board-ops: card lookups silently miss cards now that board #28 exceeds --limit 500 #2451

Problem

Board #28 now holds 533 items (counted 2026-09-22), but the card lookups in .claude/skills/board-ops/SKILL.md run gh project item-list 28 … --limit 500. Past the limit, item-list truncates silently: no error and no warning, just the first 500 items. Any card beyond that point is invisible, so the recipes return false negatives rather than failing:

issue-triage/SKILL.md uses --limit 700 (L56, L222), which covers today's board with ~170 items to spare. It will fail the same way once the board grows past that.

The skill already warns that --limit must stay above the board's item count, but that warning relies on someone remembering to check. The "~265 as of 2026-08-01" figure it quotes has doubled in under two months.

How it bit

Twice in one session (2026-09-22), both times leading to a confidently wrong statement:

• The Document the GitHub security advisory flow as a skill, and reconcile the two rules it contradicts #2443 card "was not on the board". In fact it was there, in Done.
• "Board Add tab and approval flow for server -> client sampling #28 has no draft cards." In fact all 16 GHSA advisory drafts were there, in Incoming.

Expected

A lookup either finds the card or fails loudly. It should never return an empty result because the board grew.

Suggested direction

• Issue cards: look them up from the issue side, which does not depend on board size:

  gh api graphql -f query='{repository(owner:"modelcontextprotocol",name:"inspector"){issue(number:<N>){projectItems(first:10){nodes{id project{number}}}}}}' \
    --jq '.data.repository.issue.projectItems.nodes[] | select(.project.number==28) | .id'

• Draft cards and whole-board dumps (GHSA lookup, snapshot, recovery, the triage audit) do need the full listing. Give them a limit with real headroom, and assert .items | length is below it, so a truncated listing fails instead of passing as complete.
• Remove the stale "~265 items" figure, or replace it with the assertion so no manual check is needed.

🤖 Generated with Claude Code