@aceshooting/lyra-ui 29.0.2 → 29.1.0

package/llms/components/lr-combobox.md

@@ -21,12 +21,11 @@ Filterable single/multi-select combining a text input with a listbox. Mirrors th
 `<wa-combobox>` API under the `lr-` prefix. **Form-associated**, with shared internals and validation plumbing while retaining its own
 single/multiple value and option synchronization.
 
-Consumer writes on mounted options immediately update the owning picker and its submission,
-without changing the reset default or emitting picker input/change events. Owner synchronization
-does not echo as a consumer selected write.
-
-A mounted `option.selected` assignment updates the live picker value and form submission
-immediately, including deselection and equal-value writes; it emits no user input/change event.
+Programmatic `option.selected` writes update the option immediately, including deselection and
+equal-value writes. The owning combobox reconciles selection and form state once in the next
+microtask; await one microtask before reading settled parent state. These writes do not change the
+reset default or emit picker input/change events. Assign the parent value array for a bulk
+replacement. Owner synchronization does not echo as a consumer selected write.
 
 When `multiple` becomes false, the public value, live option flags, popup `aria-selected`,
 `selectedRows`, event `data` and `with-unknown-option` rows expose one selected occurrence. The
@@ -139,7 +138,8 @@ other value (a plain object, a function) is dropped from the row instead of reac
 - `hint: string = ''`
 - `errorText: string = ''` (attribute `error-text` — static error copy shown below the hint;
   overridden by slotted `error` content when provided)
-- `open: boolean = false` (reflected). Rows mount the first time the listbox opens. Disabling the
+- `open: boolean = false` (reflected). Rows mount when the listbox opens and are removed after it
+  closes; reopening restores them. Disabling the
   combobox, making it `readonly` or disabling its fieldset closes an open listbox at once; that
   close is policy, so it emits no `lr-hide`/`lr-after-hide` and cannot be vetoed.
 - `allowCreate: boolean = false` (attribute `allow-create`) — a nonmatching query renders a
@@ -290,10 +290,12 @@ AbortSignal; limit: number }) => Promise<readonly ComboboxSourceRow[] | { rows,
 - `sourceDelay: number = 200` (attribute `source-delay` — debounce in ms between the last keystroke
   and the `source` call; `0` fires on every keystroke. Sanitized to a finite non-negative duration,
   falling back to `200` for a non-finite value)
-- `maxRender: number = 200` (attribute `max-render` — caps how many rows render at once, always
-  keeping the current selection visible even if it's outside the cap; the excess renders as one
-  `overflowText` row instead of being dropped silently. See "Large option lists" below for how to
-  size it, and when `source` is the better answer. Runtime writes are capped at 1,000)
+- `maxRender: number = 200` (attribute `max-render`) — ordinary suggestion-prefix size, retaining
+  active and selected options within an absolute 1,000-row ceiling. The active option has priority;
+  selections remain committed even when every selected row cannot mount. Zero omits the ordinary
+  prefix while retaining active/selected rows; non-finite values use 200. Rows keep source order,
+  and excess options are summarized by `overflowText`. See "Large option lists" below for sizing
+  and the async `source` alternative
 - `sourceTotal: number` (read-only) — provider-side total for the latest accepted response
 - `sourceTruncated: boolean` (read-only) — whether the response reported or contained more rows
   than the bounded retained snapshot; the overflow row includes that hidden count
@@ -469,6 +471,14 @@ element-reflection replacement can reach — element reflection resolves same-ro
 `<lr-virtual-list>` stays `role="list"`/`role="listitem"` and is the right tool for feeds and
 viewers, not for a listbox whose active row must stay addressable.
 
+A remote `source` can search a backend containing millions of records without supplying that entire
+collection to the component. Keep the search index on the host or server, return at most
+`options.limit` candidate rows, and include `total` to disclose omitted matches. A discriminating
+query can select an identity anywhere in the backend; selected labels and data survive later
+result windows. This is bounded search, with no paging or cursor for traversing every match of a
+broad query. Refine the query to reach the desired record, or use a paged or indexed data browser
+when complete match traversal is required.
+
 What that means in practice:
 
 - **Up to a few hundred rows, raise `maxRender` and move on.** A few hundred flex rows is an
@@ -480,9 +490,10 @@ What that means in practice:
   rendering everything and asking the browser to lay it out. Pair it with `sourceDelay` to debounce.
 - **Leave the overflow row doing its job.** When the cap does bite, the excess collapses into one
   `overflowText` row (default `"+{n} more — refine your search"`) rather than disappearing
-  silently, and the current selection is always kept visible even when it falls outside the cap.
-  Suppressing that row by setting `maxRender` far above the real list size trades a useful "keep
-  typing" affordance for layout work no user asked for.
+  silently. Active and selected rows reserve space inside the absolute 1,000-row ceiling;
+  oversized selections remain selected even when some selected rows cannot mount.
+  Increasing `maxRender` can expose more rows only within the absolute 1,000-row ceiling;
+  use filtering or `source` to narrow larger catalogs.
 
