@@ -44,6 +44,8 @@ import {
   ViewItemSchema,
   ViewMetadataSchema,
   VIEW_METADATA_MEMBERS,
+  TreeConfigSchema,
+  DEFAULT_VIEW_ROW_LIMIT,
 } from './view.zod';
 
 import {
@@ -4660,3 +4662,112 @@ describe('ListViewSchema — `viewType` is not a spelling of `type` (#16577)', (
     expect((r as { data: { type?: unknown } }).data.type).toBe('grid');
   });
 });
+
+
+// ============================================================================
+// [#17393] The author-settable row ceiling on the page-shaped view configs.
+//
+// A protocol-first card: objectui caps kanban and timeline by author choice off
+// a key `@objectstack/spec` never declared (`$top: schema.limit ?? DEFAULT_*_LIMIT`),
+// and the gallery — the third page-shaped view — caps not at all. These pins
+// hold the new declaration to the three things a ceiling has to be: APPLIED
+// (the default the prose states is the default the parse produces), BOUNDED
+// (a value that could not cap a fetch is refused by name), and SCOPED (the
+// non-grid four keep objectui#7210's platform ceiling and do not gain an
+// authorable one).
+// ============================================================================
+
+describe('view row ceiling — `limit` on the page-shaped view configs (#17393)', () => {
+  /**
+   * One minimal, parse-clean block per page-shaped config, so every verdict
+   * below is about `limit` alone rather than about a missing sibling key.
+   */
+  const PAGE_SHAPED = [
+    ['gallery', GalleryConfigSchema as unknown as z.ZodTypeAny, {}],
+    ['kanban', KanbanConfigSchema as unknown as z.ZodTypeAny, { groupByField: 'status', columns: ['name'] }],
+    ['timeline', TimelineConfigSchema as unknown as z.ZodTypeAny, { startDateField: 'start_date', titleField: 'name' }],
+  ] as const;
+
+  /** The `limit` member's own `.describe()` text, off the built shape. */
+  const describeOf = (schema: z.ZodTypeAny): string =>
+    (schema as unknown as { shape: Record<string, { description?: string }> }).shape.limit?.description ?? '';
+
+  it('applies the ceiling it declares when the author writes none', () => {
+    for (const [label, schema, minimal] of PAGE_SHAPED) {
+      const parsed = schema.parse({ ...minimal }) as { limit?: unknown };
+      expect(parsed.limit, label).toBe(DEFAULT_VIEW_ROW_LIMIT);
+    }
+  });
+
+  it('accepts an authored ceiling as a MEMBER, with both controls firing on the same shape', () => {
+    for (const [label, schema, minimal] of PAGE_SHAPED) {
+      // CONTROL-1 — this surface CAN refuse a key, so acceptance below means something.
+      const control = schema.safeParse({ ...minimal, zzUnlikelyBogusKey__: 7 });
+      expect(control.success, label).toBe(false);
+      expect(JSON.stringify((control as { error?: z.ZodError }).error?.issues), label)
+        .toContain('unrecognized_keys');
+
+      // CONTROL-2 — the refusal is about the NAME: the same block without it parses.
+      expect(schema.safeParse({ ...minimal }).success, label).toBe(true);
+
+      // PROBE — the authored value SURVIVES the parse; it is not merely tolerated.
+      const probe = schema.safeParse({ ...minimal, limit: 25 });
+      expect(probe.success, label).toBe(true);
+      expect(((probe as { data?: { limit?: unknown } }).data)?.limit, label).toBe(25);
+    }
+  });
+
+  it('refuses a value that could not bound a fetch — and refuses it BY NAME', () => {
+    for (const [label, schema, minimal] of PAGE_SHAPED) {
+      for (const bad of [0, -1, 2.5, '100', null] as const) {
+        const at = `${label} limit=${JSON.stringify(bad)}`;
+        const result = schema.safeParse({ ...minimal, limit: bad });
+        expect(result.success, at).toBe(false);
+        const issues = (result as { error?: z.ZodError }).error?.issues ?? [];
+        expect(issues.some((issue) => issue.path[0] === 'limit'), `${at}: ${JSON.stringify(issues)}`)
+          .toBe(true);
+      }
+    }
+  });
+
+  it('states the default it ACTUALLY applies — prose and schema pinned to each other', () => {
+    for (const [label, schema, minimal] of PAGE_SHAPED) {
+      const description = describeOf(schema);
+      const stated = /default (\d+)/.exec(description);
+      expect(stated, `${label}: ${description}`).not.toBeNull();
+      const applied = (schema.parse({ ...minimal }) as { limit: number }).limit;
+      expect(Number(stated?.[1]), `${label}: ${description}`).toBe(applied);
+    }
+  });
+
+  it('tells the author the renderer owes a VISIBLE truncation signal', () => {
+    // ⛔ The signal itself is the renderer's half and cannot be enforced from a
+    // schema. What the protocol can do — and what objectui#7390's ruling turns
+    // on — is say the cap is owed a signal, so that "bounded and silent" is
+    // never read as the finished job.
+    for (const [label, schema] of PAGE_SHAPED) {
+      expect(describeOf(schema), label).toContain('visible truncation signal');
+    }
+  });
+
+  it('leaves the non-grid four WITHOUT an authorable ceiling (objectui#7210 keeps theirs)', () => {
+    // The card scopes those four out by name: their rows are capped by a
+    // platform constant the renderer owns, because a gantt range, a map camera
+    // fit and a tree parent chain are computed over the whole set. An
+    // authorable ceiling there would be surface no renderer reads.
+    const NON_GRID_FOUR = [
+      ['gantt', GanttConfigSchema as unknown as z.ZodTypeAny],
+      ['calendar', CalendarConfigSchema as unknown as z.ZodTypeAny],
+      ['map', ListMapConfigSchema as unknown as z.ZodTypeAny],
+      ['tree', TreeConfigSchema as unknown as z.ZodTypeAny],
+    ] as const;
+
+    for (const [label, schema] of NON_GRID_FOUR) {
+      const result = schema.safeParse({ limit: 10 });
+      expect(result.success, label).toBe(false);
+      const unrecognized = ((result as { error?: z.ZodError }).error?.issues ?? [])
+        .find((issue) => issue.code === 'unrecognized_keys');
+      expect(JSON.stringify(unrecognized), label).toContain('limit');
+    }
+  });
+});
@@ -1128,6 +1128,99 @@ export const GroupingConfigSchema = lazySchema(() => strictObject({
   + 'AND-ed into the view filter. Compiled by `compileListViewGroupQuery` / `compileListViewGroupRowsQuery`',
 ));
 
