui #6521) while doing the pre-filing dedup search the dispatch contract requires. Grading is the triage seat's.
        The defect
        references/rest-channel.md prescribes, for a seat whose repo-scoped REST probe is green:
        ✓ 按标签/状态列卡:GET /repos/{o}/{r}/issues?state=open&labels=a,b&per_page=N
        and references/platform-readings.md makes the REST list endpoint the primary dedup channel, explicitly preferred over MCP search_issues, with the standing warning that "不完整枚举比零结果更危险".
        ⚠️Following the Link: rel="next" header returned by that endpoint silently under-returns. Measured just now, one container, objectstack-ai/objectui:
        how the population was walkeditems returned
        per_page=100, then follow Link: rel="next" (a cursor, ...&after=Y3Vyc29yOnYyOpLP...)102
        per_page=100&page=1,2,3 (classic page numbers)287
        GET /repos/{o}/{r} -> open_issues_count (the authority)287
        The cursor walk returned page 1 in full (100), then a 2-item page 2 with no further rel="next" — i.e. it reported itself exhausted at 102 of 287. Classic page-number pagination on the identical query returned 100 + 100 + 87 and matches open_issues_count exactly.
        Why this is worth a card
        Every failure property that makes this dangerous is present at once:
        1. It is the documented recipe. The reference tells a seat to use this endpoint for dedup and for "list by label/state". A cursor walk is the natural way to follow it.
        2. It is silent. No error, no 4xx, no truncation warning. The walk terminates the way an exhausted walk terminates.
        3. It fails toward the dangerous side. 64% of the backlog vanished. A dedup grep over the returned 102 answers "no duplicate" with total confidence, and the seat files a duplicate card — the exact outcome the search_issues false-zero discipline ([finding] MCP search_issues is returning FALSE ZEROS — reproduced on three seats across two repos, and it DEGRADED mid-session, so every dedup that rode on it passed vacuously #13326) exists to prevent, arriving through the channel that discipline names as the safe fallback.
        4. The existing control does not catch it. The prescribed positive control is a known-hit keyword. A known-hit card that happens to sit in the first 100 answers correctly, and the control goes green over a 64%-truncated corpus. ⇒ a keyword control cannot detect this class; only a count cross-check can.
        Same shape as #13373 (the zero-quota payload channel silently dropping the newest timeline items) — a documented channel that under-returns without saying so — but a different channel and a different mechanism, so that card does not cover it.
        Suggested repair
        Two lines in references/rest-channel.md, on the list-cards row:
        • ⛔ Do not follow Link: rel="next" on GET /repos/{o}/{r}/issues. Walk &page=1,2,3,... until a page returns fewer than per_page.
        • Cross-check the total against open_issues_count from GET /repos/{o}/{r} (which counts issues and PRs, so subtract the open PR count) before treating any enumeration as complete. A dedup search over an unverified population is not a reading.
        ⚠️ Not measured, and worth knowing before the fix is written: whether the truncation is the GitHub API's own cursor behaviour or something the session egress proxy does to the Link header. Two observations on one container, one repo. The repair above is correct either way, because it removes the dependency on the header rather than explaining it.
        Reproduction
        curl -sSI -H "Authorization: Bearer $GH_TOKEN" \
"https://api.github.com/repos/objectstack-ai/objectui/issues?state=open&per_page=1" | grep -i '^link:'

        returns a rel="next" whose URL carries &after= rather than &page=. Walk it to exhaustion, count, and compare with the page=N walk and with open_issues_count.
        Refs: #13373 · #13326 · #12728.
        Generated by Claude Code
        Metadata
        Metadata
        Assignees
        Labels
        domain:skillspriority:p1High: required for production / M2
        Type
        No type
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes #13900
          Closed
          #14236
          Closed
          [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes#13900
          #14236
          Assignees
          os-justin
          Labels
          domain:skillspriority:p1High: required for production / M2
          Description
          @claude
          claude
          bot
          opened on Aug 31, 2026
          Filed unassigned by an os-dev seat (objectui #6521) while doing the pre-filing dedup search the dispatch contract requires. Grading is the triage seat's.
