fix(spec): one row bound per view — retire the unpublished per-kind view limit

[objectstack-fleet]

Part of #19228

Clause-②: no

Rewritten short by the dispatching seat (2026-09-23T08:08Z). The developer's measurements are in its report on #19228; the at-tier review record is 5791323483 on this PR.

What changes

Ruling D (#19228, 5789634193): a view carries one row bound, pagination.pageSize. The per-kind view limit added for #17393 was never published (npm latest is 17.4.0; the key is absent from its tarball), so it is removed before a release carries it.

• GalleryConfigSchema / KanbanConfigSchema / TimelineConfigSchema lose limit; rowLimitKey, DEFAULT_VIEW_ROW_LIMIT and KanbanConfigParsed go with it (Kanban has one shape again, re-pinned per ADR-0122).
• A written limit in those blocks is refused as an unknown key, and the refusal names both alternatives: pagination.pageSize on a view, or the flat limit on a page component node.
• pagination.pageSize's description carries the truncation obligation that limit's description carried.
• The object-kanban / object-timeline component limit keys and their precedence are unchanged; only text describing the removed view-level key was deleted.
• The pending release note .changeset/17393-view-row-ceiling.md is deleted, and the pending .changeset/19228-view-row-limit-route-record.md loses its section about the view-level limit, so no release announces a key that does not ship. A patch changeset covers the description change.

Net: 16 files, +80 / −515.

⚠️ Check Changeset is red on purpose

This PR corrects two PENDING release notes instead of adding one, which check-empty-changeset.mjs names the DELIBERATE CORRECTION class. The workflow (pr-automation.yml, route 0) says to leave the check red and get the correction confirmed in writing on the PR; Check Changeset is not a required context. The two notes and what changed under them are listed above. Maintainer confirmation requested on this PR.

Not in this PR

objectui still spreads a view's kanban / gallery / timeline block onto the rendered node; reading pagination.pageSize as the fetch ceiling and showing the truncation signal there is objectui work. objectui#7390 is closed, so that work has no open card; triage is asked to route it (#19228).

维护者速读

• 看板、画廊、时间线视图原来各有一个「最多显示多少条」的 limit,从没发布过;按您的裁决 D,改为每个视图只用 pagination.pageSize 一个上限。
• 两条尚未发布的更新说明被删 / 删减,免得下次发版宣布一个不存在的设置;Check Changeset 因此按规定保持红色,需要您在本 PR 上书面确认一句。

🤖 Generated with Claude Code

https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1

[github-actions]

📓 Docs Drift Check

12 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️ 4 changed file(s) yielded no anchor (packages/spec/api-surface/ui.json, packages/spec/authorable-defaults/ui.json, packages/spec/authorable-surface/ui.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 4 changed file(s) yielded no anchor (packages/spec/api-surface/ui.json, packages/spec/authorable-defaults/ui.json, packages/spec/authorable-surface/ui.json, …) — pages documenting those are invisible to this run
• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 136 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a5afe382baa081da06ca5059ceed4a2ecc339828 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e764812c87c11d3b12ab1ef419060e6ede14f2e1 — the merge of head ff13eece89e69e5bccaa63d47cc43598b81aefed into base a5afe382baa081da06ca5059ceed4a2ecc339828, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e764812c87c11d3b12ab1ef419060e6ede14f2e1 && git checkout e764812c87c11d3b12ab1ef419060e6ede14f2e1
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a5afe382baa081da06ca5059ceed4a2ecc339828 ff13eece89e69e5bccaa63d47cc43598b81aefed && git checkout -B drift-repro a5afe382baa081da06ca5059ceed4a2ecc339828 && git merge --no-ff ff13eece89e69e5bccaa63d47cc43598b81aefed

node scripts/docs-audit/affected-docs.mjs --json a5afe382baa081da06ca5059ceed4a2ecc339828

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ff13eece89e69e5bccaa63d47cc43598b81aefed

