feat(plugin-detail): row caps admit only a positive integer number, and warn on refusal

normalizeLimit (record:activity, record:chatter, record:discussion) and
normalizeHistoryLimit (record:history) no longer run Number(value) before
their integer check. The spec declares limit as z.number().int().positive(),
so a string, boolean or array is refused and falls back to the block default.
Each renderer states the refusal once through console.warn from an effect,
naming the block and the raw value with its type.

The four pins that asserted numeric-string coercion are flipped to refusal
assertions with lit number controls; the two silence pins are flipped to
warning pins.

Author: claude

.changeset/10145-row-cap-admits-only-numbers.md

@@ -0,0 +1,31 @@
+---
+'@object-ui/plugin-detail': minor
+---
+
+feat(plugin-detail): row caps on `record:activity`, `record:history`, `record:chatter` and `record:discussion` admit only a positive integer number, and a refused one warns
+
+`@objectstack/spec` declares `limit` on `RecordActivityProps` (which is also
+`RecordChatterProps.feed`) and on `RecordHistoryProps` as
+`z.number().int().positive()`, and refuses a string, a boolean or an array
+outright. The renderers used to run `Number(value)` before their integer check,
+so they also read `'5'` as 5, `' 5 '` as 5, `'0x10'` as 16, `true` as 1 and `[7]`
+as 7: a second accepted set, wider than the contract (objectui#10145, ruled
+STOP).
+
+Both resolvers (`normalizeLimit`, shared by activity, chatter and discussion,
+and `normalizeHistoryLimit`) now admit only a value whose type is `number` and
+which is a positive integer. Every other authored value falls back to the
+block's default (20 for activity, chatter and discussion; 50 for history). The
+renderer then logs one `console.warn` that names the block and spells the raw
+value with its type (for example `declared limit: "5" (string)`). The warning
+also fires for the fractional, zero, negative, `NaN` and infinite values these
+blocks already refused silently. That matches the "always warn" ruling on
+objectui#10097 and the three objectui#9925 read points. An absent `limit` is not
+a refusal and stays silent.
+
+**Migration.** Stored metadata that spells a row cap as a string (for example
+`limit: '5'`, or `feed: { limit: '5' }` on a chatter or discussion block) now
+drops to the block's default and warns in the console, where it used to be read
+as 5. Write the number instead (`limit: 5`). Publishing such metadata was
+already refused by the spec, so this affects only bodies stored before that
+check, or written around it.

content/docs/plugins/plugin-detail.mdx

@@ -255,7 +255,7 @@ itself, so everything above describes that page too.
 | `types` | Allow-list of feed item types. Recognised entries narrow the feed; unrecognised ones are dropped and named in one `console.warn`. A list that keeps nothing — `types: []`, or one whose every entry is unrecognised — filters to **nothing** and the panel renders an empty timeline, rather than widening back to every kind. Omit `types` for no filter; that is the only value that means it. A recognised entry that **no producer emits** is honoured but named too — see [Feed kinds with no producer](#feed-kinds-with-no-producer). | — |
 | `filterMode` | Which slice the filter dropdown opens on (`all` / `comments_only` / `changes_only` / `tasks_only`). The user can still change it. An unrecognised value falls back to `all`. | — |
 | `showFilterToggle` | Shows/hides that dropdown. | — |
-| `limit` | Items per page; also caps the scoped `sys_activity` read. "Load more" grows the window by this much and re-reads. | — |
+| `limit` | Items per page; also caps the scoped `sys_activity` read. "Load more" grows the window by this much and re-reads. Must be a positive integer **number**: any other value (a string such as `"5"`, a boolean, a fraction, zero or a negative) is ignored, the block uses its default of 20, and one `console.warn` names the value. The same rule applies to `feed.limit` on `record:chatter` / `record:discussion` and to `limit` on `record:history` (default 50). | — |
 | `showCompleted` | Include completed activities (`sys_activity.type = 'completed'`, which surfaces as a `task` item). Off by default, per spec. | — |
 | `unifiedTimeline` | Default `true` mixes field changes and comments in one timeline (Airtable style). `false` un-mixes them: the panel becomes a discussion stream and field changes stay in `record:history`. | — |
 | `showCommentInput` | Shows the composer. | A host discussion context to persist the comment. Without one the feed is read-only and no composer is rendered. |

packages/plugin-detail/src/renderers/__tests__/record-chatter.rowLimitRefusal-10145.test.tsx