+/*
+ * ---------------------------------------------------------------------------
+ * `limit` — the author-settable row ceiling of the page-shaped views (#17393)
+ * ---------------------------------------------------------------------------
+ *
+ * Declared here because the PROTOCOL was the thing that was wrong: two
+ * renderers already cap by author choice, and the key they read was never a
+ * protocol key. Measured in objectui at `dda8f3815d`:
+ *
+ *   - `ObjectKanban.tsx:573` fetches `$top: schema.limit ?? DEFAULT_KANBAN_LIMIT`
+ *     (`= 100` at `:84`), and that `limit` is declared in `@object-ui/types`
+ *     alone (`zod/objectql.zod.ts:1762`, `z.number().int().positive().optional()`);
+ *   - `ObjectTimeline.tsx:328` fetches `$top: schema.limit ?? DEFAULT_TIMELINE_LIMIT`
+ *     (`= 100` at `:29`), with `limit` on that component's own props interface
+ *     (`:129`) and on no published schema at all;
+ *   - `ObjectGallery.tsx` sends no `$top` and reads no ceiling at all — the
+ *     unbounded fetch objectui#7390 is ruled to close by reading this key.
+ *
+ * Consumer-local author-settable keys the protocol never declared are the
+ * divergence the contract-first directive forbids, so the knob enters the
+ * protocol first and the three spellings come under one declaration (the
+ * director seat's amendment of 2026-09-10T11:0xZ on objectui#7390, on the
+ * maintainer's principle 「我们的项目以objectstack 协议为准，文档应该以实际实现
+ * 为准。协议不正确的应该先修改协议。」).
+ *
+ * ## Why on the per-view config blocks, and not as a member of the list view
+ *
+ * The alternative shape — one row ceiling on {@link ListViewShapeSchema}
+ * itself — is rejected on three properties of this tree:
+ *
+ *   1. The base shape ALREADY carries the row-bounding knob every view type
+ *      reaches: `pagination.pageSize` ({@link PaginationConfigSchema}, default
+ *      25). A second base-level row key would leave one view with two
+ *      base-level row bounds and no declared precedence between them — and the
+ *      `virtualScroll` tombstone at the bottom of this same shape prescribes
+ *      `pagination` for exactly that question.
+ *   2. A base member is reachable from EVERY `type`, the non-grid four
+ *      (gantt / calendar / map / tree) included. Their ceiling is a platform
+ *      constant the renderer owns (objectui#7210) and this card does not touch
+ *      them, so a base member would publish an authorable ceiling on four view
+ *      kinds no renderer reads — declared-but-unenforced on the day it lands.
+ *   3. The per-kind block is what actually REACHES the renderer: objectui's
+ *      `ListView` merges `schema.<kind>` into the generated node — its kanban
+ *      branch spreads the rest of the block flat onto `object-kanban`, so
+ *      `kanban.limit` lands exactly where `schema.limit` is read — while a
+ *      base-level key is forwarded into no per-kind node at all.
+ *
+ * The NAME is `limit` for the same reason: it is the name the consumer already
+ * reads, so this declaration absorbs the two consumer-local keys instead of
+ * buying a second divergence spelled differently.
+ *
+ * ⚠️ NOT the kanban LANE's `limit`. objectui's node-level
+ * `ObjectKanbanLaneSchema.limit` is a WIP warning threshold that never reaches
+ * a query; no lane object exists on this face at all
+ * ({@link KanbanConfigSchema}'s `columns` is a list of card FIELD names), so