          The defect
          references/rest-channel.md prescribes, for a seat whose repo-scoped REST probe is green:
          ✓ 按标签/状态列卡:GET /repos/{o}/{r}/issues?state=open&labels=a,b&per_page=N
          and references/platform-readings.md makes the REST list endpoint the primary dedup channel, explicitly preferred over MCP search_issues, with the standing warning that "不完整枚举比零结果更危险".
          ⚠️Following the Link: rel="next" header returned by that endpoint silently under-returns. Measured just now, one container, objectstack-ai/objectui:
          how the population was walkeditems returned
          per_page=100, then follow Link: rel="next" (a cursor, ...&after=Y3Vyc29yOnYyOpLP...)102
          per_page=100&page=1,2,3 (classic page numbers)287
          GET /repos/{o}/{r} -> open_issues_count (the authority)287
          The cursor walk returned page 1 in full (100), then a 2-item page 2 with no further rel="next" — i.e. it reported itself exhausted at 102 of 287. Classic page-number pagination on the identical query returned 100 + 100 + 87 and matches open_issues_count exactly.
          Why this is worth a card
          Every failure property that makes this dangerous is present at once:
          1. It is the documented recipe. The reference tells a seat to use this endpoint for dedup and for "list by label/state". A cursor walk is the natural way to follow it.
          2. It is silent. No error, no 4xx, no truncation warning. The walk terminates the way an exhausted walk terminates.
          3. It fails toward the dangerous side. 64% of the backlog vanished. A dedup grep over the returned 102 answers "no duplicate" with total confidence, and the seat files a duplicate card — the exact outcome the search_issues false-zero discipline ([finding] MCP search_issues is returning FALSE ZEROS — reproduced on three seats across two repos, and it DEGRADED mid-session, so every dedup that rode on it passed vacuously #13326) exists to prevent, arriving through the channel that discipline names as the safe fallback.
          4. The existing control does not catch it. The prescribed positive control is a known-hit keyword. A known-hit card that happens to sit in the first 100 answers correctly, and the control goes green over a 64%-truncated corpus. ⇒ a keyword control cannot detect this class; only a count cross-check can.
          Same shape as #13373 (the zero-quota payload channel silently dropping the newest timeline items) — a documented channel that under-returns without saying so — but a different channel and a different mechanism, so that card does not cover it.
          Suggested repair
          Two lines in references/rest-channel.md, on the list-cards row:
          • ⛔ Do not follow Link: rel="next" on GET /repos/{o}/{r}/issues. Walk &page=1,2,3,... until a page returns fewer than per_page.
          • Cross-check the total against open_issues_count from GET /repos/{o}/{r} (which counts issues and PRs, so subtract the open PR count) before treating any enumeration as complete. A dedup search over an unverified population is not a reading.
          ⚠️ Not measured, and worth knowing before the fix is written: whether the truncation is the GitHub API's own cursor behaviour or something the session egress proxy does to the Link header. Two observations on one container, one repo. The repair above is correct either way, because it removes the dependency on the header rather than explaining it.
          Reproduction
          curl -sSI -H "Authorization: Bearer $GH_TOKEN" \
"https://api.github.com/repos/objectstack-ai/objectui/issues?state=open&per_page=1" | grep -i '^link:'

          returns a rel="next" whose URL carries &after= rather than &page=. Walk it to exhaustion, count, and compare with the page=N walk and with open_issues_count.
          Refs: #13373 · #13326 · #12728.
          Generated by Claude Code
          Metadata
          Metadata
          Assignees
          Labels
          domain:skillspriority:p1High: required for production / M2
          Type
          No type
          Projects
          No projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes #13900
            Closed
            #14236
            Closed
            [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes#13900
            #14236
            Assignees
            os-justin
            Labels
            domain:skillspriority:p1High: required for production / M2
            Description
            @claude
            claude
            bot
            opened on Aug 31, 2026
            Filed unassigned by an os-dev seat (objectui #6521) while doing the pre-filing dedup search the dispatch contract requires. Grading is the triage seat's.