 **Slots:** default (`<lr-option>` children), `label`, `hint`, `error` (overrides the `errorText`
 attribute when provided), plus two adornment slots:
@@ -621,7 +632,8 @@ box visibly (nothing is clipped or made unreachable), so leave it unset there.
   baseline without overwriting a dirty live selection
 - `selected: boolean = false` (property only) — live selectedness. The parent combobox/select
   updates it as the current value changes; those live writes never rewrite the `selected`
-  attribute or `defaultSelected`
+  attribute or `defaultSelected`. Consumer writes update the option immediately and reconcile
+  parent selection/form state once in the next microtask, without parent input/change events
 - `title: string = ''` — tooltip text forwarded to the row the owning `lr-select`/`lr-combobox` renders
   for this option and to its multiple-mode tag; never part of the accessible name; omitted when empty
 - `group: string = ''` (section header)

package/llms/components/lr-command-palette.md

@@ -9,7 +9,7 @@
 - **Release history** [CHANGELOG.md](../../CHANGELOG.md)
 - **Deprecations** none
 - **Optional peers** none
-- **Themeable via** 15 parts, 16 custom properties — see this component's own `@csspart`/`@cssprop` list below
+- **Themeable via** 16 parts, 16 custom properties — see this component's own `@csspart`/`@cssprop` list below
 - **Library-wide behavior** (events, form association, `locale`/`strings`, tokens, TS types): `llms/shared.md`
 
 ---
@@ -34,6 +34,14 @@ Valid string keywords still participate in search alongside the command's label,
 group. Unsafe keyword entries are skipped without invoking accessors, and selection returns the
 original command object.
 
+`commands` admits the first 10,000 input positions; invalid or duplicate records inside that prefix
+do not extend the admission window. In the open dialog, `part="limit"` shows the localized
+`commandPaletteInputLimit` notice when the original assignment lost entries. This is independent
+of the search-result count and the virtual result window. Rebinding the retained snapshot
+preserves the notice while refreshing live command records; a fresh input below the limit clears
+it. Initial mounting and reconnecting are quiet. Later changed input loss is politely announced
+while open; changes made while closed remain quiet, and the notice appears on the next opening.
+
 **Properties:**
 
 - `open: boolean = false` (reflected) — after the initial silent render, property and attribute
@@ -66,7 +74,11 @@ shortcut?, keywords?: readonly string[], disabled?, icon?, onSelect? }`. The seq
 **Methods:** `openPalette()` (after an accepted open, clears the query and resets the active row;
 no-op if already open),
 `close()`, `show()`/`hide()` (aliases of `openPalette()`/`close('api')`, the surface every Lyra
-overlay exposes), `registerCommand(command)` — appends to `commands` and returns an unregister function.
+overlay exposes), `registerCommand(command)` — queues an addition to `commands` and returns an
+unregister function. Calls in the same turn are admitted together in a microtask; await
+`updateComplete` after that turn before inspecting rendered commands. The disposer also cancels a
+pending registration. Assign `commands` for an immediate bulk update; replacing it before a queued
+batch flush supersedes that older batch.
 
 **Keyboard:** ArrowUp/ArrowDown move the active option, skipping `disabled` rows and clamping (not
 cycling) at the ends; Home/End jump to the first/last enabled row and PageUp/PageDown by one visible
@@ -99,7 +111,8 @@ replacing the native search-cancel glyph the component resets; rendered only whi
 value), `list` (the `role="listbox"`), `group` (a group
 heading), `command-group` (a labeled ARIA group of commands), `command` (a `role="option"` button),
 `icon` (a command's leading icon glyph; only rendered when the command has one), `label`,
-`description`, `shortcut`, `list-spacer` (the virtual result extent), `empty`.
+`description`, `shortcut`, `list-spacer` (the virtual result extent), `empty`, `limit` (original
+command input-loss notice).
 
 The palette dialog paints with the shared overlay-surface family, like `lr-dialog`:
 `--lr-overlay-surface` (default `var(--lr-color-surface-container-highest)`), `--lr-overlay-border`,

package/llms/components/lr-country-picker.md

@@ -9,7 +9,7 @@
 - **Release history** [CHANGELOG.md](../../CHANGELOG.md)
 - **Deprecations** none
 - **Optional peers** none
-- **Themeable via** 12 parts, 0 custom properties — see this component's own `@csspart`/`@cssprop` list below
+- **Themeable via** 14 parts, 0 custom properties — see this component's own `@csspart`/`@cssprop` list below
 - **Library-wide behavior** (events, form association, `locale`/`strings`, tokens, TS types): `llms/shared.md`
 
 ---
@@ -44,9 +44,25 @@ rows, `disabled` prevents selection, and literal `label` overrides include expli
 A nonempty unknown, malformed or disabled selected value stays visible and invalid until cleared
 or replaced. It is never silently replaced or added as a selectable row.
 
