@@ -86,6 +86,7 @@ import { fileURLToPath } from 'node:url';
 
 import { isEntrypoint } from '../invoked-as.mjs';
 import { validateStroke } from './fleet-write/validate.mjs';
+import { ghApi, PER_PAGE, readAllPages } from './gh-pages.mjs';
 // The mailbox label, its ledger exclusion and its branch prefix have ONE owner,
 // the mailbox opener (#25417); this file reads them, never re-spells them.
 import * as mailboxOpen from './mailbox-open.mjs';
@@ -389,18 +390,11 @@ export function planWrite({ board, issue, body }) {
 }
 
 // ---------------------------------------------------------------------------
-// The live edges — `gh api` reads, the relay
+// The live edges — `gh api` reads (paged by `gh-pages.mjs`), the relay
 // ---------------------------------------------------------------------------
 
 function ghJson(path, { paginate = false } = {}) {
-  const r = spawnSync('gh', ['api', ...(paginate ? ['--paginate', '--slurp'] : []), path], { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
-  if (r.status !== 0) return { ok: false, error: (r.stderr || r.error?.message || `gh exited ${r.status}`).trim() };
-  try {
-    const parsed = JSON.parse(r.stdout);
-    return { ok: true, value: paginate ? parsed.flat() : parsed };
-  } catch (e) {
-    return { ok: false, error: `unparseable answer from GET ${path}: ${e.message}` };
-  }
+  return paginate ? readAllPages(path) : ghApi(path);
 }
 
 /** Read every repo into the snapshot shape `buildRows` takes; throws on the first failed read. */
@@ -528,8 +522,9 @@ const SELF_TEST_BATTERIES = Object.freeze({
   'the rendered body: marker, columns, footer, determinism': 8,
   'refusing to overwrite what is not the roster': 6,
   'the CLI: fixture runs offline, usage errors are exit 2': 5,
+  'paging: a three-page read through the loop equals the slurped array': 4,
 });
-const SELF_TEST_BATTERY_FLOOR = 7;
+const SELF_TEST_BATTERY_FLOOR = 8;
 
 async function selfTest() {
   let failed = 0;
@@ -652,6 +647,23 @@ async function selfTest() {
     return [p.actions.length, p.actions[0].op, Object.keys(p.actions[0]).sort(), p.errors];
   })(), [1, 'issue_patch', ['body', 'issue', 'op'], []]);
 
+  battery('paging: a three-page read through the loop equals the slurped array');
+  {
+    const slurped = [0, 1, 2].map((n) => Array.from({ length: n < 2 ? PER_PAGE : 37 }, (_, i) => ({ number: n * PER_PAGE + i + 1 })));
+    const asked = [];
+    const get = (path) => {
+      asked.push(path);
+      const page = Number(new URLSearchParams(path.split('?')[1]).get('page'));
+      return { ok: true, value: slurped[page - 1] ?? [] };
+    };
+    const read = readAllPages('/repos/o/r/issues?state=open&labels=pm%3Aseat&per_page=100', { get });
+    t('three pages read = the --slurp array, flattened', [read.ok, read.value], [true, slurped.flat()]);
+    t('pages 1..3 asked, per_page kept once, other keys kept, stop at the short page', asked, [1, 2, 3].map((n) => `/repos/o/r/issues?state=open&labels=pm%3Aseat&per_page=100&page=${n}`));
+    const exact = [];
+    t('an exact multiple of per_page reads one empty page and stops', [readAllPages('/x', { get: (p) => (exact.push(p), { ok: true, value: exact.length === 1 ? slurped[0] : [] }) }).value.length, exact.length], [PER_PAGE, 2]);
+    t('a failed page or a non-list page is an error, never a partial list', [readAllPages('/x', { get: () => ({ ok: false, error: 'boom' }) }), readAllPages('/x', { get: () => ({ ok: true, value: { message: 'x' } }) }).ok], [{ ok: false, error: 'boom' }, false]);
+  }
+
   battery('the CLI: fixture runs offline, usage errors are exit 2');
   const cli = (args) => spawnSync(process.execPath, [SELF_PATH, ...args], { encoding: 'utf8', env: { ...process.env, PATH: '/nonexistent', OS_FLEET_SESSION: '', CLAUDE_CODE_REMOTE_SESSION_ID: '' } });
   const jsonRun = cli(['--fixture', FIXTURE_PATH, '--json']);
 