            The defect
            references/rest-channel.md prescribes, for a seat whose repo-scoped REST probe is green:
            ✓ 按标签/状态列卡:GET /repos/{o}/{r}/issues?state=open&labels=a,b&per_page=N
            and references/platform-readings.md makes the REST list endpoint the primary dedup channel, explicitly preferred over MCP search_issues, with the standing warning that "不完整枚举比零结果更危险".
            ⚠️Following the Link: rel="next" header returned by that endpoint silently under-returns. Measured just now, one container, objectstack-ai/objectui:
            how the population was walkeditems returned
            per_page=100, then follow Link: rel="next" (a cursor, ...&after=Y3Vyc29yOnYyOpLP...)102
            per_page=100&page=1,2,3 (classic page numbers)287
            GET /repos/{o}/{r} -> open_issues_count (the authority)287
            The cursor walk returned page 1 in full (100), then a 2-item page 2 with no further rel="next" — i.e. it reported itself exhausted at 102 of 287. Classic page-number pagination on the identical query returned 100 + 100 + 87 and matches open_issues_count exactly.
            Why this is worth a card
            Every failure property that makes this dangerous is present at once:
            1. It is the documented recipe. The reference tells a seat to use this endpoint for dedup and for "list by label/state". A cursor walk is the natural way to follow it.
            2. It is silent. No error, no 4xx, no truncation warning. The walk terminates the way an exhausted walk terminates.
            3. It fails toward the dangerous side. 64% of the backlog vanished. A dedup grep over the returned 102 answers "no duplicate" with total confidence, and the seat files a duplicate card — the exact outcome the search_issues false-zero discipline ([finding] MCP search_issues is returning FALSE ZEROS — reproduced on three seats across two repos, and it DEGRADED mid-session, so every dedup that rode on it passed vacuously #13326) exists to prevent, arriving through the channel that discipline names as the safe fallback.
            4. The existing control does not catch it. The prescribed positive control is a known-hit keyword. A known-hit card that happens to sit in the first 100 answers correctly, and the control goes green over a 64%-truncated corpus. ⇒ a keyword control cannot detect this class; only a count cross-check can.
            Same shape as #13373 (the zero-quota payload channel silently dropping the newest timeline items) — a documented channel that under-returns without saying so — but a different channel and a different mechanism, so that card does not cover it.
            Suggested repair
            Two lines in references/rest-channel.md, on the list-cards row:
            • ⛔ Do not follow Link: rel="next" on GET /repos/{o}/{r}/issues. Walk &page=1,2,3,... until a page returns fewer than per_page.
            • Cross-check the total against open_issues_count from GET /repos/{o}/{r} (which counts issues and PRs, so subtract the open PR count) before treating any enumeration as complete. A dedup search over an unverified population is not a reading.
            ⚠️ Not measured, and worth knowing before the fix is written: whether the truncation is the GitHub API's own cursor behaviour or something the session egress proxy does to the Link header. Two observations on one container, one repo. The repair above is correct either way, because it removes the dependency on the header rather than explaining it.
            Reproduction
            curl -sSI -H "Authorization: Bearer $GH_TOKEN" \
"https://api.github.com/repos/objectstack-ai/objectui/issues?state=open&per_page=1" | grep -i '^link:'

            returns a rel="next" whose URL carries &after= rather than &page=. Walk it to exhaustion, count, and compare with the page=N walk and with open_issues_count.
            Refs: #13373 · #13326 · #12728.
            Generated by Claude Code
            Metadata
            Metadata
            Assignees
            Labels
            domain:skillspriority:p1High: required for production / M2
            Type
            No type
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes #13900
              Closed
              #14236
              Closed
              [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes#13900
              #14236
              Assignees
              os-justin
              Labels
              domain:skillspriority:p1High: required for production / M2
              Description
              @claude
              claude
              bot
              opened on Aug 31, 2026
              Filed unassigned by an os-dev seat (objectui #6521) while doing the pre-filing dedup search the dispatch contract requires. Grading is the triage seat's.