-**SSR:** All three render declarative shadow DOM with catalog rows and the committed identifier
-without browser globals. Country flag emoji need no asset loader. Interactive selection requires
-hydration; use the same explicit catalog and locale on server and client for consistent options.
+A localized `catalogPickerInputLimit` notice in `part="limit"` reports original catalog positions
+omitted beyond the 1,024-position inspection ceiling. Invalid and duplicate positions inside the
+prefix still consume that allowance. This notice is separate from `select-option-overflow`, which
+counts admitted rows outside the popup's render window. Search covers only admitted entries;
+provide a narrower or replacement catalog to include omitted input. Rebinding the picker's retained
+catalog snapshot preserves the notice; a fresh below-limit catalog, `[]`, or restoring defaults
+clears it. Initial mounting and reconnecting are quiet; later changed input loss is politely
+announced. The message supports the usual per-instance `.strings` override.
+
+All four regional pickers mount only the committed option before first focus or opening, then
+reuse the initialized catalog until its inputs change. An explicit `requestUpdate()` refreshes
+consumer presentation overrides. Popup rendering is capped at 1,000 options, with omitted rows
+reported through `select-option-overflow`; source admission still accepts up to 1,024 rows.
+Built-in catalogs remain fully available. Enable `searchable` to filter admitted custom catalog
+entries outside the initial popup window; committed tail values remain represented.
+
+**SSR:** All three render declarative shadow DOM with the committed option and identifier, without
+browser globals. Country flag emoji need no asset loader. Interactive selection and the remaining
+catalog require hydration; use the same explicit catalog and locale on server and client.
 
 `label=''`, `hint=''`, `errorText=''` (`error-text`) and the `label`, `hint`, `error` slots supply
 field chrome. `accessibleLabel=null` (attribute `aria-label`) overrides the actual control's name;
@@ -88,8 +104,9 @@ and `LyraUnitChangeDetail` from their respective component modules. Reselecting
 programmatic updates, catalog/locale changes and resets emit no selection events. Native `focus`
 and `blur` relay once; canceling `lr-invalid` suppresses native validation UI.
 
-**CSS parts:** `form-control`, `form-control-label`, `hint`, `error`, `select-trigger`,
-`select-display-input`, `select-listbox`, `select-option`, `select-option-sub`, `select-group-label`
+**CSS parts:** `form-control`, `form-control-label`, `hint`, `error`, `limit` (original catalog
+input-loss notice), `select-trigger`,
+`select-display-input`, `select-listbox`, `select-option`, `select-option-overflow`, `select-option-sub`, `select-group-label`
 and `select-clear-button`; country additionally exposes `flag`. The three field slots are the only content slots; supply options through
 the catalog property. Shared form-control and surface tokens apply, including RTL and dark themes.
 

package/llms/components/lr-csv-viewer.md

@@ -9,20 +9,21 @@
 - **Release history** [CHANGELOG.md](../../CHANGELOG.md)
 - **Deprecations** none
 - **Optional peers** `papaparse` — see `llms/peers.md`
-- **Themeable via** 12 parts, 2 custom properties — see this component's own `@csspart`/`@cssprop` list below
+- **Themeable via** 13 parts, 2 custom properties — see this component's own `@csspart`/`@cssprop` list below
 - **Library-wide behavior** (events, form association, `locale`/`strings`, tokens, TS types): `llms/shared.md`
 
 ---
 
 ## `lr-csv-viewer`
 
-Fetches CSV text, parses quoted fields with the optional `papaparse` peer, and virtualizes body rows.
+Fetches CSV text with the optional `papaparse` peer, or reads a host-owned `dataSource`, and
+virtualizes body rows.
 
 Adopts `DocumentAnchorTarget`: a `cell-range` anchor addresses the raw file grid, 1-based, with the
 header row included unless `without-header-row` is set; `scrollToAnchor()` scrolls the addressed
 row/column into view via the virtualized list's `active-item-id`. `highlights` paint as a focusable
-`part="cell-highlight"`. A jump whose document is replaced by a concurrent `src` reassignment
-mid-flight reports `found: false` rather than a phantom success.
+`part="cell-highlight"`. A jump whose document is replaced by a concurrent `src`, `rows`, or
+`dataSource` reassignment mid-flight reports `found: false` rather than a phantom success.
 
 **Properties:** `src: string = ''` and `name: string = ''`. `withoutHeaderRow: boolean = false`
 (attribute `without-header-row`) renders the first parsed row as an ordinary data row instead of the
@@ -35,13 +36,92 @@ values, declaration breaks, and `url()` are ignored. `anchorKinds: readonly Lyra
 ['cell-range']` (this viewer's supported `LyraAnchor.kind` values for the shared anchor-target
 contract).
 