@@ -0,0 +1,90 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * `record:chatter` / `record:discussion` REFUSE a `feed.limit` the contract
+ * rejects, and say so (objectui#10145, ruled STOP).
+ *
+ * `RecordChatterProps.feed` is `RecordActivityProps`, whose `limit` is
+ * `z.number().int().positive().default(20)`, so these two blocks resolve their
+ * page size through the same `normalizeLimit` as `record:activity`. Until
+ * objectui#10145 that resolver ran `Number(value)` first and read `'2'` as a
+ * two-row page; the spec refuses a string outright, so the page now falls back
+ * to the default and the renderer names the refused value on the developer
+ * channel.
+ *
+ * The observable is the number of ROOT rows the panel shows: with six comments
+ * on hand, a two-row page shows two, and the default page (20) shows all six.
+ */
+
+import * as React from 'react';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { render, screen, cleanup } from '@testing-library/react';
+import { DiscussionContextProvider } from '@object-ui/react';
+import type { FeedItem } from '@object-ui/types';
+import { RecordChatterRenderer } from '../record-chatter';
+
+/** Six root comments, oldest first. */
+const SIX: FeedItem[] = Array.from({ length: 6 }, (_, i) => ({
+  id: `c${i + 1}`,
+  type: 'comment',
+  actor: 'Ada',
+  body: `Comment number ${i + 1}`,
+  createdAt: `2026-01-0${i + 1}T00:00:00.000Z`,
+})) as FeedItem[];
+
+const handlers = { onAddComment: vi.fn(), onAddReply: vi.fn(), onToggleReaction: vi.fn() };
+
+function mount(type: string, limit: unknown) {
+  return render(
+    <DiscussionContextProvider items={SIX as any} loading={false} {...handlers}>
+      <RecordChatterRenderer schema={{ type, position: 'bottom', feed: { limit } } as any} />
+    </DiscussionContextProvider>,
+  );
+}
+
+const shownRows = () => screen.queryAllByText(/Comment number \d/).length;
+
+describe.each(['record:chatter', 'record:discussion'])('%s — `feed.limit` admits only a positive integer number (objectui#10145)', (blockName) => {
+  let warn: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    cleanup();
+    warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warn.mockRestore();
+  });
+
+  const rowCapWarnings = () =>
+    (warn.mock.calls as unknown[][])
+      .map((args) => args.map((a) => (typeof a === 'string' ? a : String(a))).join(' '))
+      .filter((text) => text.includes('row cap'));
+
+  it('CONTROL — a usable NUMBER cap narrows the page, silently', () => {
+    mount(blockName, 2);
+    expect(shownRows()).toBe(2);
+    expect(rowCapWarnings()).toEqual([]);
+  });
+
+  it.each([
+    ['a numeric string', '2', '"2" (string)'],
+    ['a padded numeric string', ' 2 ', '" 2 " (string)'],
+    ['a boolean', true, 'true (boolean)'],
+    ['an array', [2], '[2] (array)'],
+  ])('refuses %s — the page falls back to the default and one warning names the block', (_label, authored, spelled) => {
+    mount(blockName, authored);
+    // Default page (20) over six rows: all six, ⛔ not the two `Number()` read.
+    expect(shownRows()).toBe(6);
+    const hits = rowCapWarnings();
+    expect(hits).toHaveLength(1);
+    expect(hits[0]).toContain(`${blockName} feed row cap`);
+    expect(hits[0]).toContain(`declared limit: ${spelled}`);
+  });
+});

packages/plugin-detail/src/renderers/__tests__/record-history.rowLimitRefusal-10005.test.tsx

@@ -107,11 +107,25 @@ describe('record:history — a refused row cap falls back, it is not repaired (o
     expect(await topFor({ limit: 10 })).toBe(10);
   });
 
-  it('CONTROL — a numeric string still resolves, as it does on the sibling', async () => {
-    // `normalizeLimit('5')` is pinned to `5` on `record:activity`; this
-    // refusal narrows what is admitted to the contract's value set, it does
-    // not change how a node's value is read.
-    expect(await topFor({ limit: '5' })).toBe(5);
+  it('refuses a numeric STRING — ⛔ no `Number()` coercion (objectui#10145, flipped)', async () => {
+    // FLIPPED from `.toBe(5)`: while the family kept `Number(value)`, `'5'`
+    // resolved to a five-row window. The spec refuses a string outright
+    // (`z.number()`), and the ruling on objectui#10145 is STOP.
+    const top = await topFor({ limit: '5' });
+    expect(top).toBe(RENDERER_DEFAULT);
+    expect(top).not.toBe(5);
+  });
+
+  it('refuses the other shapes `Number()` used to admit (objectui#10145)', async () => {
+    expect(await topFor({ limit: ' 5 ' })).toBe(RENDERER_DEFAULT); // was 5
+    expect(await topFor({ limit: '0x10' })).toBe(RENDERER_DEFAULT); // was 16
+    expect(await topFor({ limit: true })).toBe(RENDERER_DEFAULT); // was 1
+    expect(await topFor({ limit: [7] })).toBe(RENDERER_DEFAULT); // was 7
+  });
+
+  it('CONTROL — the same cap as a NUMBER still passes through', async () => {
+    // Lit control beside the flip above.
+    expect(await topFor({ limit: 5 })).toBe(5);
   });
 
   it('the `properties` read point answers identically — refused', async () => {
@@ -123,61 +137,64 @@ describe('record:history — a refused row cap falls back, it is not repaired (o
   });
 });
 
