docs(spec): record the per-kind view limit as read by nobody, and state the gate guard the gate implements

#19228, prose + pins only. ⛔ No `.default()` moves and no precedence is
picked — both are contract directions this card is explicitly not allowed
to take.

Measured first-hand at the objectui pin `87af769e9` (2026-09-21T06:30-06:40Z),
over all 8,228 files tracked at that commit:

- `.kanban.limit` / `.gallery.limit` / `.timeline.limit` -> 0 read points,
  against 8 for the identically-shaped `.kanban.groupByField` /
  `.gallery.coverField` / `.timeline.scale` control on the same instrument.
- The row caps objectui does read are `savedViewLimit` (a view's
  `pagination.pageSize`, else its flat `limit`) and the element block's own
  flat `limit`. `ListView`'s `baseProps` carries no `limit` on any branch.
- `ElementDataSourceGate`'s arm is `!fromView || !isUsableRowLimit(authored)`,
  reading the ELEMENT-face key, which is `.optional()` with no applied
  default. The arm is reachable; the view-face default never lands on it.

So the published «fills it only when unset» was narrower than the guard, and
the per-kind key #19226 declared reaches no consumer at all. Both are now
recorded where an author and an auditor read them.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UDXER3sdqfeVYpEWZs5mZx

Author: claude

packages/spec/src/ui/component.test.ts

@@ -24,7 +24,10 @@ import {
   ObjectKanbanPropsSchema,
 } from './component.zod';
 import { PageComponentSchema, PageSchema, PageComponentType, ElementDataSourceSchema, RETIRED_PAGE_COMPONENT_TYPES } from './page.zod';
-import { GanttConfigSchema, TreeConfigSchema, ListMapConfigSchema, ListColumnSchema, ListViewSchema } from './view.zod';
+import {
+  GanttConfigSchema, TreeConfigSchema, ListMapConfigSchema, ListColumnSchema, ListViewSchema,
+  TimelineConfigSchema, DEFAULT_VIEW_ROW_LIMIT,
+} from './view.zod';
 import { FieldSchema } from '../data/field.zod';
 import { ALL_CONVERSIONS } from '../conversions/registry';
 import { strictObjectDeclarations } from '../shared/strict-object';
@@ -3799,3 +3802,68 @@ describe('the three #18305 object blocks — key sets derived from the renderers
     expect((ComponentPropsMap as Record<string, unknown>)['object-chart']).toBeUndefined();
   });
 });
+
+// #19228 — two authorable row bounds land on one `object-timeline` node, and
+// the react tier's own precedence sentence was narrower than the guard it
+// names. ⛔ This card picks NO precedence and changes no `.default()`; these
+// pins only hold the two structural facts the repair rests on, measured
+// first-hand at the objectui pin `87af769e9` on 2026-09-21T06:30-06:40Z.
+describe('row caps on the object-bound blocks — what #19228 recorded', () => {
+  const timeline = ComponentPropsMap['object-timeline'];
+  const kanban = ComponentPropsMap['object-kanban'];
+
+  it('leaves the ELEMENT-face `limit` undefaulted — the fact that keeps the gate arm alive', () => {
+    // `ElementDataSourceGate` lowers a bound view's cap into this key only
+    // when it does not already carry a USABLE one
+    // (`ElementDataSourceGate.tsx:316-331`, `!fromView || !isUsableRowLimit`).
+    // An applied default here would make every parsed node carry a usable cap
+    // and kill that arm outright — the failure #19228 feared, on the schema it
+    // would actually happen to. ⛔ Do not "fix" a red here by deleting the pin.
+    for (const [label, schema] of [['object-kanban', kanban], ['object-timeline', timeline]] as const) {
+      const parsed = schema.parse({ objectName: 'task' }) as Record<string, unknown>;
+      expect(Object.prototype.hasOwnProperty.call(parsed, 'limit'), label).toBe(false);
+    }
+
+    // LIT CONTROL, same instrument (a Zod applied default, observed through
+    // `parse`): the VIEW-face sibling DOES materialize one, so the zeros above
+    // are a reading rather than a parse that never ran.
+    const viewSide = TimelineConfigSchema.parse({ startDateField: 'start_date', titleField: 'name' }) as { limit?: number };
+    expect(viewSide.limit).toBe(DEFAULT_VIEW_ROW_LIMIT);
+  });
+
+  it('materializes the NESTED `timeline.limit` on a node whose flat `limit` stays absent', () => {
+    // The shape the record is about: one strictObject, two authorable row
+    // caps. At the pin, `ListView.tsx:3084` forwards this block nested and
+    // does NOT hoist `limit` to a flat prop, and `ObjectTimeline.tsx:407`
+    // queries off the flat key alone — so the 100 below reaches no query.
+    const result = timeline.safeParse({
+      objectName: 'task',
+      timeline: { startDateField: 'start_date', titleField: 'name' },
+    });
+    expect(result.success).toBe(true);
+    const data = (result.success ? result.data : undefined) as
+      { limit?: unknown; timeline?: { limit?: unknown } } | undefined;
+    expect(data?.timeline?.limit).toBe(DEFAULT_VIEW_ROW_LIMIT);
+    expect(Object.prototype.hasOwnProperty.call(data ?? {}, 'limit')).toBe(false);
+
+    // CONTROL — the node is still strict, so the acceptance above is not the
+    // verdict of a map that has stopped refusing anything.
+    const control = timeline.safeParse({ objectName: 'task', zzUnlikelyBogusKey__: 1 });
+    expect(control.success).toBe(false);
+    expect(JSON.stringify(control.error?.issues)).toContain('unrecognized_keys');
+  });
+
+  it('states the gate guard the gate actually implements, not the narrower 「unset」 arm', () => {
+    // ⛔ The one prose assertion here, and it is negative on purpose: this
+    // card's whole repair IS the published sentence, so without a pin the
+    // change has no falsifier. The retired wording claimed the view's cap
+    // lands ONLY on an unset key; measured, it also lands on a key set to a
+    // cap the contract refuses, with `describeDisplacedRowLimit` reporting it.
+    const shape = (ObjectKanbanPropsSchema as unknown as {
+      def: { shape: Record<string, { description?: string }> };
+    }).def.shape;
+    const description = shape.limit?.description ?? '';
+    expect(description).not.toContain('only when unset');
+    expect(description).toContain('usable');
+  });
+});