-**Methods:** `search(query)` resolves the match count via a case-insensitive substring match over
+Input properties and legacy limits:
+
+- `maxRows: number = 10000` (attribute `max-rows`) — raw rows, including the first row whether it
+  is displayed as a header or a body row; effective range 1–100,000.
+- `maxColumns: number = 1000` (attribute `max-columns`) — columns in any row;
+  effective range 1–10,000.
+- `maxBytes: number = 26214400` (attribute `max-bytes`) — source bytes, default 25 MiB;
+  effective range 1–262,144,000 bytes (250 MiB).
+- `rows: unknown[][] | undefined` (property only, default `undefined`) — an already parsed grid,
+  including its first row. `withoutHeaderRow` still controls whether that row is a header.
+
+- `dataSource: CsvViewerSource | undefined` (property only, default `undefined`) — a host-owned
+  logical source, described below; `CsvViewerSource = LyraTabularSource`.
+
+Limits truncate finite fractions and clamp to their effective ranges; non-finite inputs use the
+stated defaults. Set limits before assigning `rows`. In-memory input bypasses fetching and
+PapaParse, takes precedence over `src` even when empty, and setting it to `undefined` restores
+the configured URL source. Admission reads own data properties and rejects accessors in those
+fields without invoking them; cells may be strings, numbers, booleans, `null` or `undefined`.
+The outer grid and rows are frozen snapshots. Reassigning the accepted caller array or getter
+snapshot is a no-op while effective limits are unchanged; replace the outer array after caller
+mutation. Limit changes revalidate the current snapshot. Byte admission counts UTF-8 cell text,
+with nullish cells contributing empty text; the independent 1,000,000-cell ceiling includes the
+first row. Malformed or over-limit input displays a localized error and emits `lr-render-error`.
+
+**Host-owned source input:** A defined `dataSource` takes precedence over `rows` and `src`,
+bypassing file fetching and parsing. Invalid defined sources show a localized error and emit
+`lr-render-error`; they do not fall back to legacy input. Setting `dataSource = undefined` cancels
+source work and restores the current `rows` or URL input. Source pages never overwrite the
+legacy `rows` getter. The source remains host-owned by identity rather than being cloned. After
+changing its data or revision, reassign it (the same identity is accepted) or call the viewer's
+unnamed `requestUpdate()`. Source replacement, refresh and locale changes invalidate stale reads,
+search results and navigation. Unrelated presentation updates reuse source data.
+
+The source supplies `revision`, full logical body `rowCount`, `columnCount` and `columnAt(index)`
+returning `{ key, label }`, plus either synchronous scalar `cellAt(row, column)` or asynchronous
+`readCells(request)`. Requests carry revision, locale, an `AbortSignal`, and an absolute zero-based
+rectangle; return exactly its requested rows and columns. Accepted cells are strings, finite
+numbers, booleans, `null` or `undefined`, with nullish values displaying empty text.
+Logical body rows are not truncated by `maxRows` or materialized as a complete array. Each active
+source's `columnCount` must fit `maxColumns` (default 1,000, effective hard maximum 10,000); an
+oversized column count is an error. Reads remain bounded to at most 500 rows, 100 columns and
+10,000 cells per rectangle, with two retained rectangles. Each scalar's display text and each
+column key/label is limited to 65,536 UTF-16 units. Retained cell and column metadata text shares a
+2,000,000-unit ceiling.
+Malformed or oversized replies fail visibly instead of silently clipping source values.
+
+Only source mode uses fixed row boxes and matching virtual-list row geometry, both resolved live
+from `--lr-size-3rem` (3rem, or 48px at a 16px root font). Oversized cell display stays within that
+row box without changing the source scalar. Legacy file and in-memory rows keep their automatic
+heights. Column windows retain absolute `aria-colindex` values; anchors still use one-based display
+coordinates and can reveal unloaded rows and offscreen columns.
+Source column labels are separate metadata: hit `row: -1` is the header and body row `0` appears
+at display row 2 by default, or row 1 with `withoutHeaderRow`. Hidden header hits are omitted from
+search results and make the retained count nonexact. Changing `withoutHeaderRow` in source mode
+clears search results and pending navigation because displayed coordinates change; cached cells
+remain available.
+
+In source mode, `search(query)` delegates to the source's global search capability rather than
+scanning loaded rectangles or an admitted prefix. The viewer requests at most 1,000 hits and keeps
+`matchCount` equal to retained, cursor-addressable hits. A larger known provider total does not
+replace that count; `matchCountExact` is true only for exhaustive, fully retained results. Without
+that capability, a nonempty query returns 0 with `matchCountExact: false` and `part="search-status"`
+shows the localized `sourceSearchUnavailable` message. This adds no local search toolbar or event
+fields. `searchNext()`/`searchPrevious()` report whether the target was actually revealed;
+`clearSearch()` cancels pending search and dependent navigation.
+`LyraTabularHit` coordinates use zero-based body `row` (or -1 for labels) and zero-based `column`.
+
+`CsvViewerSource` is available from the component entry and package root. The component entry also
+re-exports `LyraSourceCell`, `LyraTabularColumn`, `LyraTabularHit`, `LyraTabularReadRequest`,
+`LyraSourceSearchRequest` and `LyraSourceSearchResult`. Shared contracts can be imported with
+`import type` from `@aceshooting/lyra-ui/data-sources.js`.
+
+Body rows and columns are windowed. Header and body share the visible column window, with
+`aria-colindex` preserving full-grid positions. Search and anchors reveal offscreen columns
+before navigating; admitted row/column counts and raw-grid anchor coordinates remain complete.
+
+**Methods:** With `dataSource` undefined, `search(query)` resolves the match count via a
+case-insensitive substring match over
 the same stringified cell values `cell()` renders, ordered row then column (empty/whitespace query
 behaves like `clearSearch()`); `searchNext()`/`searchPrevious()` advance/step back through matches
 (wrapping, resolving `false` when there are none); `clearSearch()` clears the query, matches, and
 painted marks.
 