@@ -0,0 +1,65 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * gh-pages — every page of one paginated REST read, walked by `page=N` until a
+ * short page comes back (#25962). Shared by `fleet-roster.mjs` and
+ * `mailbox-open.mjs`.
+ *
+ * ## Why not `gh api --paginate --slurp`
+ *
+ * The built-in gh of cloud sessions answers `--slurp is not supported by this
+ * built-in gh.`, and the fleet runs in cloud sessions — so a reader that leans
+ * on that flag is a reader no seat can run. Plain `gh api <path>` works under
+ * both the real CLI and the built-in one, so the loop lives here instead.
+ *
+ * ⛔ No `Link` header: a page shorter than `per_page` is the last one, the same
+ * rule as `board-snapshot.mjs`'s `readAllPages`. An exact multiple of
+ * `per_page` costs one extra, empty read.
+ *
+ * A library, not an instrument: no CLI and no `--self-test` of its own. Both
+ * importers' self-tests read a three-page fixture through `readAllPages` with
+ * an injected `get`, so the loop is tested offline twice.
+ */
+
+import { spawnSync } from 'node:child_process';
+
+export const PER_PAGE = 100;
+/** A runaway guard, not a budget: 50 pages × 100 is far past any read these scripts make. */
+export const MAX_PAGES = 50;
+
+/** `path` with `per_page` forced to `PER_PAGE` and `page` set to `page`; every other query key kept in order. */
+export function pagePath(path, page) {
+  const [base, query = ''] = String(path).split('?', 2);
+  const keep = query.split('&').filter((kv) => kv && !/^(?:per_page|page)=/.test(kv));
+  return `${base}?${[...keep, `per_page=${PER_PAGE}`, `page=${page}`].join('&')}`;
+}
+
+/** One `gh api <path>` read, parsed. `{ ok: true, value }` or `{ ok: false, error }` — never throws. */
+export function ghApi(path, { maxBuffer = 256 * 1024 * 1024 } = {}) {
+  const r = spawnSync('gh', ['api', path], { encoding: 'utf8', maxBuffer });
+  if (r.status !== 0) return { ok: false, error: (r.stderr || r.error?.message || `gh exited ${r.status}`).trim() };
+  try {
+    return { ok: true, value: JSON.parse(r.stdout) };
+  } catch (e) {
+    return { ok: false, error: `unparseable answer from GET ${path}: ${e.message}` };
+  }
+}
+
+/**
+ * Every row of a paginated list read: `page=1, 2, …` until a page shorter than
+ * `PER_PAGE`. Same answer shape as `ghApi`. A page that is not an array, a
+ * failed page, or a read past `MAX_PAGES` is an error — ⛔ never a partial list
+ * returned as if whole.
+ */
+export function readAllPages(path, { get = ghApi } = {}) {
+  const rows = [];
+  for (let page = 1; page <= MAX_PAGES; page++) {
+    const p = pagePath(path, page);
+    const r = get(p);
+    if (!r.ok) return r;
+    if (!Array.isArray(r.value)) return { ok: false, error: `GET ${p} answered ${r.value === null ? 'null' : typeof r.value}, not a list page` };
+    rows.push(...r.value);
+    if (r.value.length < PER_PAGE) return { ok: true, value: rows };
+  }
+  return { ok: false, error: `GET ${path} still returned full pages after ${MAX_PAGES}; refusing a partial read` };
+}
@@ -88,6 +88,7 @@ import { fileURLToPath } from 'node:url';
 
 import { isEntrypoint } from '../invoked-as.mjs';
 import { validateStroke } from './fleet-write/validate.mjs';
+import { ghApi, PER_PAGE, readAllPages } from './gh-pages.mjs';
 
 const SELF_PATH = fileURLToPath(import.meta.url);
 const PM_DIR = dirname(SELF_PATH);
@@ -232,18 +233,11 @@ export function planText(plan) {
 }
 