packages/spec/src/ui/component.zod.ts

@@ -3092,12 +3092,34 @@ export const ObjectKanbanPropsSchema = lazySchema(() => strictObject({
    * Why the carrier is `limit` and not the bound view's `pagination.pageSize`
    * (the alternative the card opened): precedence is the `ElementDataSourceGate`
    * table, not this key's. The component-level `dataSource.limit` overrides
-   * this key, and a bound named view's `pagination.pageSize` is LOWERED INTO
-   * it through the `limit: 'limit'` mapping only when the component authored
-   * none (`react/src/element-data-source/ElementDataSourceGate.tsx:316-331`,
+   * this key unconditionally; a bound named view's row cap is LOWERED INTO it
+   * through the `limit: 'limit'` mapping only when this key does not already
+   * carry a USABLE cap (`react/src/element-data-source/ElementDataSourceGate.tsx:316-331`,
    * `readLimit`/`writeLimit` keyed by `ElementDataSourceLimitKey`; the branch
    * gained objectui#9899's presence-is-not-authorship test and a
-   * `describeDisplacedRowLimit` report on this hop). The board
+   * `describeDisplacedRowLimit` report on this hop).
+   *
+   * ⚠️ 「only when UNSET」 is what this docblock and the describe beside it
+   * used to say, and it is narrower than the guard — re-READ first-hand at the
+   * pin `87af769e9` on 2026-09-21T06:35Z. The branch is
+   * `if (!fromView || !isUsableRowLimit(authored))`, so the view's cap also
+   * lands when this key IS set to a value the contract refuses (`0`, negative,
+   * fractional, non-number), with `describeDisplacedRowLimit` telling the
+   * author. Unset is one arm of that guard, not the whole of it. The view half
+   * is likewise not `pagination.pageSize` alone: `savedViewLimit` reads
+   * `pagination.pageSize`, else that view's FLAT `limit`
+   * (`core/src/data-scope/element-data-source.ts:237-241`); the per-kind
+   * `kanban.limit` / `gallery.limit` / `timeline.limit` #19226 declared is read
+   * by neither door (0 read points at this pin — see `rowLimitKey` in
+   * `view.zod.ts`). ⛔ This note reports the guard; it picks no precedence.
+   *
+   * ⭐ The arm therefore stays REACHABLE: its guard reads THIS key, which is
+   * `.optional()` with no applied default, so an author's silence is still
+   * silence at parse time. #19228 read the applied default on the VIEW-face
+   * per-kind `limit` as killing this arm; the two are different schemas and
+   * the view-face default never lands on this key. ⛔ Do not add a
+   * `.default()` here: that — and only that — is what would make it dead.
+   * The board
    * has no `pagination` read point, so declaring that spelling here would name
    * a key the renderer ignores — the accepted-and-dropped defect this section
    * exists to remove. Same shape as the `element:record_picker` and
@@ -3106,7 +3128,7 @@ export const ObjectKanbanPropsSchema = lazySchema(() => strictObject({
    * a schema default would materialize `limit: 100` on every parsed board.
    */
   limit: z.number().int().positive().optional()
-    .describe("Maximum number of records loaded onto the board (row cap); lowered to the query's top-level `$top` (renderer default 100). The component-level `dataSource.limit` wins when both are set; a bound view's `pagination.pageSize` fills it only when unset"),
+    .describe("Maximum number of records loaded onto the board (row cap); lowered to the query's top-level `$top` (renderer default 100). The component-level `dataSource.limit` wins when both are set; a bound view's row cap (`pagination.pageSize`, else that view's flat `limit`) fills this key unless it already carries a USABLE cap — a cap the contract refuses (zero, negative, fractional) is displaced by the view's and reported, not honoured"),
   data: z.array(z.unknown()).optional().describe('Static inline cards — bypasses the object query'),
   cardTitle: z.string().optional().describe('Field rendered as each card title'),
   titleField: z.string().optional().describe('Legacy fallback for `cardTitle` (the board reads `cardTitle || titleField`). Prefer `cardTitle`'),