-**Events:** `lr-render-error` with `detail.error` when fetching or parsing fails.
+**Events:** `lr-render-error` with `detail.error` when fetching, parsing, in-memory admission, or
+data-source validation/read/search fails.
 `lr-viewer-diagnostic` reports up to 100 recoverable PapaParse errors in one
 `detail.diagnostic` (`code: 'delimited-parse-diagnostic'`, `source: 'papaparse'`,
 `severity: 'warning'`, `fatal: false`, `cause: errors`) while the partial grid remains rendered.
@@ -59,7 +139,7 @@ cell covered by a `highlights` entry), `cell-highlight-action` (the native butto
 highlighted cell; emits `lr-highlight-activate`; its complete accessible name uses the localized
 `cellHighlightWithLabel` message with independent `{value}` and `{label}` placeholders; this action,
 not the structural `cell-highlight`, owns keyboard focus and its focus ring), `rows`,
-`spinner`, `error`, and `anchor-live-region` (an aria-hidden, non-live shadow mirror of the latest
+`spinner`, `error`, `search-status` (global source-search unavailable notice), and `anchor-live-region` (an aria-hidden, non-live shadow mirror of the latest
 anchor-jump message; the spoken copy is appended to the shared document-level polite sink only while
 the viewer and its composed ancestors are exposed to the accessibility tree). `data-row`,
 `cell`, `cell-highlight`, and `cell-highlight-action` are rendered inside the internal
@@ -85,10 +165,13 @@ that deferred too can instead import
 same registration lazily and exports `CSV_VIEWER_TAG` (`'lr-csv-viewer'`) as a stable reference to
 the tag it eventually registers.
 
-Remote resources are capped at 25 MB. A quote-aware scan stops before PapaParse at 10,000 raw rows
-(the first row consumes the same budget whether or not it is displayed as the header),
-1,000 columns in any row, 1,000,000 aggregate cells, or more than 100 parser diagnostics; streaming
-row callbacks enforce the same ceilings again. Exceeding any ceiling surfaces the localized
-`documentPreviewResourceTooLarge` message instead of a partial grid.
+Remote resources use `maxBytes`. By default, a quote-aware scan stops before PapaParse at 10,000
+raw rows and 1,000 columns in any row; `maxRows` and `maxColumns` configure those limits. The
+first row consumes the row budget whether displayed as the header or as a body row. The
+1,000,000 aggregate-cell ceiling and 100-parser-diagnostic budget remain independent. Streaming
+row callbacks enforce the same ceilings again. Exceeding a ceiling surfaces the localized
+`documentPreviewResourceTooLarge` message instead of a partial grid. The fetched-text path yields
+between dialect detection, structural admission and materialization; each parse pass remains
+synchronous.
 
 ---

package/llms/components/lr-currency-picker.md

@@ -9,7 +9,7 @@
 - **Release history** [CHANGELOG.md](../../CHANGELOG.md)
 - **Deprecations** none
 - **Optional peers** none
-- **Themeable via** 11 parts, 0 custom properties — see this component's own `@csspart`/`@cssprop` list below
+- **Themeable via** 13 parts, 0 custom properties — see this component's own `@csspart`/`@cssprop` list below
 - **Library-wide behavior** (events, form association, `locale`/`strings`, tokens, TS types): `llms/shared.md`
 
 ---
@@ -37,6 +37,25 @@ to change options. At most 1024 rows are examined, invalid rows are skipped, and
 entry for each normalized code wins. Caller order is preserved. Names and symbols resolve once per
 catalog and locale and are shared by every picker using that catalog.
 
+A localized `catalogPickerInputLimit` notice in `part="limit"` reports original catalog positions
+omitted beyond the 1,024-position inspection ceiling. Invalid and duplicate positions inside the
+prefix still consume that allowance. This notice is separate from `select-option-overflow`, which
+counts admitted rows outside the popup's render window. Search covers only admitted entries;
+provide a narrower or replacement catalog to include omitted input. Rebinding the picker's retained
+catalog snapshot preserves the notice; a fresh below-limit catalog, `[]`, or restoring defaults
+clears it. Initial mounting and reconnecting are quiet; later changed input loss is politely
+announced. The message supports the usual per-instance `.strings` override.
+
+Country, currency, time-zone and unit pickers defer their option catalog until first focus or
+opening. Before that, only the committed option is mounted to preserve its label; an unset picker
+mounts none. Programmatic option inspection should await that interaction and update completion.
+After initialization, unchanged option presentations are reused; explicit `requestUpdate()`
+refreshes consumer presentation overrides. Each popup renders at most 1,000 options, exposing
+omitted rows through `select-option-overflow`. Built-in catalogs remain fully available. For an
+admitted catalog larger than the popup window, enable `searchable` and filter to entries outside
+that initial window;
+a committed tail value remains represented within the bounded popup.
+
 **Unavailable values stay visible.** A value outside the configured catalog, a malformed nonempty
 value, or a selected entry that becomes disabled is retained and marked unavailable. It fails
 validation until cleared or replaced; it is never silently switched to another currency. Such a
@@ -83,8 +102,9 @@ updates, resets, locale changes and catalog replacements emit no change event. N
 **Slots:** `label`, `hint`, `error` — custom field copy. There is no option/default content slot;
 bind `currencies` to supply rows.
 
-**CSS parts:** `form-control`, `form-control-label`, `hint`, `error`;
-`select-trigger`, `select-display-input`, `select-listbox`, `select-option`, `select-option-sub`,
+**CSS parts:** `form-control`, `form-control-label`, `hint`, `error`, `limit` (original catalog
+input-loss notice);
+`select-trigger`, `select-display-input`, `select-listbox`, `select-option`, `select-option-overflow`, `select-option-sub`,
 `select-clear-button`, `select-group-label`. Both composed controls preserve these part names
 and inherit shared form-control and surface tokens.
 

package/llms/components/lr-data-grid.md

@@ -45,18 +45,34 @@ only that page plus the header. In server mode, `total` still drives `pageCount`
 does not inflate `aria-rowcount` while `aria-rowindex` restarts for each loaded page. Treat these
 ARIA values as page-local positions rather than as the dataset-wide total.
 