_{Reviewed and posted 2026-09-23T08:07Z by the at-tier review subagent the domain:spec#5 seat spawned — the constant CONTRACT_REVIEW_TIER names the tier. Read: the whole diff fae870352e..ff13eece89 (5 commits, 16 files, +80/−515; merge-base re-derived against origin/main a5afe382ba = fae870352e), card #19228 body and all 22 comments, the PR body and commits, the head's 46 check-runs, AGENTS.md, contract-review.md, pr-automation.yml, ci.yml, pack-smoke-optin.yml, check-empty-changeset.mjs, build-schemas.ts (proofs), ADR-0122 D3, the retirement skill, and the head state of every trimmed docblock. Ran (own measurements, in a sibling worktree objectstack-rev-19809 with an offline frozen install, removed afterwards; objectui read only by git show/git grep at the pin): safeParse probes with envelope and negative controls; vitest on the three touched test files; tsc --noEmit -p tsconfig.test.json with a negative-control pin; npm pack of 17.4.0 and 17.0.0-rc.6; repo-wide normaliser sweep; in-repo document census; all-remote-tips sweep of objectui; job log of the red check. NOT MEASURED: the Check Changeset job's steps after its failing step (unreached in CI, not re-run); the derived gate family (not re-run by rule); objectui behaviour in a browser; a YAML-style document census (its control lit 0, so it is not a reading).}

① Derived judgments

1. Removed key never published — RIGHT. npm time for @objectstack/spec: 166 versions, 9 prereleases, newest publish 17.4.0 at 2026-09-09T03:57:51Z, registry modified 2026-09-09; dist-tags latest=17.4.0, rc=17.0.0-rc.6; PR feat(spec): declare the author-settable row ceiling for the page-shaped view configs #19226 merged 2026-09-20, so no published version can carry the key. Packed both tagged tarballs: DEFAULT_VIEW_ROW_LIMIT|KanbanConfigParsed|rowLimitKey|ROW_LIMIT_SUBJECT|visible truncation signal → 0 files in each (control KanbanConfigSchema 31 / 51 files). Their json-schema for KanbanConfig / GalleryConfig / TimelineConfig: additionalProperties: false and no limit; PaginationConfig pageSize default 25, "Number of records per page".

2. A document writing the removed key — RIGHT, measured at head. GalleryConfigSchema / KanbanConfigSchema / TimelineConfigSchema.safeParse with limit: 10 → unrecognized_keys, keys: ["limit"], message carrying the bullet 「This block declares no limit. Delete the key: the row bound is pagination.pageSize on a view, or the flat limit on a page component node.」 Envelope controls (same block without the key) parse, and the parsed output carries no limit (timeline → {startDateField,titleField,scale:'week'}; kanban output == input). Negative control zzBogus__ is refused WITHOUT the bullet, so the prescription is name-specific. ListViewSchema: minimal kanban document parses; + kanban.limit refused at path ["kanban"] with the bullet; + pagination.pageSize: 50 parses; + flat limit refused on the list view. ObjectTimelinePropsSchema: nested timeline.limit refused with the same bullet (path ["timeline"]); flat limit: 10 accepted; minimal node parses; bogus key refused. Gantt / calendar / map / tree refuse limit as before (no bullet). Relative to 17.4.0 the verdict on limit is unchanged — refused there too; only the message gains the prescription.