@@ -3942,8 +3964,13 @@ const OBJECT_TIMELINE_FLAT_CONFIG_GUIDANCE: readonly KeySetGuidance[] = [
  * the canonical nested config every field resolution prefers), `filter`
  * (`:210`, `:232` — verbatim to `$filter`), `sort` (`:211`, `:233` — through
  * the shared `convertSortToQueryParams` sink, as `object-calendar`'s does),
- * `limit` (`:234`, `:254` — the fetch's top-level `$top`, renderer default
- * `DEFAULT_TIMELINE_LIMIT` = 100 at `:28`), `items` (`:170`, `:247`, `:299`,
+ * `limit` (⭐ re-READ at the CURRENT pin `87af769e9` on 2026-09-21T06:30Z,
+ * #19228 — the other anchors in this list are still the `53ded82b` readings
+ * the header names: `:407`, the fetch's one top-level `$top`, through
+ * `resolveRowLimit(schema.limit, DEFAULT_TIMELINE_LIMIT)` with the default
+ * `100` at `:29` and the refused-cap diagnostic at `:279`. ⚠️ It is the FLAT
+ * key that is read — `schema.timeline.limit` has 0 read points anywhere in
+ * objectui at that pin; see the `timeline` door below), `items` (`:170`, `:247`, `:299`,
  * `:480` — the authored pass-through that short-circuits the object query),
  * `data` (`:171`, `:247`, `:254`, `:256` — the pre-fetched record source,
  * read off REACT PROPS rather than `schema`; the door's own docblock carries
@@ -3969,6 +3996,17 @@ const OBJECT_TIMELINE_FLAT_CONFIG_GUIDANCE: readonly KeySetGuidance[] = [
  * VALUE posture: `timeline` takes {@link TimelineConfigSchema}, the block
  * `ListViewSchema.timeline` already declares — one vocabulary, taken by
  * reference, so this element face cannot fork from the view face.
+ * ⚠️ Taking it by reference also imported #19226's new `limit` onto THIS
+ * strictObject, beside the flat `limit` below — two authorable row caps on one
+ * node, one live and one inert, and the nested one carries an APPLIED default
+ * so every parsed node with a `timeline` block materializes `timeline.limit:
+ * 100` (#19228). Measured at the pin `87af769e9`, 2026-09-21T06:30Z:
+ * `ListView.tsx:3062-3117` forwards this block NESTED (`:3084`) and hoists
+ * only `startDateField` / `endDateField` / `titleField` / `groupByField` /
+ * `colorField` / `scale` to flat props — `limit` is not among them — while
+ * `ObjectTimeline.tsx:407` queries off the flat `schema.limit` alone.
+ * ⛔ Recorded, not repaired: which key should carry a timeline's row cap is
+ * the open half of #19228 and is not answered here.
  * `mapping` stays `z.unknown()`: its contract
  * (`TimelineMappingSchema`) still lives in objectui, which is the
  * `object-calendar.calendar` posture this section's header prescribes for
@@ -3992,7 +4030,7 @@ export const ObjectTimelinePropsSchema = lazySchema(() => strictObject({
   objectName: z.string().optional()
     .describe('Object this timeline binds to. Optional because the component-level `dataSource` binding can supply the object instead — this block registers through `ElementDataSourceGate`, which lowers the binding onto this key before the renderer sees the node'),
   timeline: TimelineConfigSchema.optional()
-    .describe('Timeline configuration, the author face — the same block `ListViewSchema.timeline` declares: { startDateField, endDateField, titleField, groupByField, colorField, scale }. The flat top-level spellings beside it are the runtime handoff, not a second authoring spelling'),
+    .describe('Timeline configuration, the author face — the same block `ListViewSchema.timeline` declares: { startDateField, endDateField, titleField, groupByField, colorField, scale, limit }. The flat top-level spellings beside it are the runtime handoff, not a second authoring spelling. ⚠️ `limit` is the one member of that block NO renderer reads: this face queries off the FLAT `limit` beside this key, and a `timeline.limit` written here is accepted, defaulted to 100 by the block, and then dropped'),
   /** Base query filter — the family's one `ViewFilterRule` array orthography (#15449). */
   filter: z.array(ViewFilterRuleSchema, {
     error: ruleArrayFilterError({