+Row details remain virtualized as part of their owning row's measured block. `--max-height: none`
+still opts out of row virtualization. Wide grids mount columns intersecting the inline viewport
+plus overscan, pinned columns, and the focused column; ARIA column positions refer to the complete
+visible column sequence. Above 50 columns, CSS-resolved widths stay stable while scrolling; newly
+mounted content fits those widths. Column definitions/widths, row projection, allocation, font
+changes and explicit refresh recalculate them. Header, body and footer share these tracks.
+Search and text filters reuse folded cells, sorting is independent of query changes, and
+footers/aggregates reuse results until their row/column inputs change. Call `requestUpdate()` after
+changing borrowed row content or callback-dependent external state in place.
+
 **Properties:**
 
 - `appearance: 'outlined' | 'plain' = 'outlined'` (`appearance`, reflected).
 - `childRows: string | ((row) => readonly Row[] | undefined) | null = null` (`child-rows`) — dot path or
   callback for nested rows. Tree sorting stays within each parent and paging keeps a subtree with
-  its top-level parent. Projection is iterative, cycle-safe, and bounded to 10,000 total rows and
+  its top-level parent. Projection is iterative, cycle-safe, and bounded to `maxRows` total rows and
   64 descendant levels; exceeding a budget renders the localized `tree-limit` notice.
 - `columnOrder: readonly string[] = []` (JS-only) — empty preserves declaration order.
 - `columns: readonly DataGridColumn<Row>[] = []` (JS-only).
 - `data: readonly Row[] = []` (JS-only) — client rows, or the currently loaded server page.
-  Flat input beyond 10,000 rows shows the localized `row-limit` notice; nested input retains its
+  Flat input beyond `maxRows` rows shows the localized `row-limit` notice; nested input retains its
   `tree-limit` notice when the node or depth budget is reached.
+- `maxRows: number = 10000` (`max-rows`) — client-row and tree-descendant admission limit,
+  normalized to 1–100,000. Set it before assigning `data`; after raising it, reassign the source
+  array to restore excluded rows. Admission reads at most `maxRows` source positions through own
+  data descriptors while preserving row object identities. Tree depth remains bounded to 64
+  descendant levels, and column definitions retain at most 10,000 entries. Controlled selected
+  and expanded keys remain independent of this row-admission cap.
 - `dataSource: ((request) => Promise<{ rows, total }>) | null = null` (JS-only) — providing it
   enables server behavior.
 - `error: boolean = false` (`error`, reflected) — replaces the body row with the failed-load
@@ -71,7 +87,7 @@ ARIA values as page-local positions rather than as the dataset-wide total.
   The mirrored `expandedKeys` spelling remains a compatibility alias for this same state.
 - `filterDebounce: number = 250` (`filter-debounce`) — finite server search/filter delay.
 - `filteredCount: number` (read-only, JS-only) — matching client rows before paging.
-- `dataTruncated: boolean` (read-only, JS-only) — true when projection drops input over 10,000 rows
+- `dataTruncated: boolean` (read-only, JS-only) — true when projection drops input over `maxRows` rows
   or 64 nesting levels; controlled `selectedRowKeys` remain because omitted keys may exist.
 - `filterFromLeafRows: boolean = false` (`filter-from-leaf-rows`) — retains ancestors of matching
   tree descendants.
@@ -180,9 +196,11 @@ are `text`, `equals`, `number-range`, `date-range`, `set`, `includes-any`, and `
   group/tree/detail display rows, and scrolls with `align: 'start' | 'center' | 'end'`. A row hidden
   in a collapsed branch is a no-op.
 
-**Server mode:** `dataSource` receives `{ sort, filters, search, page, pageSize, signal }`. A newer
-request aborts and supersedes the previous one; rejected requests keep prior rows and emit
-`lr-data-error`. Filter/search requests use `filterDebounce`; sorting and paging load immediately.
+**Server mode:** `dataSource` receives `{ sort, filters, search, page, pageSize, signal }`. A new
+query immediately aborts and supersedes the previous request, including while its replacement
+waits for `filterDebounce`. Obsolete results and errors cannot update the grid even when a loader
+ignores the signal. A rejected current request keeps prior rows and emits `lr-data-error`.
+Filter/search requests use `filterDebounce`; sorting and paging load immediately.
 For event-driven loading, set `server`, listen to the mirrored `request` event, and assign `data`,
 `total`, and `loading` yourself. The redundant Lyra-only `lr-data-request` event was removed in
 9.0.0; rename that listener to `request`. Each dispatch carries a fresh frozen detail that cannot

package/llms/components/lr-dataset-viewer.md

@@ -9,15 +9,15 @@
 - **Release history** [CHANGELOG.md](../../CHANGELOG.md)
 - **Deprecations** none
 - **Optional peers** `papaparse` — see `llms/peers.md`
-- **Themeable via** 12 parts, 3 custom properties — see this component's own `@csspart`/`@cssprop` list below
+- **Themeable via** 13 parts, 3 custom properties — see this component's own `@csspart`/`@cssprop` list below
 - **Library-wide behavior** (events, form association, `locale`/`strings`, tokens, TS types): `llms/shared.md`
 
 ---
 
 ## `lr-dataset-viewer`
 
-Fetches tab-, pipe-, or delimiter-separated text and renders a virtualized, accessible table (a
-`role="table"` container with a sticky `role="row"` header, composed with `<lr-virtual-list
+Fetches tab-, pipe-, or delimiter-separated text, or reads a host-owned `dataSource`, and renders a
+virtualized, accessible table (a `role="table"` container with a sticky `role="row"` header, composed with `<lr-virtual-list
 item-role="row">` for the body) using the optional `papaparse` peer. The document registry matches
 `.tsv`, `.psv`, and `.dat` filenames.
 
