fix(spec): the changeset still asserted what round 4 retracted — and three wordings overstated

Round 4 touched four files and not the changeset, so the tree carried both the
retracted claim and the corrected one at once. The changeset is the published
CHANGELOG entry for @objectstack/spec, an author-facing surface, which makes
that round 2's lesson repeated inside the tree instead of in the PR body.

1. Changeset 'What the published text said' rewritten to the round-4 claim:
   'only when unset' is exactly right for this face; the accept set is a
   SUBSET of isUsableRowLimit so 'set but not usable' is empty; the view half
   is pagination.pageSize ALONE, with savedViewLimit's flat view.limit named
   as the saved-view RECORD face it belongs to. Grade unchanged at patch --
   this is text, not level.

2. 'the SAME set this key declares' overstated and is now the derivable
   claim, accept-set SUBSET-OF usable-set, with the separating witness:
   2**53+2 is refused here (zod 4 .int() is safe-integer, too_big) and
   Number.isInteger calls it usable. Verified by parse, not asserted.
   The test title moves the same way and the witness is pinned as a case.

3. The test comment claimed 'either side widening reds this'. Half wrong, and
   now stated asymmetrically: the SPEC side reds (nullable, a 0 sentinel,
   dropping .int(), adding a .default() each fail a specific expect), but the
   GATE side CANNOT -- usableToTheGate is a transcription of isUsableRowLimit
   dated to pin 87af769e9, not an import, so a rewrite at objectui HEAD leaves
   this green. It refreshes only on a pin bump, by hand.

4. The instrument partition was off by one label: ListView.kanbanOptionsBag
   Canonical-8193.test.tsx:99 is an it() title string, not a comment. Now 2
   comments, 1 test-title string, 2 quoted-pin lines -> 8 executable of 13.
   The spread predicate's exclusion list also gains ListView.tsx:3044-3046
   (mergedGallery, nested) and app-shell ObjectView.tsx:1284 (a write back
   into a view document's own block, not a node build).

No describe changed, so no .mdx regenerates; check:generated is green without
--fix, which is the prediction this round was able to state in advance.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UDXER3sdqfeVYpEWZs5mZx

Author: claude

.changeset/19228-view-row-limit-route-record.md

@@ -9,18 +9,29 @@ to the same values before and after. ⛔ No `.default()` moves, ⛔ no precedenc
 of the per-kind view `limit`, a view's `pagination.pageSize` and a component's flat `limit`
 should win is the open half of #19228 and is not answered here.
 
-## What the published text said, and what the consumer does
-
-`ObjectKanbanPropsSchema.limit` told authors that a bound view's `pagination.pageSize`
-「fills it only when unset」. Measured first-hand at the objectui pin this repo builds against
-(`.objectui-sha` = `87af769e9`), the branch is `if (!fromView || !isUsableRowLimit(authored))`
-(`react/src/element-data-source/ElementDataSourceGate.tsx:316-331`): the view's cap ALSO lands
-when the key is set to a cap the contract refuses — zero, negative or fractional — with
-`describeDisplacedRowLimit` telling the author. Unset is one arm of that guard, not the whole of
-it. The view half is likewise not `pagination.pageSize` alone: `savedViewLimit` reads
-`pagination.pageSize`, else that view's flat `limit`
-(`core/src/data-scope/element-data-source.ts:237-241`). The describe now states the guard as
-implemented.
+## What the published text said, and what an author can actually reach
+
+`ObjectKanbanPropsSchema.limit` tells authors that a bound view's `pagination.pageSize` fills it
+「only when unset」. Measured first-hand at the objectui pin this repo builds against
+(`.objectui-sha` = `87af769e9`), that sentence is exactly right for this face, and the describe
+now says WHY rather than leaving it to look narrower than the mechanism.
+
+The gate's branch is `if (!fromView || !isUsableRowLimit(authored))`
+(`react/src/element-data-source/ElementDataSourceGate.tsx:316-331`), and `isUsableRowLimit` is
+`typeof v === 'number' && Number.isInteger(v) && v > 0` (`:192-194`). Every cap this key ACCEPTS
+is one that predicate already calls usable — the accept set is a subset of the usable set — so
+across the whole accept set the guard has exactly two outcomes and 「set but not usable」 is
+empty. The extra arm, a cap displaced and reported because it is zero, negative or fractional,
+is reachable only for a node this contract refuses, so it is recorded in the docblock rather
+than in an author-facing sentence.
+
+The view half is `pagination.pageSize` ALONE on this face. `savedViewLimit` does fall back to a
+flat `view.limit` (`core/src/data-scope/element-data-source.ts:237-241`), but that names a
+saved-view RECORD as the adapter's `listViews()` returns it — a third face, not an authored view
+document. Measured on this tree: `ListViewSchema` REFUSES a flat `limit` with
+`unrecognized_keys: ["limit"]`, the verdict a bogus key gets, while the same minimal document
+parses with `pagination.pageSize: 50` and with a per-kind `kanban.limit: 50`. No view document
+declares a flat `limit` and none carries a tombstone for one.
 