3. Export removals safe — RIGHT. objectui pin 87af769e9a3ee28ace099fdd653d3ebd79fe82e2 (object present in the sibling checkout, whose HEAD is 0cf2d664): DEFAULT_VIEW_ROW_LIMIT|KanbanConfigParsed|rowLimitKey → 0 files (control KanbanConfigSchema 10). All 1059 distinct objectui remote tips, *.ts,*.tsx: \.(kanban|gallery|timeline)\??\.limit\b → 0 (exit 1); control \.(kanban|gallery|timeline)\??\.(groupByField|scale|coverField)\b → 2314 hits / 12 distinct paths on the same ref set. In-repo at head, normaliser sweep (strip * / //, drop backticks, join ' + ' seams, collapse whitespace) over .ts/.tsx/.md/.mdx/.mjs/.json excluding node_modules/dist/.cache: DEFAULT_VIEW_ROW_LIMIT 0, rowLimitKey 0, ROW_LIMIT_SUBJECT 0, kanban.limit / gallery.limit / timeline.limit 0, defaulted to 100 0; KanbanConfigParsed 3, all in the pin test's comments saying it is deleted; control pagination.pageSize lit in .ts (26), .md (10), .mdx (2). Liveness ledger: 0 rows for the three limit keys (control TimelineConfig:scale 2). No other pending changeset names the key. In-repo documents writing limit inside a kanban:/gallery:/timeline: block: 0 (control, a real member in such a block: 25 files). view.form.ts: 0 limit entries. Console Pin Gate would not go red (no import at the pin); it is path-skipped here.

4. Component face unchanged — RIGHT. The seven limit: declarations in component.zod.ts are the same seven lines at base and head (object-kanban :3167→:3146, object-timeline :4216→:4142, both z.number().int().positive().optional()); neither flat describe nor the precedence sentence is in the diff; object-kanban minimal parse carries no limit; flat limit: 10 is accepted on both nodes. What does move on the object-timeline node is the nested timeline.limit, taken by reference from TimelineConfigSchema: accepted-and-defaulted at base, refused at head — a narrowing relative to main only; relative to 17.4.0 that nested key never existed.

5. pagination.pageSize description — true as the contract statement ruling D step 3 orders, with one reading recorded. At the pin, plugin-list/src/ListView.tsx pages only the grid (paginate = currentView === 'grid' && !grouping, :1407), issues $top: effectivePageSize on every fetch (:2356), sets dataLimitReached when items.length >= effectivePageSize (:2410) and renders the cap warning for non-paged views (:4855-4858; its own comment names "pager-less views (gallery/kanban/calendar)"). On that route the sentence describes what happens. plugin-view/src/ObjectView.tsx fetches with a hard-coded $top: 100 (:1096) and only forwards pagination (:2264): there the sentence is an obligation not yet met (objectui work, ③). Wording note: the parenthetical "(kanban, gallery, timeline)" reads as an enumeration while ListView bounds every non-grid kind by the same $top; not false.

6. ADR-0122 pins — RIGHT. KanbanConfigSchema shape at head: groupByField, summarizeField?, titleField?, columns, no default/transform → z.input === z.infer; D3 says one shape gets only the bare name, so deleting KanbanConfigParsed (and its api-surface / export-origins rows) is the rule, not a choice. Iso882 is unique and the highest id; Iso829 is not redeclared. tsc --noEmit -p tsconfig.test.json: 0 errors in the pin file; a scratch negative control asserting GalleryConfigSchema isomorphic → TS2344, so the instrument is live; the 257 errors it reports elsewhere sit in 53 files all within test-typecheck-debt.json, none over its ledger (view.test.ts 8 = ledger 8; component.test.ts 0). vitest on the pin test + view.test.ts + component.test.ts: 3 files, 817 passed (pin count 790).

7. Generated artifacts — consistent with the source by reading. authorable-surface / authorable-defaults lose exactly the three limit rows; the 9 view.mdx rows and 1 component.mdx row for the key are gone; the 3 pageSize rows and the timeline door row are byte-equal to their describes; the kanban summary column drops its … because the block has 4 members now. check:docs / check:api-surface ran green inside the required TypeScript Type Check job.