 // ---------------------------------------------------------------------------
-// The live edges — `gh api` reads, `git`, with-fleet, the relay
+// The live edges — `gh api` reads (paged by `gh-pages.mjs`), `git`, with-fleet, the relay
 // ---------------------------------------------------------------------------
 
 function ghJson(path, { paginate = false } = {}) {
-  const r = spawnSync('gh', ['api', ...(paginate ? ['--paginate', '--slurp'] : []), path], { encoding: 'utf8' });
-  if (r.status !== 0) return { ok: false, error: (r.stderr || r.error?.message || `gh exited ${r.status}`).trim() };
-  try {
-    const parsed = JSON.parse(r.stdout);
-    return { ok: true, value: paginate ? parsed.flat() : parsed };
-  } catch (e) {
-    return { ok: false, error: `unparseable answer from GET ${path}: ${e.message}` };
-  }
+  return paginate ? readAllPages(path) : ghApi(path);
 }
 
 function run(cmd, args) {
@@ -371,8 +365,9 @@ const SELF_TEST_BATTERIES = Object.freeze({
   'refusing to close what is not an open mailbox': 4,
   'the ledger exclusion and the footer': 4,
   'the CLI: dry run prints the actions file and sends nothing': 5,
+  'paging: a three-page read through the loop equals the slurped array': 4,
 });
-const SELF_TEST_BATTERY_FLOOR = 7;
+const SELF_TEST_BATTERY_FLOOR = 8;
 
 async function selfTest() {
   let failed = 0;
@@ -443,6 +438,23 @@ async function selfTest() {
   t('a session_ id is kept', bodyFooter('session_01XYZ').includes('/code/session_01XYZ)'), true);
   t('no or a malformed session falls back to the bare footer', [bodyFooter(null), bodyFooter('cse_')].every((f) => f.endsWith('(https://claude.ai/code)_')), true);
 
+  battery('paging: a three-page read through the loop equals the slurped array');
+  {
+    const slurped = [0, 1, 2].map((n) => Array.from({ length: n < 2 ? PER_PAGE : 37 }, (_, i) => ({ number: n * PER_PAGE + i + 1 })));
+    const asked = [];
+    const get = (path) => {
+      asked.push(path);
+      const page = Number(new URLSearchParams(path.split('?')[1]).get('page'));
+      return { ok: true, value: slurped[page - 1] ?? [] };
+    };
+    const read = readAllPages('/repos/o/r/issues?state=open&labels=pm%3Aseat&per_page=100', { get });
+    t('three pages read = the --slurp array, flattened', [read.ok, read.value], [true, slurped.flat()]);
+    t('pages 1..3 asked, per_page kept once, other keys kept, stop at the short page', asked, [1, 2, 3].map((n) => `/repos/o/r/issues?state=open&labels=pm%3Aseat&per_page=100&page=${n}`));
+    const exact = [];
+    t('an exact multiple of per_page reads one empty page and stops', [readAllPages('/x', { get: (p) => (exact.push(p), { ok: true, value: exact.length === 1 ? slurped[0] : [] }) }).value.length, exact.length], [PER_PAGE, 2]);
+    t('a failed page or a non-list page is an error, never a partial list', [readAllPages('/x', { get: () => ({ ok: false, error: 'boom' }) }), readAllPages('/x', { get: () => ({ ok: true, value: { message: 'x' } }) }).ok], [{ ok: false, error: 'boom' }, false]);
+  }
+
   battery('the CLI: dry run prints the actions file and sends nothing');
   const cli = (args) => spawnSync(process.execPath, [SELF_PATH, ...args], { encoding: 'utf8', env: { ...process.env, PATH: '/nonexistent', OS_FLEET_SESSION: '', CLAUDE_CODE_REMOTE_SESSION_ID: '' } });
   const dry = cli(['--repo', 'objectstack-ai/objectstack', '--login', 'os-bill', '--dry-run']);