 ## Where the per-kind VIEW `limit` lands
 

packages/spec/src/ui/component.test.ts

@@ -3857,16 +3857,26 @@ describe('row caps on the object-bound blocks — what #19228 recorded', () => {
     expect(JSON.stringify(control.error?.issues)).toContain('unrecognized_keys');
   });
 
-  it('admits exactly the caps the binding gate calls usable — which is WHY 「unset」 is the whole rule', () => {
+  it('admits only caps the binding gate calls usable — the SUBSET that makes 「unset」 the whole rule', () => {
     // ⛔ Not a prose pin. The published sentence says a bound view's
     // `pagination.pageSize` fills this key only when it is UNSET, and this is
     // the structural fact that makes that true rather than narrow:
     // `ElementDataSourceGate`'s guard is `!isUsableRowLimit(authored)` with
-    // `isUsableRowLimit = typeof v === 'number' && Number.isInteger(v) && v > 0`
-    // — the same set this key declares. So across the whole accept set the
-    // guard has exactly two outcomes, and 「set but not usable」 is empty.
-    // If either side ever widens (a `.nullable()`, a `0` sentinel, a float),
-    // this reds and the sentence has to be rewritten with it.
+    // `isUsableRowLimit = typeof v === 'number' && Number.isInteger(v) && v > 0`.
+    // This key's accept set is a SUBSET of that predicate — ⛔ NOT the same
+    // set; `2 ** 53 + 2` separates them, and the case below pins it. Subset is
+    // the direction the sentence needs: it makes 「set but not usable」 empty
+    // across the whole accept set, so the guard has exactly two outcomes.
+    //
+    // ⚠️ What this pin can and cannot catch, because the two sides are not
+    // symmetric here:
+    //  · SPEC side — reds. A `.nullable()`, a `0` sentinel, dropping `.int()`
+    //    or adding a `.default()` each fail a specific expect below.
+    //  · GATE side — ⛔ CANNOT red. `usableToTheGate` is a TRANSCRIPTION of
+    //    `isUsableRowLimit` as it read at objectui pin `87af769e9`, not an
+    //    import — nothing here resolves into objectui. A rewrite of that
+    //    predicate at objectui HEAD leaves this test green. It is re-read on
+    //    a PIN BUMP, by hand, and that is the only thing that refreshes it.
     const usableToTheGate = (v: unknown): boolean =>
       typeof v === 'number' && Number.isInteger(v) && v > 0;
 
@@ -3884,6 +3894,15 @@ describe('row caps on the object-bound blocks — what #19228 recorded', () => {
       expect(usableToTheGate(cap), `gate also rejects ${JSON.stringify(cap)}`).toBe(false);
     }
 
+    // ⛔ The sets are NOT equal, and this is the witness. `2 ** 53 + 2` is
+    // refused here (zod 4's `.int()` enforces SAFE integers, `too_big`) while
+    // `Number.isInteger` calls it usable. Subset, not coincidence — if this
+    // case ever flips, the docblock sentence built on the subset direction
+    // has to be re-derived rather than reworded.
+    const beyondSafe = 2 ** 53 + 2;
+    expect(kanban.safeParse({ objectName: 'x', limit: beyondSafe }).success).toBe(false);
+    expect(usableToTheGate(beyondSafe)).toBe(true);
+
     // UNSET — accepted, and the one state the gate treats as unauthored.
     const unset = kanban.safeParse({ objectName: 'x' });
     expect(unset.success).toBe(true);