@@ -26,7 +26,7 @@ header row always occupying row 1 (this component always parses with a header ro
 is never part of the virtualized body); `scrollToAnchor()` scrolls the addressed row into view via
 the virtualized list's `active-item-id`. `highlights` paint as a `part="cell-highlight"` cell wrapping a
 focusable `part="cell-highlight-action"` native button, keeping the ARIA table tree intact. A jump
-whose document is replaced by a concurrent `src` reassignment mid-flight reports `found: false`
+whose document is replaced by a concurrent `src`, `table`, or `dataSource` reassignment mid-flight reports `found: false`
 rather than a phantom success, and a header-row target scrolls with the same
 `prefers-reduced-motion`-gated smooth behavior every other row uses.
 
@@ -50,12 +50,90 @@ complementary, matching `lr-csv-viewer`/`lr-archive-viewer`'s base-vs-content sp
 `anchorKinds: readonly LyraAnchorKind[] = ['cell-range']` (this viewer's supported `LyraAnchor.kind`
 values for the shared anchor-target contract).
 
-**Methods:** `search(query)` resolves the match count via a case-insensitive substring search over
-every body cell's raw string value, ordered row then column (empty/whitespace query behaves like
+Input properties and legacy limits:
+
+- `maxRows: number = 10000` (attribute `max-rows`) — data rows, excluding the separate header;
+  effective range 1–100,000.
+- `maxColumns: number = 1000` (attribute `max-columns`) — fields; effective range 1–10,000.
+- `maxBytes: number = 26214400` (attribute `max-bytes`) — source bytes, default 25 MiB;
+  effective range 1–262,144,000 bytes (250 MiB).
+- `table: DatasetTable | undefined` (property only, default `undefined`) — an already parsed
+  `{ fields: string[]; rows: Record<string, string>[] }` table, with the header in `fields` rather
+  than in `rows`. Field names must be unique strings. Runtime scalar cell values are normalized to
+  strings, with `null` and `undefined` becoming empty text.
+
+- `dataSource: DatasetViewerSource | undefined` (property only, default `undefined`) — a host-owned
+  logical source, described below; `DatasetViewerSource = LyraTabularSource`.
+
+Limits truncate finite fractions and clamp to their effective ranges; non-finite inputs use the
+stated defaults. Set limits before assigning `table`. In-memory input bypasses fetching and
+PapaParse, takes precedence over `src` even when empty, and setting it to `undefined` restores
+the configured URL source. Admission reads own data properties, rejecting accessors in those
+fields without invoking them, and accepts only string, number, boolean, `null` or `undefined`
+cells. The table, rows and records are frozen snapshots. Reassigning the accepted caller object or
+getter snapshot is a no-op while effective limits are unchanged; replace the outer table after
+caller mutation. Limit changes revalidate the current snapshot. Byte admission counts the UTF-8
+text of cells and field names; the independent 1,000,000-cell budget includes the header.
+Malformed or over-limit input displays a localized error and emits `lr-render-error`.
+
+**Host-owned source input:** A defined `dataSource` takes precedence over `table` and `src`,
+bypassing file fetching and parsing. Invalid defined sources show a localized error and emit
+`lr-render-error`; they do not fall back to legacy input. Setting `dataSource = undefined` cancels
+source work and restores the current `table` or URL input. Source pages never overwrite the
+legacy `table` getter. The source remains host-owned by identity rather than being cloned. After
+changing its data or revision, reassign it (the same identity is accepted) or call the viewer's
+unnamed `requestUpdate()`. Source replacement, refresh and locale changes invalidate stale reads,
+search results and navigation. Unrelated presentation updates reuse source data.
+
+The source supplies `revision`, full logical body `rowCount`, `columnCount` and `columnAt(index)`
+returning `{ key, label }`, plus either synchronous scalar `cellAt(row, column)` or asynchronous
+`readCells(request)`. Requests carry revision, locale, an `AbortSignal`, and an absolute zero-based
+rectangle; return exactly its requested rows and columns. Accepted cells are strings, finite
+numbers, booleans, `null` or `undefined`, with nullish values displaying empty text.
+Logical body rows are not truncated by `maxRows` or materialized as a complete array. Each active
+source's `columnCount` must fit `maxColumns` (default 1,000, effective hard maximum 10,000); an
+oversized column count is an error. Reads remain bounded to at most 500 rows, 100 columns and
+10,000 cells per rectangle, with two retained rectangles. Each scalar's display text and each
+column key/label is limited to 65,536 UTF-16 units. Retained cell and column metadata text shares a
+2,000,000-unit ceiling.
+Malformed or oversized replies fail visibly instead of silently clipping source values.
+
+Only source mode uses fixed row boxes and matching virtual-list row geometry, both resolved live
+from `--lr-size-3rem` (3rem, or 48px at a 16px root font). Oversized cell display stays within that
+row box without changing the source scalar. Legacy file and in-memory rows keep their automatic
+heights. Column windows retain absolute `aria-colindex` values; anchors still use one-based display
+coordinates and can reveal unloaded rows and offscreen columns.
+Source column labels always occupy display row 1; hit `row: -1` addresses those labels and body
+row `0` appears at display row 2. The same mapping applies in both `scrollMode` values.
+
+In source mode, `search(query)` delegates to the source's global search capability rather than
+scanning loaded rectangles or an admitted prefix. The viewer requests at most 1,000 hits and keeps
+`matchCount` equal to retained, cursor-addressable hits. A larger known provider total does not
+replace that count; `matchCountExact` is true only for exhaustive, fully retained results. Without
+that capability, a nonempty query returns 0 with `matchCountExact: false` and `part="search-status"`
+shows the localized `sourceSearchUnavailable` message. This adds no local search toolbar or event
+fields. `searchNext()`/`searchPrevious()` report whether the target was actually revealed;
+`clearSearch()` cancels pending search and dependent navigation.
+`LyraTabularHit` coordinates use zero-based body `row` (or -1 for labels) and zero-based `column`.
+
+`DatasetViewerSource` is available from the component entry and package root. The component entry also
+re-exports `LyraSourceCell`, `LyraTabularColumn`, `LyraTabularHit`, `LyraTabularReadRequest`,
+`LyraSourceSearchRequest` and `LyraSourceSearchResult`. Shared contracts can be imported with
+`import type` from `@aceshooting/lyra-ui/data-sources.js`.
+
+Both body rows and columns are windowed. Header and body share the visible column window, with
+`aria-colindex` retaining each cell's full-grid position. Search and anchors reveal offscreen
+columns before navigating; admitted row/column counts and raw-grid anchor coordinates remain
+complete. This also applies to the page scroll mode.
+
+**Methods:** With `dataSource` undefined, `search(query)` resolves the match count via a
+case-insensitive substring search over header fields followed by every body cell's raw string
+value, ordered row then column (empty/whitespace query behaves like
 `clearSearch()`); `searchNext()`/`searchPrevious()` advance/step back through matches (wrapping,
 resolving `false` when there are none); `clearSearch()` clears the query, matches, and cursor.
 