Sentences that ship or stand (each checked; none found false): the guidance string (true; carries no tracker number); view.zod.ts:1140 「timeline is also nested on object-timeline」 (true, component.zod.ts:4129); the timeline door describe's six-member list (equals the measured shape keys); the trimmed object-kanban docblock and the OBJECT_TIMELINE docblock read whole at head — coherent, and the anchors they keep (ElementDataSourceGate.tsx:316-331, :192-194, ObjectTimeline.tsx:407, element-data-source.ts:238-241) re-read at the pin; .changeset/19228-pagesize-fetch-ceiling.md — "accept set and default (25) unchanged", "no export or authorable key moves relative to the last published release" — true against the 17.4.0 tarball; the trimmed .changeset/19228-view-row-limit-route-record.md — every remaining sentence re-checked (flat limit refused, pagination.pageSize: 50 parses, no tombstone) and nothing left describes the removed key; view.test.ts header — ^\s*limit: in view.zod.ts → 0 (control pageSize: 1) and all seven kinds refuse it; pin-test comments (789→790, Iso829 vacant) — true. PR body: "16 files, +80/−515" ✓; "latest 17.4.0, key absent from its tarball" ✓; "Check Changeset is not a required context" ✓ (absent from AGENTS.md's seven; the workflow's route-0 text says so); "objectui still spreads…" ✓ (four flat spreads at the pin: ListView.tsx:2979, ObjectView.tsx:1638 / :1697 / :1725). Two imprecisions, non-blocking: (a) "the refusal points to pagination.pageSize (or, on an object-timeline node, the node's own flat limit)" — the bullet names BOTH alternatives on every face; it is not face-specific; (b) the follow-up carrier objectui#7390 was closed not_planned at 2026-09-23T06:52Z, before this PR opened.

② Semver level

@objectstack/spec: patch with Clause-②: no on the PR body and the claim — RIGHT. Against the last published release (17.4.0): no accept set moves (limit was refused on the three blocks there and is refused now; pageSize stays int().positive().default(25)), no export moves (the two removed exports never shipped), one description changes. The minor (widening) note this PR deletes announced a widening that never published, so deleting it is what keeps the next CHANGELOG true. No ADR-0087 conversion or D2/D3 registry row is owed (nothing published is retired), matching ruling D step 5; check:adr-0087-registration has no declared-breaking changeset to read. The .strict() retirement route (delete the key + guidance) is the one the retirement skill's table and AGENTS.md step 3 prescribe.

③ Boundary flags

(1) Strict-object guidance added so the build's authorable-surface gate accepts the removal — SOUND, not a workaround. build-schemas.ts proof 4 (#18301) is exactly "key deleted from a strictObject shape whose guidance names it, so an author is answered with the prescription"; it is also the tombstone AGENTS.md requires when an authorable key is removed, and the measured refusal carries the prescription on every face. The dev's note that check (a) has no never-published arm is a tooling-wording matter, not a gap.

(2) Deleting the component-face describe clauses about the nested timeline.limit (c4f3dfb772) — SOUND; keep it (dev's option A). ObjectTimelinePropsSchema.timeline is TimelineConfigSchema by reference, so the nested key leaves with the view key and the old describe ("accepted, defaulted to 100") would ship false. Ruling D item 4 protects the flat limit keys and their precedence, and those are byte-identical (①4). Text only; no .omit fork was introduced.

(3) Trimming and deleting the two pending release notes — SOUND and gate-consistent. Ruling D step 1 orders the 17393 note rewritten or deleted so no release carries the key; the route-record note's deleted section described the same key and its applied default, and its remaining text is verified true. The foreign-changeset rule (#17712) reds on D / M by design and names the DELIBERATE CORRECTION remedy: say so on the PR, get it confirmed in writing, leave the check red, never skip-changeset. The PR body does that and asks the maintainer. ⚠️ A contract-review PASS is not that confirmation: the seat lands only with the maintainer's written word on the PR (or by citing ruling D as it).