              The defect
              references/rest-channel.md prescribes, for a seat whose repo-scoped REST probe is green:
              ✓ 按标签/状态列卡:GET /repos/{o}/{r}/issues?state=open&labels=a,b&per_page=N
              and references/platform-readings.md makes the REST list endpoint the primary dedup channel, explicitly preferred over MCP search_issues, with the standing warning that "不完整枚举比零结果更危险".
              ⚠️Following the Link: rel="next" header returned by that endpoint silently under-returns. Measured just now, one container, objectstack-ai/objectui:
              how the population was walkeditems returned
              per_page=100, then follow Link: rel="next" (a cursor, ...&after=Y3Vyc29yOnYyOpLP...)102
              per_page=100&page=1,2,3 (classic page numbers)287
              GET /repos/{o}/{r} -> open_issues_count (the authority)287
              The cursor walk returned page 1 in full (100), then a 2-item page 2 with no further rel="next" — i.e. it reported itself exhausted at 102 of 287. Classic page-number pagination on the identical query returned 100 + 100 + 87 and matches open_issues_count exactly.
              Why this is worth a card
              Every failure property that makes this dangerous is present at once:
              1. It is the documented recipe. The reference tells a seat to use this endpoint for dedup and for "list by label/state". A cursor walk is the natural way to follow it.
              2. It is silent. No error, no 4xx, no truncation warning. The walk terminates the way an exhausted walk terminates.
              3. It fails toward the dangerous side. 64% of the backlog vanished. A dedup grep over the returned 102 answers "no duplicate" with total confidence, and the seat files a duplicate card — the exact outcome the search_issues false-zero discipline ([finding] MCP search_issues is returning FALSE ZEROS — reproduced on three seats across two repos, and it DEGRADED mid-session, so every dedup that rode on it passed vacuously #13326) exists to prevent, arriving through the channel that discipline names as the safe fallback.
              4. The existing control does not catch it. The prescribed positive control is a known-hit keyword. A known-hit card that happens to sit in the first 100 answers correctly, and the control goes green over a 64%-truncated corpus. ⇒ a keyword control cannot detect this class; only a count cross-check can.
              Same shape as #13373 (the zero-quota payload channel silently dropping the newest timeline items) — a documented channel that under-returns without saying so — but a different channel and a different mechanism, so that card does not cover it.
              Suggested repair
              Two lines in references/rest-channel.md, on the list-cards row:
              • ⛔ Do not follow Link: rel="next" on GET /repos/{o}/{r}/issues. Walk &page=1,2,3,... until a page returns fewer than per_page.
              • Cross-check the total against open_issues_count from GET /repos/{o}/{r} (which counts issues and PRs, so subtract the open PR count) before treating any enumeration as complete. A dedup search over an unverified population is not a reading.
              ⚠️ Not measured, and worth knowing before the fix is written: whether the truncation is the GitHub API's own cursor behaviour or something the session egress proxy does to the Link header. Two observations on one container, one repo. The repair above is correct either way, because it removes the dependency on the header rather than explaining it.
              Reproduction
              curl -sSI -H "Authorization: Bearer $GH_TOKEN" \
"https://api.github.com/repos/objectstack-ai/objectui/issues?state=open&per_page=1" | grep -i '^link:'

              returns a rel="next" whose URL carries &after= rather than &page=. Walk it to exhaustion, count, and compare with the page=N walk and with open_issues_count.
              Refs: #13373 · #13326 · #12728.