+ * the two cannot be confused here.
+ */
+export const DEFAULT_VIEW_ROW_LIMIT = 100;
+
+/** What a page-shaped view's ceiling bounds, per view type. */
+const ROW_LIMIT_SUBJECT = {
+  gallery: 'cards the gallery fetches and draws',
+  kanban: 'records the board fetches across all its lanes',
+  timeline: 'rows the timeline fetches onto its rail',
+} as const;
+
+/** The three view configs that cap by AUTHOR choice (not by platform ceiling). */
+type RowLimitView = keyof typeof ROW_LIMIT_SUBJECT;
+
+/**
+ * The `limit` declaration for one page-shaped view config.
+ *
+ * The default is APPLIED, not merely described: a `.describe()` naming a
+ * default the schema does not apply is a second contract that nothing
+ * enforces, and the two drift the first time either is edited. The agreement
+ * is pinned from both sides in `view.test.ts` (#17393) — the parsed default is
+ * compared against the number the describe text states.
+ *
+ * ⛔ The truncation signal is the renderer's half and cannot be enforced from
+ * here; it is stated in the describe because a bounded-and-silent view reads
+ * as complete, which is worse than the unbounded-and-silent one this key
+ * replaces — the author needs to know the cap is visible, and the renderer
+ * author needs to know it is owed.
+ */
+const rowLimitKey = (view: RowLimitView) =>
+  z.number().int().positive().default(DEFAULT_VIEW_ROW_LIMIT).describe(
+    `Row ceiling — the most ${ROW_LIMIT_SUBJECT[view]}, sent as the query \`$top\`; default `
+    + `${DEFAULT_VIEW_ROW_LIMIT} when the key is absent. When the ceiling APPLIES (the filtered `
+    + 'set is larger than it), the renderer must show a visible truncation signal saying what is '
+    + 'on screen is not the whole set — a bounded view that looks complete is worse than an '
+    + 'unbounded one.',
+  );
+
 /**
  * Gallery View Configuration (Airtable-style)
  * Configures card layout for gallery/card views.
@@ -1141,6 +1234,7 @@ export const GalleryConfigSchema = lazySchema(() => strictObject({
   cardSize: z.enum(['small', 'medium', 'large']).default('medium').describe('Card size in gallery view'),
   titleField: z.string().optional().describe('Field to display as card title'),
   visibleFields: z.array(z.string()).optional().describe('Fields to display on card body'),
+  limit: rowLimitKey('gallery'),
 }).describe('Gallery/card view configuration'));
 
 /**
@@ -1163,6 +1257,7 @@ export const TimelineConfigSchema = lazySchema(() => strictObject({
     ),
   colorField: z.string().optional().describe('Field to derive each item color from (it names a field, not a color): the option color declared on that field for the record value, else the value itself when it already is a color literal (hex, rgb() or hsl()), else the timeline default marker color'),
   scale: z.enum(['hour', 'day', 'week', 'month', 'quarter', 'year']).default('week').describe('Default timeline scale'),
+  limit: rowLimitKey('timeline'),
 }).describe('Timeline view configuration'));
 
 /**
@@ -1466,6 +1561,7 @@ export const KanbanConfigSchema = lazySchema(() => strictObject({
    */
   titleField: z.string().optional().describe('Field displayed as the card title. Omit to fall back to the record display name (ADR-0079 resolver chain)'),
   columns: z.array(z.string()).describe('Fields to show on cards'),
+  limit: rowLimitKey('kanban'),
 }));
 
 /**