packages/spec/src/ui/component.zod.ts

@@ -3104,10 +3104,14 @@ export const ObjectKanbanPropsSchema = lazySchema(() => strictObject({
    * 2026-09-21T10:20Z. The branch is
    * `if (!fromView || !isUsableRowLimit(authored))`, and
    * `isUsableRowLimit` is `typeof v === 'number' && Number.isInteger(v) && v > 0`
-   * (`ElementDataSourceGate.tsx:192-194`) — the SAME set this key declares,
-   * `z.number().int().positive()`. So for every node this schema ACCEPTS,
-   * `authored` is either absent (not usable ⇒ the view's cap lands) or a
-   * positive integer (usable ⇒ it does not): unset is the only reachable arm.
+   * (`ElementDataSourceGate.tsx:192-194`), and this key's accept set
+   * (`z.number().int().positive()`) is a SUBSET of it — ⛔ not the same set,
+   * and the difference is reachable: `2^53 + 2` is refused here (zod 4's
+   * `.int()` is safe-integer, `too_big`) and `Number.isInteger` calls it
+   * usable. Subset is the direction that matters, and it is the whole
+   * argument: for every node this schema ACCEPTS, `authored` is either absent
+   * (not usable ⇒ the view's cap lands) or a cap the gate already treats as
+   * authored (⇒ it does not). So unset is the only reachable arm.
    * The extra arm — a cap displaced and reported because it is `0`, negative
    * or fractional — is reachable ONLY for a node this contract refuses, so
    * ⛔ it does not belong in an author-facing describe. Pinned structurally

packages/spec/src/ui/view.zod.ts

@@ -1248,10 +1248,14 @@ type RowLimitView = keyof typeof ROW_LIMIT_SUBJECT;
  *     `plugin-list/src/__tests__/ListView.kanbanOptionsBagCanonical-8193.test.tsx:42`,
  *     `:99`, `plugin-view/src/ObjectView.tsx:1695`, and
  *     `types/src/__tests__/object-kanban-group-by-limit-7322.test.ts:146`, `:148`.
- *     ⚠️ Filtering changes that number and the filter must be stated with it:
- *     3 of the 13 are in COMMENTS and 2 more sit inside a quoted source-text
- *     pin, so a reader counting executable reads only gets **8**. All three
- *     readings are of one hit set. A live instrument — and a WRONG answer.
+ *     ⚠️ Filtering changes that number and the filter must be stated with it.
+ *     Of the 13: **2 are COMMENTS** (`ObjectView.galleryBinding-7547.test.tsx:41`,
+ *     `ListView.kanbanOptionsBagCanonical-8193.test.tsx:42`), **1 is an
+ *     `it()` TITLE string** (same file, `:99` — ⛔ not a comment), and **2 are
+ *     lines inside a QUOTED source-text pin**
+ *     (`object-kanban-group-by-limit-7322.test.ts:146`, `:148`). So a reader
+ *     counting executable reads only gets **8**. All three readings are of one
+ *     hit set. A live instrument — and a WRONG answer.
  *  2. ⭐ SPREADS — a spread carries a key without ever spelling it, so it is
  *     the hole instrument 1 cannot see by construction. ⛔ Re-take it by its
  *     PREDICATE, not by its count: **a spread whose target is the object
@@ -1266,7 +1270,12 @@ type RowLimitView = keyof typeof ROW_LIMIT_SUBJECT;
  *     `galleryViewOptions` (`:334`). They build an OPTIONS BAG that feeds
  *     `ListView`'s nested forward, not the object literal an adapter returns
  *     as the node, so the predicate excludes them — deliberately, not by
- *     oversight.
+ *     oversight. Two more the predicate excludes for their own reasons:
+ *     `plugin-list/src/ListView.tsx:3044-3046` (`mergedGallery`) builds a
+ *     NESTED gallery prop, the `...mergedTimeline` family; and
+ *     `app-shell/src/views/ObjectView.tsx:1284`
+ *     (`spec.kanban = { ...(spec.kanban || {}), columns }`) writes back into a
+ *     VIEW document's own block — a metadata write, not a node build.
  *     Under that predicate, at that pin, the VIEW-face per-kind blocks give:
  *       `plugin-list/src/ListView.tsx:2979`   `...restKanban`
  *       `plugin-view/src/ObjectView.tsx:1638`  `...restKanban`