packages/spec/src/ui/view.zod.ts

@@ -1216,6 +1216,25 @@ type RowLimitView = keyof typeof ROW_LIMIT_SUBJECT;
  * as complete, which is worse than the unbounded-and-silent one this key
  * replaces — the author needs to know the cap is visible, and the renderer
  * author needs to know it is owed.
+ *
+ * ⚠️ NO CONSUMER READS THIS KEY YET — recorded, not repaired (#19228).
+ * Measured 2026-09-21T06:40Z at the pin this repo builds against
+ * (`.objectui-sha` = `87af769e9`), by `git grep` over all 8,228 files tracked
+ * at that commit: `.kanban.limit` / `.gallery.limit` / `.timeline.limit` →
+ * **0** read points, against **8** for the identically-shaped control
+ * `.kanban.groupByField` / `.gallery.coverField` / `.timeline.scale` on the
+ * same instrument. The row caps objectui DOES read are two other keys: a
+ * saved view's `pagination.pageSize`, else that view's FLAT `limit`
+ * (`core/src/data-scope/element-data-source.ts:237-241`, `savedViewLimit`),
+ * and the element block's own flat `limit` (`plugin-timeline/src/
+ * ObjectTimeline.tsx:407`, `plugin-kanban/src/ObjectKanban.tsx:676`).
+ * `ListView`'s `baseProps` (`plugin-list/src/ListView.tsx:2840-2865`) carries
+ * no `limit` on any branch, so a parsed view's per-kind ceiling reaches no
+ * query at all — it is declared-and-dropped, the ADR-0049 class, at birth.
+ *
+ * ⛔ Which of the three row bounds wins is NOT decided here and NOT implied by
+ * this declaration: #19228 opens that question and picks nothing, and neither
+ * does this note. What is recorded is only what each key reaches today.
  */
 const rowLimitKey = (view: RowLimitView) =>
   z.number().int().positive().default(DEFAULT_VIEW_ROW_LIMIT).describe(