-describe('record:history — the refusal is SILENT, matching its sibling (objectui#10005)', () => {
+describe('record:history — the refusal is LOUD (objectui#10097, objectui#10145)', () => {
   let warn: ReturnType<typeof vi.spyOn>;
-  let error: ReturnType<typeof vi.spyOn>;
 
   beforeEach(() => {
     cleanup();
     warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    error = vi.spyOn(console, 'error').mockImplementation(() => {});
   });
 
   afterEach(() => {
     warn.mockRestore();
-    error.mockRestore();
   });
 
   /**
-   * Calls on a developer channel that are ABOUT this renderer's row cap.
-   *
-   * ⚠️ Deliberately a FILTER rather than a blanket `not.toHaveBeenCalled()`.
-   * MEASURED on this harness: rendering the timeline emits an unrelated
-   * `react-i18next` `NO_I18NEXT_INSTANCE` warning, and whether it lands inside
-   * this spy's window depends on which OTHER tests in the file ran first — so a
-   * blanket assertion pins test ORDER, not this renderer's silence, and goes red
-   * for anyone who runs this one test alone. The filter is kept wide enough that
-   * a real diagnostic cannot slip through it: any message naming the authored
-   * value, `limit`, a row cap, or this renderer counts.
+   * Calls on the developer channel that are ABOUT this block's row cap. A
+   * FILTER rather than a blanket count: MEASURED on this harness, rendering the
+   * timeline emits an unrelated `react-i18next` `NO_I18NEXT_INSTANCE` warning
+   * whose presence in this spy's window depends on test order.
    */
-  function rowCapDiagnostics(spy: ReturnType<typeof vi.spyOn>): unknown[][] {
-    return (spy.mock.calls as unknown[][]).filter((args) => {
-      const text = args
-        .map((a) => {
-          if (typeof a === 'string') return a;
-          try {
-            return JSON.stringify(a);
-          } catch {
-            return String(a);
-          }
-        })
-        .join(' ');
-      return /limit|row cap|record:history|RecordHistory|-5/i.test(text);
-    });
+  function rowCapWarnings(): string[] {
+    return (warn.mock.calls as unknown[][])
+      .map((args) => args.map((a) => (typeof a === 'string' ? a : String(a))).join(' '))
+      .filter((text) => text.includes('record:history row cap'));
   }
 
   /**
-   * ⭐ This is a DECISION recorded as a pin, not an inevitability. The sibling
-   * this card was told to match — `normalizeLimit` in `recordActivityFeed` —
-   * refuses in silence, so this renderer does too. The three read points
-   * objectui#9925 repaired (`object-kanban`, `object-timeline`,
-   * `record:reference_rail`) refuse LOUDLY instead, so the family currently
-   * holds two answers on loudness. Whoever rules that question changes this
-   * pin deliberately rather than discovering the silence by accident.
+   * FLIPPED from "names nothing on the developer channel when it refuses":
+   * that pin recorded the family's silence as a decision awaiting a ruling.
+   * objectui#10097 ruled "always warn"; objectui#10145 ruled STOP with a loud
+   * fallback. The warning names the block and spells the raw value WITH its
+   * type, so `'5'` and `5` cannot be confused in the message.
    */
-  it('names nothing on the developer channel when it refuses', async () => {
-    expect(await topFor({ limit: -5 })).toBe(RENDERER_DEFAULT);
-    expect(rowCapDiagnostics(warn)).toEqual([]);
-    expect(rowCapDiagnostics(error)).toEqual([]);
+  it.each([
+    ['a numeric string', '5', '"5" (string)'],
+    ['a padded numeric string', ' 5 ', '" 5 " (string)'],
+    ['a hex string', '0x10', '"0x10" (string)'],
+    ['a boolean', true, 'true (boolean)'],
+    ['an array', [7], '[7] (array)'],
+    ['a fraction', 1.5, '1.5 (number)'],
+    ['zero', 0, '0 (number)'],
+    ['a negative', -5, '-5 (number)'],
+    ['NaN', Number.NaN, 'NaN (number)'],
+    ['Infinity', Number.POSITIVE_INFINITY, 'Infinity (number)'],
+  ])('warns once, naming the block and the raw value, for %s', async (_label, authored, spelled) => {
+    expect(await topFor({ limit: authored })).toBe(RENDERER_DEFAULT);
+    const hits = rowCapWarnings();
+    expect(hits).toHaveLength(1);
+    expect(hits[0]).toContain('record:history');
+    expect(hits[0]).toContain(`declared limit: ${spelled}`);
+  });
+
+  it('CONTROL — a usable cap and an absent cap say nothing', async () => {
+    expect(await topFor({ limit: 10 })).toBe(10);
+    expect(await topFor({})).toBe(RENDERER_DEFAULT);
+    expect(rowCapWarnings()).toEqual([]);
+  });
+
+  it('the `properties` read point warns identically', async () => {
+    expect(await topFor({ properties: { limit: '5' } })).toBe(RENDERER_DEFAULT);
+    expect(rowCapWarnings()).toHaveLength(1);
   });
 });