Constant GRID_LIMIT 

pub const GRID_LIMIT: i32 = _; // 1_048_576i32

The document extent, in grid cells: two of them sum far inside i32, so no rect accessor can overflow a value a decoder accepted. Enforced at the decode boundary, where “bounded by the document extent” stops being true because the payload came from a stranger. Refused, never clamped — clamping relocates geometry instead of reporting a bad payload. Authoring must respect it too, or it writes commits it cannot read back.