-**Events:** `lr-render-error` with `detail.error` when fetching or parsing fails.
+**Events:** `lr-render-error` with `detail.error` when fetching, parsing, in-memory admission, or
+data-source validation/read/search fails.
 `lr-viewer-diagnostic` reports up to 100 recoverable PapaParse errors in one
 `detail.diagnostic` (`code: 'delimited-parse-diagnostic'`, `source: 'papaparse'`,
 `severity: 'warning'`, `fatal: false`, `cause: errors`) while the partial table remains rendered.
@@ -73,7 +151,7 @@ every fetch state), `body`, `table`, `header-row`, `header-cell`, `data-row`, `c
 `cell-highlight-action` (the native button filling a highlighted cell — focusable, emits
 `lr-highlight-activate` on click or Enter/Space; its complete accessible name uses the localized
 `cellHighlightWithLabel` message with independent `{value}` and `{label}` placeholders), `spinner`,
-`error`, and `anchor-live-region` (an aria-hidden, non-live shadow mirror of the latest anchor-jump
+`error`, `search-status` (global source-search unavailable notice), and `anchor-live-region` (an aria-hidden, non-live shadow mirror of the latest anchor-jump
 message; the spoken copy is appended to the shared document-level polite sink only while the viewer
 and its composed ancestors are exposed to the accessibility tree). `data-row`, `cell`,
 `cell-highlight` and `cell-highlight-action` render inside the internal `<lr-virtual-list>` and are
@@ -96,7 +174,10 @@ sticky header row, independent of the highlight outline above.
 
 **Optional peer dependency:** `papaparse`.
 
-Remote resources are capped at 25 MB. A quote-aware scan stops before PapaParse at 10,000 data rows,
-1,000 fields in any row, 1,000,000 aggregate cells (including the header), or more than 100 parser
-diagnostics; streaming record callbacks enforce the same ceilings again. Exceeding any ceiling
+Remote resources use `maxBytes`. By default, a quote-aware scan stops before PapaParse at 10,000
+data rows and 1,000 fields in any row; `maxRows` and `maxColumns` configure those limits. The
+1,000,000 aggregate-cell ceiling (including the header) and 100-parser-diagnostic budget remain
+independent. Streaming record callbacks enforce the same ceilings again. Exceeding a ceiling
 surfaces the localized `documentPreviewResourceTooLarge` message instead of a partial table.
+The fetched-text path yields between dialect detection, structural admission and materialization;
+each parse pass remains synchronous.

package/llms/components/lr-dialog.md

@@ -24,7 +24,7 @@ nested and `slot=""` headings remain outside automatic discovery.
 
 ### `lr-dialog`
 
-Dialog and drawer panels follow the [shared surface treatment](shared/styles-and-tokens.md).
+Dialog and drawer panels follow the [shared surface treatment](../shared/styles-and-tokens.md).
 The public panel and body retain their scrolling and focus behavior.
 
 A modal/overlay: `role="dialog"`, focus-trapped while open, dismissible via Escape or (opt-in) a