Follow-ups the seat carries (not grounds): (a) packages/spec/src/ui/view.form.ts:47-61 shows pagination only inside table_options (visibleWhen: "data.type == 'grid' || data.type == null"), so after D the only row bound of a kanban / gallery / timeline view is not editable in the Studio form — a card, not this PR; (b) objectui's plugin-view route fetches with a hard-coded $top: 100, so "pageSize is the fetch ceiling" is unmet there, and the PR body's carrier objectui#7390 is closed not_planned — name a live carrier.

CI at head — 46 runs, de-duplicated by name keeping the latest started_at → 35 names: 30 success, 4 skipped, 1 failure. All seven required contexts (Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard) are success. Skipped, each by its own if:: Check PR Size and Auto Label — their latest runs (07:32Z) came from the edited events of the body rewrite and both jobs carry github.event.action != 'edited' (their opened runs at 07:24–07:25Z succeeded); Console Pin Gate — needs.filter.outputs.console != 'false' behind a paths filter on .objectui-sha / console scripts, none touched; Packed-tarball smoke (opt-in) — requires the needs:pack-smoke label. Failure: Check Changeset (three runs, all failure) — job log read: "adds 1 changeset", empty-frontmatter rule ✓, then check-empty-changeset.mjs exits 1 naming exactly .changeset/17393-view-row-ceiling.md (DELETED) and .changeset/19228-view-row-limit-route-record.md (CHANGED) with the two-class remedy — red by design (route 0) and not a required context. Consequence to record: the job's later steps (ADR-0087 registration, allow-major read, check-changeset-no-major level axis) are unreached on this head — their if: carries no always() — so they are NOT MEASURED here; the level axis reads only the body's Clause-②: line as its carrier (check-changeset-no-major.mjs:1455), which says no beside a patch changeset, the consistent pair.

Model identifiers: swept the 5 commit messages (model-free trailer pair), all 80 added lines, and the PR title and body for every model-identifier spelling — 0 matches; control (AGENTS.md) 2.

Blocking: none.
Non-blocking: PR body — (a) refusal wording is not face-specific, (b) closed carrier objectui#7390; pageSize describe parenthetical reads as exhaustive; Studio form hides pagination for non-grid kinds (card to file); the maintainer's written confirmation on the PR for the two corrected notes is still owed before landing.

Implemented-by: claude/issue-19228-view-row-ceiling-retire
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1 — at-tier review subagent spawned by the domain:spec#5 seat

VERDICT: PASS

[objectstack-fleet]

落地状态 —— 达档复核 PASS;只差维护者对两条待发布说明的书面确认

domain:spec seat 5(session_01Sfe5YjBLwB9J3y8fvm2xq1),2026-09-23T08:09Z。

• 复核: 达档记录 5791323483,VERDICT: PASS(本席已从复核子代理 transcript 读到服役档符合 CONTRACT_REVIEW_TIER)。两个载体已剥除 needs:contract-review,引用该记录。
• CI(head ff13eece89): 7 个 required 全绿;4 个 skipped 各为自身 if:;1 个红 —— Check Changeset。

Check Changeset 为什么红,以及为什么不补救它: 本 PR 没有新增 changeset,而是更正了两条尚未发布的说明:删除 .changeset/17393-view-row-ceiling.md(它宣布的 limit 从未发布,留着会让下一版 CHANGELOG 宣布一个不存在的设置);删减 .changeset/19228-view-row-limit-route-record.md 里描述同一个键的那一节。check-empty-changeset.mjs 把这归为 DELIBERATE CORRECTION。pr-automation.yml 的 route 0 写明:⛔ 不贴 skip-changeset、在 PR 上书面确认、让这项检查保持红色;Check Changeset 不是 required context。SKILL 的「带红入队」三条逐条核过:① 源码自述按设计而红 —— 是;② 该工作流只挂 pull_request,不跑 merge_group —— 是;③ 本条评论记明门与因 —— 是。

⏳ 待办: 维护者在本 PR 上书面确认这两条更正(一句即可)。收到之后,本席转 ready 并开启 auto-merge。

---

Generated by Claude Code