              Generated by Claude Code
              Metadata
              Metadata
              Assignees
              Labels
              domain:skillspriority:p1High: required for production / M2
              Type
              No type
              Projects
              No projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes #13900
                Closed
                #14236
                Closed
                [finding] The REST issues-list Link: rel="next" cursor silently returns 102 of 287 open issues — the dedup channel references/rest-channel.md prescribes#13900
                #14236
                Assignees
                os-justin
                Labels
                domain:skillspriority:p1High: required for production / M2
                Description
                @claude
                claude
                bot
                opened on Aug 31, 2026
                Filed unassigned by an os-dev seat (objectui #6521) while doing the pre-filing dedup search the dispatch contract requires. Grading is the triage seat's.
                The defect
                references/rest-channel.md prescribes, for a seat whose repo-scoped REST probe is green:
                ✓ 按标签/状态列卡:GET /repos/{o}/{r}/issues?state=open&labels=a,b&per_page=N
                and references/platform-readings.md makes the REST list endpoint the primary dedup channel, explicitly preferred over MCP search_issues, with the standing warning that "不完整枚举比零结果更危险".
                ⚠️Following the Link: rel="next" header returned by that endpoint silently under-returns. Measured just now, one container, objectstack-ai/objectui:
                how the population was walkeditems returned
                per_page=100, then follow Link: rel="next" (a cursor, ...&after=Y3Vyc29yOnYyOpLP...)102
                per_page=100&page=1,2,3 (classic page numbers)287
                GET /repos/{o}/{r} -> open_issues_count (the authority)287
                The cursor walk returned page 1 in full (100), then a 2-item page 2 with no further rel="next" — i.e. it reported itself exhausted at 102 of 287. Classic page-number pagination on the identical query returned 100 + 100 + 87 and matches open_issues_count exactly.
                Why this is worth a card
                Every failure property that makes this dangerous is present at once:
                1. It is the documented recipe. The reference tells a seat to use this endpoint for dedup and for "list by label/state". A cursor walk is the natural way to follow it.
                2. It is silent. No error, no 4xx, no truncation warning. The walk terminates the way an exhausted walk terminates.
                3. It fails toward the dangerous side. 64% of the backlog vanished. A dedup grep over the returned 102 answers "no duplicate" with total confidence, and the seat files a duplicate card — the exact outcome the search_issues false-zero discipline ([finding] MCP search_issues is returning FALSE ZEROS — reproduced on three seats across two repos, and it DEGRADED mid-session, so every dedup that rode on it passed vacuously #13326) exists to prevent, arriving through the channel that discipline names as the safe fallback.
                4. The existing control does not catch it. The prescribed positive control is a known-hit keyword. A known-hit card that happens to sit in the first 100 answers correctly, and the control goes green over a 64%-truncated corpus. ⇒ a keyword control cannot detect this class; only a count cross-check can.
                Same shape as #13373 (the zero-quota payload channel silently dropping the newest timeline items) — a documented channel that under-returns without saying so — but a different channel and a different mechanism, so that card does not cover it.
                Suggested repair
                Two lines in references/rest-channel.md, on the list-cards row:
                • ⛔ Do not follow Link: rel="next" on GET /repos/{o}/{r}/issues. Walk &page=1,2,3,... until a page returns fewer than per_page.
                • Cross-check the total against open_issues_count from GET /repos/{o}/{r} (which counts issues and PRs, so subtract the open PR count) before treating any enumeration as complete. A dedup search over an unverified population is not a reading.
                ⚠️ Not measured, and worth knowing before the fix is written: whether the truncation is the GitHub API's own cursor behaviour or something the session egress proxy does to the Link header. Two observations on one container, one repo. The repair above is correct either way, because it removes the dependency on the header rather than explaining it.
                Reproduction
                curl -sSI -H "Authorization: Bearer $GH_TOKEN" \
"https://api.github.com/repos/objectstack-ai/objectui/issues?state=open&per_page=1" | grep -i '^link:'

                returns a rel="next" whose URL carries &after= rather than &page=. Walk it to exhaustion, count, and compare with the page=N walk and with open_issues_count.
                Refs: #13373 · #13326 · #12728.
                Generated by Claude Code
                Metadata
                Metadata
                Assignees
                Labels
                domain:skillspriority:p1High: required for production / M2
                Type
                No type
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions