From 05d3aa70073a5b27c6e5388770b68f51fabcc97c Mon Sep 17 00:00:00 2001
From: Adron Hall <adronhall@gmail.com>
Date: Wed, 9 Sep 2026 09:55:20 -0700
Subject: [PATCH] =?UTF-8?q?fix(settings,app):=20complete=20View=20Preferen?=
 =?UTF-8?q?ces=20parity=20=E2=80=94=20ranges,=20viewing=20filter,=20tray?=
 =?UTF-8?q?=20limit,=20composer=20gear?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Settings ▸ Preferences shipped three of the five documented View
Preferences, and the one range it did ship could save values the web
cannot represent. Closes the gap tracked as G35 / issue #43.

Everything here was pinned against the live site read-only on
2026-09-09 (GET + OPTIONS only) rather than guessed:

  • the web Settings form's own controls give the ranges —
    `messagesPerPage` `min=10 max=30`, `notificationTrayLimit`
    `min=10 max=40` default 20;
  • its `<select id="viewingPreference">` gives the wire vocabulary —
    my_messages / all_messages / followers_only / following_only;
  • its View Preferences card PATCHes all four keys to
    `/api/user/update`, which settles that `notificationTrayLimit` is
    an accepted write key (it was read-only on `UserDTO` before);
  • its composer gear PATCHes the single key
    `{ showAdvancedPostSettings }`, so the preference is the panel's
    default open state and the gear writes it back;
  • `GET /api/messages` still honours only `onlyMine` — `?scope=following`,
    `?viewingPreference=…` and `?filter=…` all return the identical
    unfiltered page, so neither follower feed exists (P1-G);
  • `GET /api/notifications` honours `limit` unscoped but ignores it
    under `scope=tray`, correcting a stale comment that claimed the
    server ignores it outright.

Kit
  • `UpdateUserRequest` gains `notificationTrayLimit` (encodeIfPresent,
    so an unrelated patch never clobbers it).
  • `Notifications.tray(scope:limit:)` takes an optional limit.

Domain
  • New `ViewingPreference` — four typed cases plus an `.other(String)`
    escape hatch that round-trips a token this build doesn't recognise
    instead of silently rewriting the account. Unknown tokens resolve
    to the `.all` scope rather than throwing.
  • `UserSettings` gains `viewingPreference` + `notificationTrayLimit`
    and clamps both integers on read *and* write, so an account still
    holding a legacy value (the old `5...100 step 5` control) is
    corrected rather than re-sent.
  • `TimelineScope.followers` joins `.following` as a backend-less
    scope; `MessagesService.timeline` short-circuits both via
    `hasBackendFeed`.
  • `UserService.setShowAdvancedPostSettings` writes that one field, so
    the composer gear can persist without carrying a stale snapshot.
  • `NotificationsService.tray(limit:)` sends the limit and caps the
    rendered rows client-side, leaving the server-authoritative
    `unreadCount` untouched.

App
  • `PreferencesView`: posts-per-page corrected to 10...30 step 1; new
    Viewing picker and "Notifications in tray" stepper. All four
    viewing values are offered — the two with no backend say so
    honestly instead of being hidden, which would let the next save
    quietly overwrite a preference set on the web.
  • The timeline opens on the stored preference and gains a Followers
    segment with the existing coming-soon state. The toolbar picker
    stays a session override and does not write the preference back —
    multiple timeline windows can be open, and one window's transient
    filter must not mutate the account under the others.
  • The composer's advanced sections now sit behind a gear seeded from
    the preference; toggling it persists optimistically and rolls back
    on failure. Before this the toggle was read by the Preferences pane
    and by nothing else.
  • `NotificationsListViewModel` passes the tray limit — the setting
    had no reader at all.

Gate (CODE_SIGNING_ALLOWED=NO, -derivedDataPath DerivedData): build
succeeded; App 760 tests / 0 failures; Kit 403 / 0; Domain 795 / 0;
Persistence 135 / 0; zero `import InterlinedKit` in App/Features,
App/Navigation, App/MenuCommands; live ContractTests 4/4 passed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtmXBbJVxqGvGnsJzbBywr
---
 App/Composition/AppEnvironment.swift          |  17 ++
 App/Composition/UserPreferencesStore.swift    |  13 +
 App/Features/Compose/ComposerViewModel.swift  |  48 ++-
 App/Features/Compose/ComposerWindowView.swift |  59 +++-
 .../NotificationsListViewModel.swift          |  13 +-
 .../Notifications/NotificationsRootView.swift |   4 +-
 App/Features/Settings/PreferencesView.swift   |  65 +++-
 .../Settings/PreferencesViewModel.swift       |  36 +++
 App/Features/Timeline/TimelineRootView.swift  |  33 +-
 AppTests/PreferencesViewModelTests.swift      |  18 +-
 .../Support/StubNotificationsService.swift    |   8 +-
 AppTests/Support/StubUserService.swift        |  20 ++
 AppTests/ViewPreferencesParityTests.swift     | 289 ++++++++++++++++++
 .../Models/TimelineScope.swift                |  26 +-
 .../Models/UserSettings.swift                 |  94 ++++--
 .../Models/ViewingPreference.swift            | 111 +++++++
 .../Services/MessagesService.swift            |  11 +-
 .../Services/NotificationsService.swift       |  53 +++-
 .../Services/UserService.swift                |  22 +-
 .../UserSettingsTests.swift                   | 109 ++++++-
 .../ViewPreferencesWiringTests.swift          | 190 ++++++++++++
 .../ViewingPreferenceTests.swift              |  94 ++++++
 .../Sources/InterlinedKit/DTOs/UserDTO.swift  |  22 +-
 .../Endpoints/NotificationsEndpoint.swift     |  16 +-
 .../NotificationsEndpointTests.swift          |  18 ++
 .../UserEndpointTests.swift                   |  38 +++
 .../Mapping/MessageRecordMapping.swift        |   6 +-
 27 files changed, 1352 insertions(+), 81 deletions(-)
 create mode 100644 AppTests/ViewPreferencesParityTests.swift
 create mode 100644 Packages/InterlinedDomain/Sources/InterlinedDomain/Models/ViewingPreference.swift
 create mode 100644 Packages/InterlinedDomain/Tests/InterlinedDomainTests/ViewPreferencesWiringTests.swift
 create mode 100644 Packages/InterlinedDomain/Tests/InterlinedDomainTests/ViewingPreferenceTests.swift

diff --git a/App/Composition/AppEnvironment.swift b/App/Composition/AppEnvironment.swift
index 4780be6..1da2c0f 100644
--- a/App/Composition/AppEnvironment.swift
+++ b/App/Composition/AppEnvironment.swift
@@ -73,6 +73,23 @@ final class AppEnvironment: ObservableObject {
         currentUserStore.currentUser?.defaultVisibility ?? .public
     }
 
+    // MARK: - View preferences (G35 / issue #43)
+    //
+    // One additive block reading the account's server-synced View Preferences
+    // off `userPreferences`, so features get them without importing the store
+    // directly. All three fall back to `UserSettings.default` before the first
+    // load resolves, so nothing waits on a preferences round-trip.
+
+    /// The scope a newly-opened timeline window starts on, from the account's
+    /// stored `viewingPreference`.
+    var defaultTimelineScope: TimelineScope { userPreferences.defaultTimelineScope }
+
+    /// How many rows the notification bell tray renders (10...40, default 20).
+    var notificationTrayLimit: Int { userPreferences.notificationTrayLimit }
+
+    /// Whether the composer opens with its advanced post options revealed.
+    var showsAdvancedPostOptionsByDefault: Bool { userPreferences.showAdvancedPostSettings }
+
     /// Re-resolves the signed-in account's `customerStatus` (PLAN.md §8 — a
     /// gated call returning 403 means the subscription lapsed mid-session, so
     /// the UI must re-gate). The composer calls this when a gated `createPost`
diff --git a/App/Composition/UserPreferencesStore.swift b/App/Composition/UserPreferencesStore.swift
index 47c0096..30125c9 100644
--- a/App/Composition/UserPreferencesStore.swift
+++ b/App/Composition/UserPreferencesStore.swift
@@ -35,6 +35,19 @@ final class UserPreferencesStore {
     /// Settings ▸ Preferences ▸ Reading ▸ "Show link previews".
     var showLinkPreviews: Bool { settings.showPreviews }
 
+    /// The feed slice the account asked for, mapped to the timeline's own scope
+    /// vocabulary. Seeds a newly-opened timeline window so an account whose
+    /// viewing preference was set on the web sees that filter honoured on
+    /// launch (G35 / issue #43 acceptance criterion).
+    var defaultTimelineScope: TimelineScope { settings.viewingPreference.defaultScope }
+
+    /// How many rows the notification bell tray renders (10...40, default 20).
+    var notificationTrayLimit: Int { settings.notificationTrayLimit }
+
+    /// Whether the composer opens with its advanced post options (media /
+    /// schedule / cross-post) already revealed — the web's "gear" preference.
+    var showAdvancedPostSettings: Bool { settings.showAdvancedPostSettings }
+
     init(userService: UserServicing) {
         self.userService = userService
     }
diff --git a/App/Features/Compose/ComposerViewModel.swift b/App/Features/Compose/ComposerViewModel.swift
index 8bf25a6..ed4c2c6 100644
--- a/App/Features/Compose/ComposerViewModel.swift
+++ b/App/Features/Compose/ComposerViewModel.swift
@@ -170,6 +170,19 @@ final class ComposerViewModel {
         return false
     }
 
+    /// Whether the advanced post options (media / schedule / cross-post) are
+    /// currently revealed, behind the gear affordance.
+    ///
+    /// Seeded from the account's `showAdvancedPostSettings` preference and
+    /// flipped by `toggleAdvancedOptions()`. This is what makes Settings ▸
+    /// Preferences ▸ "Show advanced post options" real: before G35 / issue #43
+    /// the toggle was persisted and read back by the Preferences pane and by
+    /// nothing else, so turning it off changed nothing in the composer.
+    private(set) var showsAdvancedOptions: Bool
+
+    /// True while the gear's write-back to the account is in flight.
+    private(set) var isSavingAdvancedOptionsPreference: Bool = false
+
     /// The primary-action label. Reflects the schedule-vs-send-now affordance
     /// (PLAN.md §6 M6) for a new message; falls back to the mode's label for an
     /// edit.
@@ -228,7 +241,8 @@ final class ComposerViewModel {
         userService: UserServicing? = nil,
         contentLimits: ContentLimitsProviding? = nil,
         linkedIn: LinkedInServicing? = nil,
-        initialVisibility: Visibility = .public
+        initialVisibility: Visibility = .public,
+        initialShowsAdvancedOptions: Bool = true
     ) {
         self.messages = messages
         self.eventBus = eventBus
@@ -240,6 +254,10 @@ final class ComposerViewModel {
         self.contentLimits = contentLimits
         self.linkedIn = linkedIn
         self.scheduledAt = Date().addingTimeInterval(3600)
+        // Defaults to `true` so previews and existing tests that don't pass a
+        // preference keep the pre-G35 behaviour (options always revealed).
+        // Production passes the account's real preference.
+        self.showsAdvancedOptions = initialShowsAdvancedOptions
         switch mode {
         case .newPost:
             self.body = ""
@@ -269,6 +287,34 @@ final class ComposerViewModel {
         self.visibility = visibility
     }
 
+    /// Reveals or hides the advanced post options and persists the new state to
+    /// the account, mirroring the web gear exactly: its click handler flips the
+    /// panel *and* PATCHes `{ showAdvancedPostSettings }` (verified against the
+    /// live bundle 2026-09-09), so the choice sticks across sessions and
+    /// clients.
+    ///
+    /// The local flip is optimistic and is rolled back if the write fails, so
+    /// the panel never shows a state the account does not hold. A `nil`
+    /// `userService` (previews / tests) still toggles locally — the affordance
+    /// must work without a network seam wired.
+    func toggleAdvancedOptions() async {
+        guard !isSavingAdvancedOptionsPreference else { return }
+        let snapshot = showsAdvancedOptions
+        let desired = !snapshot
+        showsAdvancedOptions = desired
+        guard let userService else { return }
+        isSavingAdvancedOptionsPreference = true
+        defer { isSavingAdvancedOptionsPreference = false }
+        do {
+            let updated = try await userService.setShowAdvancedPostSettings(desired)
+            // Trust the server's answer over the optimistic guess.
+            showsAdvancedOptions = updated.showAdvancedPostSettings
+        } catch {
+            showsAdvancedOptions = snapshot
+            self.error = error
+        }
+    }
+
     /// Adds picked / dropped file URLs as attachments. Unsupported file types
     /// are surfaced as an error rather than silently dropped. No-op for
     /// non-subscribers (the affordance is disabled in the view, but this is
diff --git a/App/Features/Compose/ComposerWindowView.swift b/App/Features/Compose/ComposerWindowView.swift
index fda629b..d223df6 100644
--- a/App/Features/Compose/ComposerWindowView.swift
+++ b/App/Features/Compose/ComposerWindowView.swift
@@ -87,7 +87,12 @@ struct ComposerWindowView: View {
                     // The account's public/private default for new posts. Read
                     // synchronously off the session-cached `CurrentUser`, so the
                     // picker opens on the right value with no fetch and no flicker.
-                    initialVisibility: environment.defaultComposeVisibility
+                    initialVisibility: environment.defaultComposeVisibility,
+                    // G35 / issue #43: the account's "Show advanced post
+                    // options" preference decides whether the gear opens
+                    // revealed. Read synchronously off the preferences store,
+                    // so there is no fetch and no flicker.
+                    initialShowsAdvancedOptions: environment.showsAdvancedPostOptionsByDefault
                 )
             }
             if assistant == nil, let environment {
@@ -150,15 +155,22 @@ struct ComposerWindowView: View {
 
                 visibilityPicker(viewModel: viewModel)
 
-                // M6 — subscriber-gated controls, new messages only.
+                // M6 — subscriber-gated controls, new messages only. The gear
+                // reveals/hides them and persists the choice to the account
+                // (G35 / issue #43), matching the web's own affordance: "Show
+                // the gear icon next to the message input so you can attach
+                // images, video, and cross-post when composing".
                 if viewModel.showsSubscriberControls {
                     Divider()
-                    if !viewModel.canUseSubscriberFeatures {
-                        upsellHint
+                    advancedOptionsToggle(viewModel: viewModel)
+                    if viewModel.showsAdvancedOptions {
+                        if !viewModel.canUseSubscriberFeatures {
+                            upsellHint
+                        }
+                        mediaSection(viewModel: viewModel)
+                        scheduleSection(viewModel: viewModel)
+                        crossPostSection(viewModel: viewModel)
                     }
-                    mediaSection(viewModel: viewModel)
-                    scheduleSection(viewModel: viewModel)
-                    crossPostSection(viewModel: viewModel)
                 }
 
                 if let error = viewModel.error {
@@ -190,6 +202,39 @@ struct ComposerWindowView: View {
         }
     }
 
+    // MARK: - Advanced options gear
+
+    /// The gear that reveals the media / schedule / cross-post sections. Always
+    /// present for a new message so the controls are never simply missing; its
+    /// initial state comes from the account's "Show advanced post options"
+    /// preference and flipping it writes that preference back.
+    @ViewBuilder
+    private func advancedOptionsToggle(viewModel: ComposerViewModel) -> some View {
+        HStack(spacing: 6) {
+            Button {
+                Task { await viewModel.toggleAdvancedOptions() }
+            } label: {
+                Label(
+                    viewModel.showsAdvancedOptions ? "Hide posting options" : "Posting options",
+                    systemImage: "gearshape"
+                )
+                .font(.ilMono(11))
+            }
+            .buttonStyle(.plain)
+            .disabled(viewModel.isSavingAdvancedOptionsPreference)
+            .help("Media, scheduling, and cross-posting. Your choice is saved to your account.")
+            .accessibilityLabel("Posting options")
+            .accessibilityValue(viewModel.showsAdvancedOptions ? "Shown" : "Hidden")
+
+            if viewModel.isSavingAdvancedOptionsPreference {
+                ProgressView()
+                    .controlSize(.small)
+                    .accessibilityHidden(true)
+            }
+            Spacer()
+        }
+    }
+
     // MARK: - Upsell
 
     private var upsellHint: some View {
diff --git a/App/Features/Notifications/NotificationsListViewModel.swift b/App/Features/Notifications/NotificationsListViewModel.swift
index 0407918..aeb051f 100644
--- a/App/Features/Notifications/NotificationsListViewModel.swift
+++ b/App/Features/Notifications/NotificationsListViewModel.swift
@@ -27,6 +27,13 @@ final class NotificationsListViewModel {
     private let service: NotificationsServicing
     private let bus: NotificationsEventBus?
 
+    /// The account's `notificationTrayLimit` (10...40, default 20), passed to
+    /// every tray load so the bell never renders more rows than the user asked
+    /// for (G35 / issue #43 — the preference had no reader before this).
+    /// Optional so existing tests and previews construct the view model
+    /// unchanged and get the server's own page size.
+    private let trayLimit: Int?
+
     // MARK: - Observable state
 
     /// The rendered tray rows, newest-first as the server returns them.
@@ -56,10 +63,12 @@ final class NotificationsListViewModel {
 
     init(
         service: NotificationsServicing,
-        notificationsEventBus: NotificationsEventBus? = nil
+        notificationsEventBus: NotificationsEventBus? = nil,
+        trayLimit: Int? = nil
     ) {
         self.service = service
         self.bus = notificationsEventBus
+        self.trayLimit = trayLimit
     }
 
     // MARK: - Intents
@@ -72,7 +81,7 @@ final class NotificationsListViewModel {
         isLoading = true
         defer { isLoading = false }
         do {
-            let tray = try await service.tray()
+            let tray = try await service.tray(limit: trayLimit)
             items = tray.items
             unreadCount = tray.unreadCount
             error = nil
diff --git a/App/Features/Notifications/NotificationsRootView.swift b/App/Features/Notifications/NotificationsRootView.swift
index a2f5346..589ca57 100644
--- a/App/Features/Notifications/NotificationsRootView.swift
+++ b/App/Features/Notifications/NotificationsRootView.swift
@@ -81,7 +81,9 @@ struct NotificationsRootView: View {
         if viewModel == nil {
             let vm = NotificationsListViewModel(
                 service: environment.notificationsService,
-                notificationsEventBus: environment.notificationsEventBus
+                notificationsEventBus: environment.notificationsEventBus,
+                // G35 / issue #43 — the account's notification tray limit.
+                trayLimit: environment.notificationTrayLimit
             )
             viewModel = vm
             await vm.load()
diff --git a/App/Features/Settings/PreferencesView.swift b/App/Features/Settings/PreferencesView.swift
index fb17cbf..a784e89 100644
--- a/App/Features/Settings/PreferencesView.swift
+++ b/App/Features/Settings/PreferencesView.swift
@@ -7,6 +7,12 @@
 //
 // SwiftUI-only (no AppKit). The pane reads `AppEnvironment.userService` and
 // builds its view model on first appearance, mirroring the other Settings panes.
+//
+// G35 / issue #43 completes the "View preferences" card against the web's own
+// controls (verified live 2026-09-09): posts-per-page is `10...30` (it shipped
+// as `5...100 step 5`, which could save values the web cannot represent), the
+// Viewing picker and the notification-tray stepper are new, and the advanced
+// post options toggle now actually drives the composer's gear.
 
 import SwiftUI
 import InterlinedDomain
@@ -44,20 +50,44 @@ struct PreferencesView: View {
             Section("Posting") {
                 Toggle("New posts are public by default", isOn: boolBinding(viewModel, \.defaultPubliclyVisible))
                 Toggle("Show advanced post options", isOn: boolBinding(viewModel, \.showAdvancedPostSettings))
+                Text("Reveals the composer's options gear — media, scheduling, and cross-posting — without clicking it first.")
+                    .font(.ilMono(10))
+                    .foregroundStyle(.secondary)
             }
 
             Section("Reading") {
                 Toggle("Show link previews", isOn: boolBinding(viewModel, \.showPreviews))
+
+                // Range mirrors the web's `min=10 max=30` exactly; step 1
+                // because the web's number input has no step attribute. The
+                // old `5...100 step 5` could save 5 or 100, values the web
+                // control cannot represent (G35 / issue #43).
                 Stepper(
                     "Posts per page: \(viewModel.settings.messagesPerPage)",
                     value: Binding(
                         get: { viewModel.settings.messagesPerPage },
                         set: { viewModel.settings.messagesPerPage = $0 }
                     ),
-                    in: 5...100,
-                    step: 5
+                    in: viewModel.messagesPerPageRange,
+                    step: 1
                 )
                 .accessibilityLabel("Posts per page")
+
+                viewingPreferencePicker(viewModel: viewModel)
+
+                Stepper(
+                    "Notifications in tray: \(viewModel.settings.notificationTrayLimit)",
+                    value: Binding(
+                        get: { viewModel.settings.notificationTrayLimit },
+                        set: { viewModel.settings.notificationTrayLimit = $0 }
+                    ),
+                    in: viewModel.notificationTrayLimitRange,
+                    step: 1
+                )
+                .accessibilityLabel("Notifications in tray")
+                Text("How many notifications the bell tray holds before older ones drop off.")
+                    .font(.ilMono(10))
+                    .foregroundStyle(.secondary)
             }
 
             Section("Privacy") {
@@ -90,6 +120,37 @@ struct PreferencesView: View {
         .disabled(viewModel.isLoading)
     }
 
+    /// The account's default feed slice. All four documented values are offered
+    /// rather than hiding the two the backend cannot serve yet: hiding them
+    /// would silently rewrite a preference the user set on the web the moment
+    /// they saved anything else here. Selecting an unserved value shows an
+    /// honest note instead — the timeline renders its existing "coming soon"
+    /// empty state for that scope (P1-G, re-verified 2026-09-09).
+    @ViewBuilder
+    private func viewingPreferencePicker(viewModel: PreferencesViewModel) -> some View {
+        Picker(
+            "Viewing",
+            selection: Binding(
+                get: { viewModel.settings.viewingPreference },
+                set: { viewModel.settings.viewingPreference = $0 }
+            )
+        ) {
+            ForEach(viewModel.viewingPreferenceOptions, id: \.self) { preference in
+                Text(preference.displayName).tag(preference)
+            }
+        }
+        .accessibilityLabel("Viewing preference")
+
+        if !viewModel.selectedViewingPreferenceIsServed {
+            Label(
+                "This feed isn't available yet — the timeline will show a \"coming soon\" state for it. Your choice is still saved and honoured on the web.",
+                systemImage: "clock.badge.exclamationmark"
+            )
+            .font(.ilMono(10))
+            .foregroundStyle(.secondary)
+        }
+    }
+
     /// A two-way binding into one boolean field of the working-copy settings.
     private func boolBinding(
         _ viewModel: PreferencesViewModel,
diff --git a/App/Features/Settings/PreferencesViewModel.swift b/App/Features/Settings/PreferencesViewModel.swift
index 76360c6..e40589a 100644
--- a/App/Features/Settings/PreferencesViewModel.swift
+++ b/App/Features/Settings/PreferencesViewModel.swift
@@ -57,6 +57,34 @@ final class PreferencesViewModel {
     /// Drives the Save button's enabled state.
     var hasChanges: Bool { settings != lastSaved }
 
+    /// The rows the Viewing picker offers: the four documented values, plus the
+    /// account's current value when the server sent a token this build does not
+    /// recognise.
+    ///
+    /// Without the second half a `.other` token would leave the `Picker` with a
+    /// selection matching no tag, which SwiftUI renders as a blank control —
+    /// and the first edit to any other field would silently rewrite the
+    /// unrecognised preference. Offering it keeps the round-trip honest.
+    var viewingPreferenceOptions: [ViewingPreference] {
+        let selectable = ViewingPreference.selectable
+        guard !selectable.contains(settings.viewingPreference) else { return selectable }
+        return selectable + [settings.viewingPreference]
+    }
+
+    /// The inclusive range the Posts-per-page stepper offers. Mirrors the web
+    /// control exactly (`min=10 max=30`) so no value saved here is
+    /// unrepresentable there.
+    var messagesPerPageRange: ClosedRange<Int> { UserSettings.messagesPerPageRange }
+
+    /// The inclusive range the notification-tray stepper offers
+    /// (`min=10 max=40`, default 20).
+    var notificationTrayLimitRange: ClosedRange<Int> { UserSettings.notificationTrayLimitRange }
+
+    /// Whether the selected viewing preference names a feed the API can serve.
+    /// `false` for Followers Only / Following Only until P1-G lands; the pane
+    /// says so rather than implying the filter is in effect.
+    var selectedViewingPreferenceIsServed: Bool { settings.viewingPreference.hasBackendFeed }
+
     init(
         userService: UserServicing,
         preferencesStore: UserPreferencesStore? = nil,
@@ -75,6 +103,14 @@ final class PreferencesViewModel {
         error = nil
         defer { isLoading = false }
         do {
+            // `UserSettings` clamps `messagesPerPage` and `notificationTrayLimit`
+            // in its initializer, so an account that still stores an
+            // out-of-range value — the pane used to offer `5...100`, which the
+            // web's `10...30` control cannot represent — is corrected on the way
+            // in. Both `settings` and `lastSaved` therefore hold the clamped
+            // value: the pane opens clean (no phantom unsaved change), and the
+            // next Save for any reason writes the legal value rather than
+            // re-sending the illegal one.
             let loaded = try await userService.settings()
             settings = loaded
             lastSaved = loaded
diff --git a/App/Features/Timeline/TimelineRootView.swift b/App/Features/Timeline/TimelineRootView.swift
index 83978c3..8337aa0 100644
--- a/App/Features/Timeline/TimelineRootView.swift
+++ b/App/Features/Timeline/TimelineRootView.swift
@@ -92,6 +92,13 @@ struct TimelineRootView: View {
             if viewModel == nil, let environment {
                 let model = TimelineViewModel(
                     messages: environment.messages,
+                    // G35 / issue #43 — open on the account's stored Viewing
+                    // preference, so a filter set on the web is honoured on
+                    // launch instead of always starting at All. Read
+                    // synchronously off the preferences store, which holds
+                    // `UserSettings.default` (All Messages) until the first
+                    // load resolves, so this never blocks first paint.
+                    scope: environment.defaultTimelineScope,
                     eventBus: environment.composerEventBus
                 )
                 viewModel = model
@@ -247,10 +254,11 @@ struct TimelineRootView: View {
             ) {
                 Text("All").tag(TimelineScope.all)
                 Text("Mine").tag(TimelineScope.mine)
+                Text("Followers").tag(TimelineScope.followers)
                 Text("Following").tag(TimelineScope.following)
             }
             .pickerStyle(.segmented)
-            .frame(maxWidth: 220)
+            .frame(maxWidth: 300)
             .accessibilityLabel("Timeline scope")
 
             HStack(spacing: 6) {
@@ -295,12 +303,14 @@ struct TimelineRootView: View {
 
     @ViewBuilder
     private func content(viewModel: TimelineViewModel) -> some View {
-        // Following has no API endpoint yet — always show the coming-soon
-        // state regardless of load / error / empty conditions (App Store
-        // Guideline 2.1: every visible control must work or show a graceful
-        // unavailable state).
-        if viewModel.scope == .following {
-            followingComingSoonState
+        // Neither follower scope has an API endpoint yet — always show the
+        // coming-soon state regardless of load / error / empty conditions (App
+        // Store Guideline 2.1: every visible control must work or show a
+        // graceful unavailable state). Re-verified 2026-09-09: the API ignores
+        // every follower-filter parameter and returns the full timeline, so an
+        // "empty feed" here would actually be a mislabelled complete one.
+        if !viewModel.scope.hasBackendFeed {
+            followerFeedComingSoonState(scope: viewModel.scope)
         } else if let error = viewModel.error, viewModel.messagesLoaded.isEmpty {
             errorState(error: error, viewModel: viewModel)
         } else if viewModel.messagesLoaded.isEmpty, viewModel.isLoading {
@@ -370,14 +380,15 @@ struct TimelineRootView: View {
         .frame(maxWidth: .infinity, maxHeight: .infinity)
     }
 
-    private var followingComingSoonState: some View {
-        VStack(spacing: 8) {
+    private func followerFeedComingSoonState(scope: TimelineScope) -> some View {
+        let name = scope == .followers ? "Followers" : "Following"
+        return VStack(spacing: 8) {
             Image(systemName: "person.2")
                 .font(.ilDisplay(36))
                 .foregroundStyle(.secondary)
-            Text("Following feed coming soon")
+            Text("\(name) feed coming soon")
                 .font(.ilSubtitle())
-            Text("The Following timeline is not yet available.")
+            Text("The \(name) timeline is not yet available.")
                 .foregroundStyle(.secondary)
         }
         .frame(maxWidth: .infinity, maxHeight: .infinity)
diff --git a/AppTests/PreferencesViewModelTests.swift b/AppTests/PreferencesViewModelTests.swift
index c8f6192..b50f65e 100644
--- a/AppTests/PreferencesViewModelTests.swift
+++ b/AppTests/PreferencesViewModelTests.swift
@@ -16,14 +16,18 @@ final class PreferencesViewModelTests: XCTestCase {
         showPreviews: Bool = true,
         showAdvancedPostSettings: Bool = false,
         isPrivateAccount: Bool = false,
-        messagesPerPage: Int = 20
+        messagesPerPage: Int = 20,
+        viewingPreference: ViewingPreference = .allMessages,
+        notificationTrayLimit: Int = 20
     ) -> UserSettings {
         UserSettings(
             defaultPubliclyVisible: defaultPubliclyVisible,
             showPreviews: showPreviews,
             showAdvancedPostSettings: showAdvancedPostSettings,
             isPrivateAccount: isPrivateAccount,
-            messagesPerPage: messagesPerPage
+            messagesPerPage: messagesPerPage,
+            viewingPreference: viewingPreference,
+            notificationTrayLimit: notificationTrayLimit
         )
     }
 
@@ -73,14 +77,14 @@ final class PreferencesViewModelTests: XCTestCase {
         stub.enqueueSettings(success: settings(messagesPerPage: 20))
         let viewModel = PreferencesViewModel(userService: stub)
         await viewModel.load()
-        viewModel.settings.messagesPerPage = 50
-        stub.enqueueUpdateSettings(success: settings(messagesPerPage: 50))
+        viewModel.settings.messagesPerPage = 28
+        stub.enqueueUpdateSettings(success: settings(messagesPerPage: 28))
 
         await viewModel.save()
 
         XCTAssertFalse(viewModel.hasChanges)
-        XCTAssertEqual(viewModel.settings.messagesPerPage, 50)
-        XCTAssertEqual(stub.lastUpdatedSettings?.messagesPerPage, 50)
+        XCTAssertEqual(viewModel.settings.messagesPerPage, 28)
+        XCTAssertEqual(stub.lastUpdatedSettings?.messagesPerPage, 28)
         XCTAssertNil(viewModel.error)
     }
 
@@ -100,7 +104,7 @@ final class PreferencesViewModelTests: XCTestCase {
         stub.enqueueSettings(success: settings(messagesPerPage: 20))
         let viewModel = PreferencesViewModel(userService: stub)
         await viewModel.load()
-        viewModel.settings.messagesPerPage = 40
+        viewModel.settings.messagesPerPage = 25
         stub.enqueueUpdateSettings(failure: URLError(.timedOut))
 
         await viewModel.save()
diff --git a/AppTests/Support/StubNotificationsService.swift b/AppTests/Support/StubNotificationsService.swift
index 0294a64..30e2834 100644
--- a/AppTests/Support/StubNotificationsService.swift
+++ b/AppTests/Support/StubNotificationsService.swift
@@ -10,7 +10,9 @@ import InterlinedDomain
 
 struct RecordedNotificationsCall: Sendable, Equatable {
     enum Kind: Sendable, Equatable {
-        case tray
+        /// Carries the `limit` the view model asked for, so a test can assert
+        /// the account's tray preference actually reached the service.
+        case tray(limit: Int?)
         case markRead(id: String)
         case markAllRead
     }
@@ -34,8 +36,8 @@ actor StubNotificationsService: NotificationsServicing {
     func enqueueMarkAllReadSuccess() { markAllReadOutcomes.append(.success(())) }
     func enqueueMarkAllRead(failure error: Error) { markAllReadOutcomes.append(.failure(error)) }
 
-    func tray() async throws -> NotificationTray {
-        recorded.append(.init(kind: .tray))
+    func tray(limit: Int?) async throws -> NotificationTray {
+        recorded.append(.init(kind: .tray(limit: limit)))
         return try take(&trayOutcomes, label: "tray")
     }
 
diff --git a/AppTests/Support/StubUserService.swift b/AppTests/Support/StubUserService.swift
index f0f8e59..30ac71f 100644
--- a/AppTests/Support/StubUserService.swift
+++ b/AppTests/Support/StubUserService.swift
@@ -32,6 +32,8 @@ struct RecordedUserCall: Sendable, Equatable {
         case linkIdentityNative(provider: String, code: String, state: String)
         case settings
         case updateSettings
+        /// The composer gear's single-field write, with the value it sent.
+        case setShowAdvancedPostSettings(enabled: Bool)
     }
     let kind: Kind
 }
@@ -54,6 +56,7 @@ final class StubUserService: UserServicing, @unchecked Sendable {
     private var linkIdentityNativeOutcomes: [Result<LinkedIdentity, Error>] = []
     private var settingsOutcomes: [Result<UserSettings, Error>] = []
     private var updateSettingsOutcomes: [Result<UserSettings, Error>] = []
+    private var setShowAdvancedPostSettingsOutcomes: [Result<UserSettings, Error>] = []
 
     /// The settings snapshot passed to the most recent `updateSettings` call,
     /// so a test can assert what was sent.
@@ -181,6 +184,15 @@ final class StubUserService: UserServicing, @unchecked Sendable {
         updateSettingsOutcomes.append(.failure(error))
     }
 
+    func enqueueSetShowAdvancedPostSettings(success settings: UserSettings) {
+        lock.lock(); defer { lock.unlock() }
+        setShowAdvancedPostSettingsOutcomes.append(.success(settings))
+    }
+    func enqueueSetShowAdvancedPostSettings(failure error: Error) {
+        lock.lock(); defer { lock.unlock() }
+        setShowAdvancedPostSettingsOutcomes.append(.failure(error))
+    }
+
     /// The settings snapshot passed to the most recent `updateSettings` call.
     var lastUpdatedSettings: UserSettings? {
         lock.lock(); defer { lock.unlock() }
@@ -325,6 +337,14 @@ final class StubUserService: UserServicing, @unchecked Sendable {
             set: { $0.updateSettingsOutcomes = $1 }
     }
 
+    func setShowAdvancedPostSettings(_ enabled: Bool) async throws -> UserSettings {
+        try perform(
+            label: "setShowAdvancedPostSettings",
+            record: .setShowAdvancedPostSettings(enabled: enabled)
+        ) { $0.setShowAdvancedPostSettingsOutcomes }
+            set: { $0.setShowAdvancedPostSettingsOutcomes = $1 }
+    }
+
     /// Synchronous lock-guarded write so the `async` `updateSettings` never
     /// touches `NSLock` directly (Swift 6 forbids `lock()`/`unlock()` in an
     /// async context — mirrors `readCachedOrganizations`).
diff --git a/AppTests/ViewPreferencesParityTests.swift b/AppTests/ViewPreferencesParityTests.swift
new file mode 100644
index 0000000..347d248
--- /dev/null
+++ b/AppTests/ViewPreferencesParityTests.swift
@@ -0,0 +1,289 @@
+// ViewPreferencesParityTests
+//
+// BDD-named tests for the App-layer half of the View Preferences parity fix
+// (work-consolidation.md G35 / issue #43):
+//
+//   • `PreferencesViewModel` — the corrected page-size range, the new Viewing
+//     picker options, and the tray-limit control;
+//   • `ComposerViewModel` — the gear that finally makes "Show advanced post
+//     options" do something;
+//   • `NotificationsListViewModel` — the tray limit reaching the service.
+//
+// View models only, against stubs — no SwiftUI rendering (per the skill's
+// view-layer rule).
+
+import XCTest
+import InterlinedDomain
+@testable import InterlinedList
+
+@MainActor
+final class ViewPreferencesParityTests: XCTestCase {
+
+    private func settings(
+        showAdvancedPostSettings: Bool = false,
+        messagesPerPage: Int = 20,
+        viewingPreference: ViewingPreference = .allMessages,
+        notificationTrayLimit: Int = 20
+    ) -> UserSettings {
+        UserSettings(
+            defaultPubliclyVisible: true,
+            showPreviews: true,
+            showAdvancedPostSettings: showAdvancedPostSettings,
+            isPrivateAccount: false,
+            messagesPerPage: messagesPerPage,
+            viewingPreference: viewingPreference,
+            notificationTrayLimit: notificationTrayLimit
+        )
+    }
+
+    // MARK: - Preferences pane: ranges
+
+    func test_givenPreferencesPane_whenReadingControlRanges_thenMatchesTheWebsBounds() {
+        // Happy path: the pane offers exactly what the web offers, so nothing
+        // saved from macOS is unrepresentable there. It used to offer
+        // `5...100 step 5`.
+        let viewModel = PreferencesViewModel(userService: StubUserService())
+
+        XCTAssertEqual(viewModel.messagesPerPageRange, 10...30)
+        XCTAssertEqual(viewModel.notificationTrayLimitRange, 10...40)
+    }
+
+    func test_givenOutOfRangeStoredPageSize_whenLoading_thenClampsAndOpensClean() async {
+        // Boundary: an account still holding a value the old macOS control
+        // could save (5) must be corrected on load, not re-sent.
+        let stub = StubUserService()
+        stub.enqueueSettings(success: settings(messagesPerPage: 5, notificationTrayLimit: 99))
+        let viewModel = PreferencesViewModel(userService: stub)
+
+        await viewModel.load()
+
+        XCTAssertEqual(viewModel.settings.messagesPerPage, 10)
+        XCTAssertEqual(viewModel.settings.notificationTrayLimit, 40)
+        XCTAssertFalse(
+            viewModel.hasChanges,
+            "The clamp is applied to both the working copy and the baseline, so the pane opens clean"
+        )
+    }
+
+    func test_givenTrayLimitEdit_whenSaving_thenSendsTheNewLimit() async {
+        // Happy path for the new control: it round-trips like any other field.
+        let stub = StubUserService()
+        stub.enqueueSettings(success: settings(notificationTrayLimit: 20))
+        let viewModel = PreferencesViewModel(userService: stub)
+        await viewModel.load()
+
+        viewModel.settings.notificationTrayLimit = 35
+        stub.enqueueUpdateSettings(success: settings(notificationTrayLimit: 35))
+        await viewModel.save()
+
+        XCTAssertNil(viewModel.error)
+        XCTAssertEqual(stub.lastUpdatedSettings?.notificationTrayLimit, 35)
+        XCTAssertEqual(viewModel.settings.notificationTrayLimit, 35)
+    }
+
+    // MARK: - Preferences pane: viewing preference
+
+    func test_givenEachViewingPreference_whenSaved_thenRoundTripsThroughTheService() async {
+        // The issue's happy-path case: all four values survive a save. The
+        // account starts on a *different* value each time so `hasChanges` is
+        // genuinely true — otherwise `save()` correctly short-circuits and the
+        // assertion below would be testing nothing.
+        for preference in ViewingPreference.selectable {
+            let stub = StubUserService()
+            stub.enqueueSettings(success: settings(viewingPreference: .other("unset")))
+            let viewModel = PreferencesViewModel(userService: stub)
+            await viewModel.load()
+
+            viewModel.settings.viewingPreference = preference
+            stub.enqueueUpdateSettings(success: settings(viewingPreference: preference))
+            await viewModel.save()
+
+            XCTAssertEqual(stub.lastUpdatedSettings?.viewingPreference, preference)
+            XCTAssertEqual(viewModel.settings.viewingPreference, preference)
+            XCTAssertNil(viewModel.error)
+        }
+    }
+
+    func test_givenKnownViewingPreference_whenOfferingOptions_thenListsTheFourDocumentedValues() async {
+        let stub = StubUserService()
+        stub.enqueueSettings(success: settings(viewingPreference: .followingOnly))
+        let viewModel = PreferencesViewModel(userService: stub)
+
+        await viewModel.load()
+
+        XCTAssertEqual(viewModel.viewingPreferenceOptions, ViewingPreference.selectable)
+    }
+
+    func test_givenUnrecognisedViewingPreference_whenOfferingOptions_thenKeepsItSelectable() async {
+        // Invalid input: a token this build doesn't know must still appear in
+        // the picker. Dropping it would leave the control blank and let the
+        // next unrelated save silently rewrite the account's preference.
+        let stub = StubUserService()
+        stub.enqueueSettings(success: settings(viewingPreference: .other("mentions_only")))
+        let viewModel = PreferencesViewModel(userService: stub)
+
+        await viewModel.load()
+
+        XCTAssertEqual(viewModel.viewingPreferenceOptions.count, 5)
+        XCTAssertEqual(viewModel.viewingPreferenceOptions.last, .other("mentions_only"))
+        XCTAssertTrue(
+            viewModel.selectedViewingPreferenceIsServed,
+            "An unknown filter falls back to the All feed, which the API does serve"
+        )
+    }
+
+    func test_givenFollowerViewingPreference_whenSelected_thenPaneReportsTheFeedUnavailable() async {
+        // Both follower feeds are backend-less (P1-G, re-verified 2026-09-09),
+        // so the pane must say so rather than implying the filter is live.
+        let stub = StubUserService()
+        stub.enqueueSettings(success: settings(viewingPreference: .followersOnly))
+        let viewModel = PreferencesViewModel(userService: stub)
+        await viewModel.load()
+
+        XCTAssertFalse(viewModel.selectedViewingPreferenceIsServed)
+
+        viewModel.settings.viewingPreference = .followingOnly
+        XCTAssertFalse(viewModel.selectedViewingPreferenceIsServed)
+
+        viewModel.settings.viewingPreference = .myMessages
+        XCTAssertTrue(viewModel.selectedViewingPreferenceIsServed)
+    }
+
+    func test_givenViewingPreferenceSaveFails_whenSaving_thenSurfacesErrorAndKeepsTheEdit() async {
+        // Upstream failure: the pane keeps the user's edit so they can retry,
+        // and the working copy is not replaced by a value the server never took.
+        let stub = StubUserService()
+        stub.enqueueSettings(success: settings(viewingPreference: .allMessages))
+        let viewModel = PreferencesViewModel(userService: stub)
+        await viewModel.load()
+
+        viewModel.settings.viewingPreference = .myMessages
+        stub.enqueueUpdateSettings(failure: URLError(.timedOut))
+        await viewModel.save()
+
+        XCTAssertNotNil(viewModel.error)
+        XCTAssertTrue(viewModel.hasChanges)
+        XCTAssertEqual(viewModel.settings.viewingPreference, .myMessages)
+        XCTAssertEqual(viewModel.lastSaved.viewingPreference, .allMessages)
+    }
+
+    // MARK: - Composer gear (makes "Show advanced post options" real)
+
+    func test_givenPreferenceOn_whenComposerOpens_thenAdvancedOptionsStartRevealed() {
+        let viewModel = ComposerViewModel(
+            messages: StubMessagesService(),
+            eventBus: ComposerEventBus(),
+            initialShowsAdvancedOptions: true
+        )
+
+        XCTAssertTrue(viewModel.showsAdvancedOptions)
+    }
+
+    func test_givenPreferenceOff_whenComposerOpens_thenAdvancedOptionsStartHidden() {
+        // The bug this fixes: before G35 the preference was persisted and read
+        // by the Preferences pane and by nothing else, so turning it off
+        // changed nothing in the composer.
+        let viewModel = ComposerViewModel(
+            messages: StubMessagesService(),
+            eventBus: ComposerEventBus(),
+            initialShowsAdvancedOptions: false
+        )
+
+        XCTAssertFalse(viewModel.showsAdvancedOptions)
+    }
+
+    func test_givenGearTapped_whenToggling_thenRevealsOptionsAndPersistsThePreference() async {
+        // Happy path, mirroring the web gear: flip the panel *and* PATCH the
+        // single `showAdvancedPostSettings` key.
+        let stub = StubUserService()
+        stub.enqueueSetShowAdvancedPostSettings(success: settings(showAdvancedPostSettings: true))
+        let viewModel = ComposerViewModel(
+            messages: StubMessagesService(),
+            eventBus: ComposerEventBus(),
+            userService: stub,
+            initialShowsAdvancedOptions: false
+        )
+
+        await viewModel.toggleAdvancedOptions()
+
+        XCTAssertTrue(viewModel.showsAdvancedOptions)
+        XCTAssertTrue(stub.recorded.contains { $0.kind == .setShowAdvancedPostSettings(enabled: true) })
+        XCTAssertNil(viewModel.error)
+    }
+
+    func test_givenGearWriteFails_whenToggling_thenRollsBackAndSurfacesTheError() async {
+        // Upstream failure + optimistic-UI rollback: the panel must not sit in
+        // a state the account does not hold.
+        let stub = StubUserService()
+        stub.enqueueSetShowAdvancedPostSettings(failure: URLError(.notConnectedToInternet))
+        let viewModel = ComposerViewModel(
+            messages: StubMessagesService(),
+            eventBus: ComposerEventBus(),
+            userService: stub,
+            initialShowsAdvancedOptions: true
+        )
+
+        await viewModel.toggleAdvancedOptions()
+
+        XCTAssertTrue(viewModel.showsAdvancedOptions, "The optimistic hide must be rolled back")
+        XCTAssertNotNil(viewModel.error)
+    }
+
+    func test_givenServerDisagrees_whenToggling_thenAdoptsTheServersAnswer() async {
+        // The server is authoritative: if it refuses to flip the flag, the UI
+        // follows it rather than the optimistic guess.
+        let stub = StubUserService()
+        stub.enqueueSetShowAdvancedPostSettings(success: settings(showAdvancedPostSettings: false))
+        let viewModel = ComposerViewModel(
+            messages: StubMessagesService(),
+            eventBus: ComposerEventBus(),
+            userService: stub,
+            initialShowsAdvancedOptions: false
+        )
+
+        await viewModel.toggleAdvancedOptions()
+
+        XCTAssertFalse(viewModel.showsAdvancedOptions)
+    }
+
+    func test_givenNoUserService_whenTogglingTheGear_thenStillFlipsLocally() async {
+        // Boundary: previews and test hosts have no network seam wired; the
+        // affordance must still work rather than appearing dead.
+        let viewModel = ComposerViewModel(
+            messages: StubMessagesService(),
+            eventBus: ComposerEventBus(),
+            initialShowsAdvancedOptions: false
+        )
+
+        await viewModel.toggleAdvancedOptions()
+
+        XCTAssertTrue(viewModel.showsAdvancedOptions)
+        XCTAssertNil(viewModel.error)
+    }
+
+    // MARK: - Notification tray limit reaches the service
+
+    func test_givenTrayLimit_whenLoadingNotifications_thenPassesItToTheService() async {
+        // The preference had no reader at all before this.
+        let stub = StubNotificationsService()
+        await stub.enqueueTray(success: NotificationTray(unreadCount: 0, items: []))
+        let viewModel = NotificationsListViewModel(service: stub, trayLimit: 25)
+
+        await viewModel.load()
+
+        let recorded = await stub.recorded
+        XCTAssertEqual(recorded.first?.kind, .tray(limit: 25))
+    }
+
+    func test_givenNoTrayLimit_whenLoadingNotifications_thenLeavesThePageSizeToTheServer() async {
+        // Boundary: the parameter is optional so existing callers are unchanged.
+        let stub = StubNotificationsService()
+        await stub.enqueueTray(success: NotificationTray(unreadCount: 0, items: []))
+        let viewModel = NotificationsListViewModel(service: stub)
+
+        await viewModel.load()
+
+        let recorded = await stub.recorded
+        XCTAssertEqual(recorded.first?.kind, .tray(limit: nil))
+    }
+}
diff --git a/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/TimelineScope.swift b/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/TimelineScope.swift
index 3c7c6b1..8160b77 100644
--- a/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/TimelineScope.swift
+++ b/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/TimelineScope.swift
@@ -17,16 +17,38 @@ public enum TimelineScope: Sendable, Equatable, Hashable, CaseIterable {
     /// 2.1 requires every visible control to have a graceful unavailable
     /// state rather than a broken or missing one).
     case following
+    /// Feed of accounts that follow the signed-in user — the destination for
+    /// the account's `followers_only` viewing preference (G35 / issue #43).
+    ///
+    /// Like `.following`, it has no API endpoint. VERIFIED live 2026-09-09:
+    /// `GET /api/messages` honours only `onlyMine`; `?scope=following`,
+    /// `?viewingPreference=followers_only` and `?filter=followers_only` each
+    /// return the identical unfiltered page. The case exists so a web-set
+    /// `followers_only` preference lands on an honest "coming soon" state
+    /// instead of being silently rewritten to the full timeline.
+    case followers
 
     /// The `onlyMine` query flag this scope maps to. `nil` means "do not send
     /// the parameter", which the API treats as the full timeline.
-    /// `.following` is short-circuited in the service before this property
-    /// is ever consulted — the value here is kept as `nil` for safety.
+    /// `.following` / `.followers` are short-circuited in the service before
+    /// this property is ever consulted — the values here are kept as `nil`
+    /// for safety.
     public var onlyMine: Bool? {
         switch self {
         case .all:       return nil
         case .mine:      return true
         case .following: return nil
+        case .followers: return nil
+        }
+    }
+
+    /// Whether the API can serve this scope today. `false` means the UI must
+    /// render the "coming soon" empty state rather than an empty feed that
+    /// looks like "you have no messages".
+    public var hasBackendFeed: Bool {
+        switch self {
+        case .all, .mine:            return true
+        case .following, .followers: return false
         }
     }
 }
diff --git a/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/UserSettings.swift b/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/UserSettings.swift
index ee89527..1c066bc 100644
--- a/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/UserSettings.swift
+++ b/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/UserSettings.swift
@@ -2,58 +2,106 @@ import Foundation
 import InterlinedKit
 
 /// The user's server-synced account preferences (work-consolidation.md — settings
-/// storage). Read from `GET /api/user` and written with `POST /api/user/update`.
+/// storage; G35 / issue #43 for the View Preferences completion). Read from
+/// `GET /api/user` and written with `PATCH /api/user/update`.
 ///
 /// This is the domain projection of the editable preference fields on `UserDTO`.
-/// It intentionally covers only the settings with clear, verified semantics —
-/// booleans and a page-size integer. `theme` and `viewingPreference` are carried
-/// on the wire too, but their valid value sets aren't confirmed yet, so they are
-/// left out of this typed surface (a `POST /api/user/update` omits nil fields, so
-/// leaving them out never clobbers them). Adding them is a follow-up once the
-/// server documents the allowed values.
+/// `theme` is still carried on the wire only — its valid value set is unverified,
+/// and an update omits nil fields, so leaving it out never clobbers it.
+///
+/// **Ranges are enforced here, not just in the UI.** The web's View Preferences
+/// card validates `messagesPerPage` to 10...30 and `notificationTrayLimit` to
+/// 10...40 before it will PATCH (verified against the live client 2026-09-09), so
+/// a value outside those bounds is unrepresentable on the web. Both fields are
+/// therefore clamped on *read* as well as on *write*: an account that already
+/// stores an out-of-range value (the macOS pane used to offer `5...100`) is
+/// corrected on load rather than re-sending the bad value.
 public struct UserSettings: Sendable, Equatable {
 
+    /// Values the web's "Messages per page" control accepts (`min=10 max=30`).
+    public static let messagesPerPageRange: ClosedRange<Int> = 10...30
+
+    /// Values the web's "Notifications in tray" control accepts
+    /// (`min=10 max=40`, default 20).
+    public static let notificationTrayLimitRange: ClosedRange<Int> = 10...40
+
     /// New posts default to public visibility rather than private.
     public var defaultPubliclyVisible: Bool
     /// Render rich link-preview cards on posts.
     public var showPreviews: Bool
-    /// Reveal the advanced post options (scheduling / cross-post / media) by
-    /// default in the composer.
+    /// Reveal the advanced post options (media / scheduling / cross-post) by
+    /// default in the composer — the "gear" affordance the web describes.
     public var showAdvancedPostSettings: Bool
     /// The account is private (followers must be approved).
     public var isPrivateAccount: Bool
-    /// How many posts a feed page requests.
-    public var messagesPerPage: Int
+    /// Which slice of the feed the account wants by default.
+    public var viewingPreference: ViewingPreference
+
+    /// How many posts a feed page requests. Always within
+    /// `messagesPerPageRange` — the setter clamps.
+    public var messagesPerPage: Int {
+        get { storedMessagesPerPage }
+        set { storedMessagesPerPage = Self.clamp(newValue, to: Self.messagesPerPageRange) }
+    }
+
+    /// How many rows the notification bell tray holds. Always within
+    /// `notificationTrayLimitRange` — the setter clamps.
+    public var notificationTrayLimit: Int {
+        get { storedNotificationTrayLimit }
+        set { storedNotificationTrayLimit = Self.clamp(newValue, to: Self.notificationTrayLimitRange) }
+    }
+
+    /// Backing storage for the two clamped properties. Private so no caller can
+    /// route around the clamp; `Equatable` still compares them because synthesised
+    /// conformance uses stored properties.
+    private var storedMessagesPerPage: Int
+    private var storedNotificationTrayLimit: Int
 
     public init(
         defaultPubliclyVisible: Bool,
         showPreviews: Bool,
         showAdvancedPostSettings: Bool,
         isPrivateAccount: Bool,
-        messagesPerPage: Int
+        messagesPerPage: Int,
+        viewingPreference: ViewingPreference = .allMessages,
+        notificationTrayLimit: Int = 20
     ) {
         self.defaultPubliclyVisible = defaultPubliclyVisible
         self.showPreviews = showPreviews
         self.showAdvancedPostSettings = showAdvancedPostSettings
         self.isPrivateAccount = isPrivateAccount
-        self.messagesPerPage = messagesPerPage
+        self.viewingPreference = viewingPreference
+        self.storedMessagesPerPage = Self.clamp(messagesPerPage, to: Self.messagesPerPageRange)
+        self.storedNotificationTrayLimit = Self.clamp(
+            notificationTrayLimit,
+            to: Self.notificationTrayLimitRange
+        )
     }
 
     /// Sensible fallbacks used for any field the server omits, so a partial
     /// payload never yields a nonsensical setting (e.g. a zero page size).
+    /// Matches the server's own defaults: `all_messages`, tray limit 20.
     public static let `default` = UserSettings(
         defaultPubliclyVisible: true,
         showPreviews: true,
         showAdvancedPostSettings: false,
         isPrivateAccount: false,
-        messagesPerPage: 20
+        messagesPerPage: 20,
+        viewingPreference: .allMessages,
+        notificationTrayLimit: 20
     )
+
+    private static func clamp(_ value: Int, to range: ClosedRange<Int>) -> Int {
+        min(max(value, range.lowerBound), range.upperBound)
+    }
 }
 
 public extension UserSettings {
 
     /// Maps the editable preference fields off a decoded `UserDTO`, falling back
-    /// to `default` for any absent field.
+    /// to `default` for any absent field. Out-of-range integers are clamped by
+    /// the initializer, so a legacy stored value (e.g. `messagesPerPage: 5`
+    /// saved by an older macOS build) is corrected on load.
     init(from dto: UserDTO) {
         let fallback = UserSettings.default
         self.init(
@@ -61,21 +109,29 @@ public extension UserSettings {
             showPreviews: dto.showPreviews ?? fallback.showPreviews,
             showAdvancedPostSettings: dto.showAdvancedPostSettings ?? fallback.showAdvancedPostSettings,
             isPrivateAccount: dto.isPrivateAccount ?? fallback.isPrivateAccount,
-            messagesPerPage: dto.messagesPerPage ?? fallback.messagesPerPage
+            messagesPerPage: dto.messagesPerPage ?? fallback.messagesPerPage,
+            viewingPreference: dto.viewingPreference.map(ViewingPreference.init(wireToken:))
+                ?? fallback.viewingPreference,
+            notificationTrayLimit: dto.notificationTrayLimit ?? fallback.notificationTrayLimit
         )
     }
 
-    /// The `POST /api/user/update` body that persists this settings snapshot.
-    /// All five managed fields are sent so the pane's "Save" applies the full
+    /// The `PATCH /api/user/update` body that persists this settings snapshot.
+    /// All seven managed fields are sent so the pane's "Save" applies the full
     /// current state; other profile fields (name, bio, theme, …) are left nil
     /// and therefore untouched.
+    ///
+    /// The two integers are read through the clamped accessors, so this body can
+    /// never carry a value the web would reject.
     var updateRequest: UpdateUserRequest {
         UpdateUserRequest(
             defaultPubliclyVisible: defaultPubliclyVisible,
             messagesPerPage: messagesPerPage,
+            viewingPreference: viewingPreference.wireToken,
             showPreviews: showPreviews,
             showAdvancedPostSettings: showAdvancedPostSettings,
-            isPrivateAccount: isPrivateAccount
+            isPrivateAccount: isPrivateAccount,
+            notificationTrayLimit: notificationTrayLimit
         )
     }
 }
diff --git a/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/ViewingPreference.swift b/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/ViewingPreference.swift
new file mode 100644
index 0000000..805c682
--- /dev/null
+++ b/Packages/InterlinedDomain/Sources/InterlinedDomain/Models/ViewingPreference.swift
@@ -0,0 +1,111 @@
+import Foundation
+
+/// Which slice of the feed the account's stored "Viewing" preference asks for
+/// (work-consolidation.md G35 / issue #43).
+///
+/// This is the domain projection of `UserDTO.viewingPreference`, which was
+/// decoded but deliberately excluded from `UserSettings` because the valid value
+/// set was unconfirmed. It is confirmed now.
+///
+/// **Wire vocabulary — VERIFIED live 2026-09-09.** The web Settings form's own
+/// `<select id="viewingPreference">` offers exactly four `<option value>` tokens,
+/// and the test account reads back `"all_messages"`:
+///
+/// | Token             | Label           |
+/// |-------------------|-----------------|
+/// | `my_messages`     | My Messages     |
+/// | `all_messages`    | All Messages    |
+/// | `followers_only`  | Followers Only  |
+/// | `following_only`  | Following Only  |
+///
+/// `other` is a deliberate escape hatch, not dead code: it preserves a token the
+/// server introduces later so a macOS save round-trips it untouched instead of
+/// silently rewriting the account to `all_messages`. Nothing throws on an
+/// unrecognised token — `defaultScope` resolves it to `.all`, the safest feed.
+public enum ViewingPreference: Sendable, Equatable, Hashable {
+
+    /// Only the signed-in account's own messages.
+    case myMessages
+    /// Everyone's public timeline. The server default.
+    case allMessages
+    /// Messages from accounts that follow you. **No backend feed exists** —
+    /// see `hasBackendFeed`.
+    case followersOnly
+    /// Messages from accounts you follow. **No backend feed exists** — this is
+    /// the same P1-G gap that keeps `TimelineScope.following` short-circuited.
+    case followingOnly
+    /// A token this build does not recognise, carried verbatim so a save never
+    /// clobbers a value set by a newer server or by the web.
+    case other(String)
+
+    /// Maps a wire token onto a case. Unknown, empty, and whitespace-only
+    /// tokens become `.other`; `nil` is the caller's problem (use
+    /// `init(wireToken:)` with the server default when the field is absent).
+    public init(wireToken: String) {
+        switch wireToken.trimmingCharacters(in: .whitespacesAndNewlines) {
+        case "my_messages":    self = .myMessages
+        case "all_messages":   self = .allMessages
+        case "followers_only": self = .followersOnly
+        case "following_only": self = .followingOnly
+        case let token:        self = .other(token)
+        }
+    }
+
+    /// The token sent back in `UpdateUserRequest.viewingPreference`.
+    public var wireToken: String {
+        switch self {
+        case .myMessages:       return "my_messages"
+        case .allMessages:      return "all_messages"
+        case .followersOnly:    return "followers_only"
+        case .followingOnly:    return "following_only"
+        case .other(let token): return token
+        }
+    }
+
+    /// Human label, matching the web form's `<option>` text exactly so the two
+    /// clients read the same.
+    public var displayName: String {
+        switch self {
+        case .myMessages:       return "My Messages"
+        case .allMessages:      return "All Messages"
+        case .followersOnly:    return "Followers Only"
+        case .followingOnly:    return "Following Only"
+        case .other(let token): return token
+        }
+    }
+
+    /// The four values a user can pick, in the web form's order. `.other` is
+    /// never offered — it only ever arrives from the server.
+    public static let selectable: [ViewingPreference] = [
+        .myMessages, .allMessages, .followersOnly, .followingOnly
+    ]
+
+    /// The timeline scope this preference asks the feed to open on.
+    ///
+    /// An unrecognised token resolves to `.all` rather than throwing: the
+    /// account still gets a working feed, and the stored token is preserved for
+    /// round-trip by `wireToken`.
+    public var defaultScope: TimelineScope {
+        switch self {
+        case .myMessages:    return .mine
+        case .allMessages:   return .all
+        case .followersOnly: return .followers
+        case .followingOnly: return .following
+        case .other:         return .all
+        }
+    }
+
+    /// Whether the API can actually serve this slice today.
+    ///
+    /// VERIFIED live 2026-09-09: `GET /api/messages` honours only `onlyMine`.
+    /// `?scope=following`, `?viewingPreference=followers_only` and
+    /// `?filter=followers_only` all return the identical unfiltered page, so
+    /// neither follower feed exists (P1-G). The UI must show the honest
+    /// "coming soon" empty state for these rather than a silently-wrong feed.
+    public var hasBackendFeed: Bool {
+        switch self {
+        case .myMessages, .allMessages, .other: return true
+        case .followersOnly, .followingOnly:    return false
+        }
+    }
+}
diff --git a/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/MessagesService.swift b/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/MessagesService.swift
index 99c1928..4ebc316 100644
--- a/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/MessagesService.swift
+++ b/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/MessagesService.swift
@@ -390,11 +390,18 @@ public final class MessagesService: MessagesServicing {
         limit: Int,
         offset: Int
     ) async throws -> TimelinePage {
-        // The Following feed has no API endpoint yet. Return an empty page
+        // Neither follower feed has an API endpoint yet. Return an empty page
         // immediately — no network call, no store write — so the view model
         // surfaces a "coming soon" empty state rather than a spinner that
         // never resolves or a spurious API error (App Store Guideline 2.1).
-        if scope == .following {
+        //
+        // Re-verified live 2026-09-09 (G35 / issue #43): `GET /api/messages`
+        // honours only `onlyMine`. `?scope=following`,
+        // `?viewingPreference=followers_only` and `?filter=followers_only` all
+        // return the identical unfiltered page, so sending the request would
+        // render the *full* timeline under a "Followers" / "Following" label —
+        // a silently-wrong feed, which is worse than an honest empty state.
+        guard scope.hasBackendFeed else {
             return TimelinePage(messages: [], hasMore: false, nextOffset: nil)
         }
         do {
diff --git a/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/NotificationsService.swift b/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/NotificationsService.swift
index 687c22b..3629552 100644
--- a/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/NotificationsService.swift
+++ b/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/NotificationsService.swift
@@ -7,18 +7,32 @@ import InterlinedKit
 /// mark-one-read, mark-all-read (PLAN.md §1 "Notifications", §6 M5).
 ///
 /// **Scope.** The API only accepts `scope=tray` today (the kit endpoint
-/// encodes it for us). The user-side `notificationTrayLimit` (server-side,
-/// clamped 10–40, default 20) controls the page size; this service does
-/// **not** pass a client-side `limit` because the server ignores it.
+/// encodes it for us). The user-side `notificationTrayLimit` (10–40, default
+/// 20) controls the page size.
+///
+/// **Tray limit — corrected 2026-09-09 (G35 / issue #43).** The previous note
+/// here claimed the server ignores a client `limit` outright. A live probe
+/// disproves that: unscoped, `?limit=5` returns 5 rows and `?limit=40` returns
+/// 36, and omitting it returns exactly the account's stored limit. Only the
+/// `scope=tray` form ignores it. So `tray(limit:)` both sends the value *and*
+/// caps the decoded rows client-side — the send is what will start working the
+/// moment the tray route honours it, and the cap is what makes the preference
+/// observable today.
 ///
 /// Follows the same DI shape as the other domain services — takes its
 /// `APIClientProtocol` as a parameter so unit tests run against a stub.
 public protocol NotificationsServicing: Sendable {
 
-    /// Loads the current notification tray. Returns the domain
-    /// `NotificationTray` (server-authoritative `unreadCount` + the items
-    /// page).
-    func tray() async throws -> NotificationTray
+    /// Loads the current notification tray, showing at most `limit` rows.
+    /// Returns the domain `NotificationTray` (server-authoritative
+    /// `unreadCount` + the items page).
+    ///
+    /// - Parameter limit: the account's `notificationTrayLimit`. `nil` (the
+    ///   default, via the `tray()` convenience) leaves the page size entirely
+    ///   to the server. `unreadCount` is never capped — it is the server's own
+    ///   total and stays authoritative for the badge even when the rendered
+    ///   rows are trimmed.
+    func tray(limit: Int?) async throws -> NotificationTray
 
     /// Marks a single notification read by id. The service does not return
     /// the updated row — the wire response is a `{ ok: Bool }` confirmation.
@@ -32,6 +46,16 @@ public protocol NotificationsServicing: Sendable {
     func markAllRead() async throws
 }
 
+public extension NotificationsServicing {
+
+    /// Loads the tray with no client-side limit — the server applies the
+    /// account's own `notificationTrayLimit`. Kept so callers that have no
+    /// preference to hand (background refreshers, tests) read unchanged.
+    func tray() async throws -> NotificationTray {
+        try await tray(limit: nil)
+    }
+}
+
 // MARK: - NotificationsService
 
 public final class NotificationsService: NotificationsServicing {
@@ -44,9 +68,18 @@ public final class NotificationsService: NotificationsServicing {
         self.api = api
     }
 
-    public func tray() async throws -> NotificationTray {
-        let dto = try await api.send(Notifications.tray())
-        return NotificationTray(from: dto)
+    public func tray(limit: Int?) async throws -> NotificationTray {
+        let dto = try await api.send(Notifications.tray(limit: limit))
+        let tray = NotificationTray(from: dto)
+        // Client-side cap: `scope=tray` ignores the query parameter today, so
+        // without this the user's limit would have no visible effect. The
+        // server-authoritative `unreadCount` is preserved as-is — trimming the
+        // rendered rows must not understate the badge.
+        guard let limit, limit > 0, tray.items.count > limit else { return tray }
+        return NotificationTray(
+            unreadCount: tray.unreadCount,
+            items: Array(tray.items.prefix(limit))
+        )
     }
 
     public func markRead(id: String) async throws {
diff --git a/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/UserService.swift b/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/UserService.swift
index cdebbb1..f129e70 100644
--- a/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/UserService.swift
+++ b/Packages/InterlinedDomain/Sources/InterlinedDomain/Services/UserService.swift
@@ -86,10 +86,21 @@ public protocol UserServicing: Sendable {
     /// (work-consolidation.md — settings storage). Maps `GET /api/user`.
     func settings() async throws -> UserSettings
 
-    /// Persists a settings snapshot via `POST /api/user/update` and returns the
+    /// Persists a settings snapshot via `PATCH /api/user/update` and returns the
     /// server's authoritative post-update settings.
     func updateSettings(_ settings: UserSettings) async throws -> UserSettings
 
+    /// Persists **only** the "show advanced post options" preference and returns
+    /// the server's authoritative post-update settings.
+    ///
+    /// Exists because the composer's gear toggles this preference mid-compose
+    /// and must not carry a whole `UserSettings` snapshot with it — a stale
+    /// snapshot from another window would clobber a page size or viewing
+    /// preference the user changed in Settings a moment earlier. Mirrors the
+    /// web client, which PATCHes the single key `{ showAdvancedPostSettings }`
+    /// from its own gear button (verified against the live bundle 2026-09-09).
+    func setShowAdvancedPostSettings(_ enabled: Bool) async throws -> UserSettings
+
     // MARK: - User search / lookup (NW-1)
 
     /// Searches for users by username prefix. Returns the first `limit` matches.
@@ -290,6 +301,15 @@ public final class UserService: UserServicing {
         return UserSettings(from: response.user)
     }
 
+    public func setShowAdvancedPostSettings(_ enabled: Bool) async throws -> UserSettings {
+        // Single-key body on purpose — `UpdateUserRequest` omits nil fields, so
+        // nothing else on the account is touched.
+        let response = try await api.send(
+            User.update(UpdateUserRequest(showAdvancedPostSettings: enabled))
+        )
+        return UserSettings(from: response.user)
+    }
+
     // MARK: - User search / lookup (NW-1)
 
     public func searchUsers(query: String, limit: Int?) async throws -> [UserSearchResult] {
diff --git a/Packages/InterlinedDomain/Tests/InterlinedDomainTests/UserSettingsTests.swift b/Packages/InterlinedDomain/Tests/InterlinedDomainTests/UserSettingsTests.swift
index 0f324a4..b810153 100644
--- a/Packages/InterlinedDomain/Tests/InterlinedDomainTests/UserSettingsTests.swift
+++ b/Packages/InterlinedDomain/Tests/InterlinedDomainTests/UserSettingsTests.swift
@@ -3,15 +3,19 @@ import InterlinedKit
 @testable import InterlinedDomain
 
 /// BDD-named coverage for the `UserSettings` mapper + update-request builder
-/// (work-consolidation.md — settings storage).
+/// (work-consolidation.md — settings storage; G35 / issue #43 for the View
+/// Preferences completion: the clamped ranges, `viewingPreference`, and
+/// `notificationTrayLimit`).
 final class UserSettingsTests: XCTestCase {
 
     private func dto(
         defaultPubliclyVisible: Bool? = nil,
         messagesPerPage: Int? = nil,
+        viewingPreference: String? = nil,
         showPreviews: Bool? = nil,
         showAdvancedPostSettings: Bool? = nil,
-        isPrivateAccount: Bool? = nil
+        isPrivateAccount: Bool? = nil,
+        notificationTrayLimit: Int? = nil
     ) -> UserDTO {
         UserDTO(
             id: "u1",
@@ -20,42 +24,132 @@ final class UserSettingsTests: XCTestCase {
             emailVerified: true,
             defaultPubliclyVisible: defaultPubliclyVisible,
             messagesPerPage: messagesPerPage,
+            viewingPreference: viewingPreference,
             showPreviews: showPreviews,
             showAdvancedPostSettings: showAdvancedPostSettings,
             isPrivateAccount: isPrivateAccount,
             customerStatus: "free",
+            notificationTrayLimit: notificationTrayLimit,
             createdAt: Date(timeIntervalSince1970: 1_700_000_000)
         )
     }
 
+    // MARK: - Happy path
+
     func test_givenFullDTO_whenMapping_thenReadsEveryPreferenceField() {
         let settings = UserSettings(from: dto(
             defaultPubliclyVisible: false,
-            messagesPerPage: 42,
+            messagesPerPage: 25,
+            viewingPreference: "followers_only",
             showPreviews: false,
             showAdvancedPostSettings: true,
-            isPrivateAccount: true
+            isPrivateAccount: true,
+            notificationTrayLimit: 35
         ))
 
         XCTAssertFalse(settings.defaultPubliclyVisible)
-        XCTAssertEqual(settings.messagesPerPage, 42)
+        XCTAssertEqual(settings.messagesPerPage, 25)
+        XCTAssertEqual(settings.viewingPreference, .followersOnly)
         XCTAssertFalse(settings.showPreviews)
         XCTAssertTrue(settings.showAdvancedPostSettings)
         XCTAssertTrue(settings.isPrivateAccount)
+        XCTAssertEqual(settings.notificationTrayLimit, 35)
+    }
+
+    /// Happy path from the issue's test plan: "each of the four viewing
+    /// preferences round-trips". Wire token in → typed case → same token out.
+    func test_givenEachDocumentedViewingPreference_whenRoundTripped_thenTokenSurvives() {
+        let expectations: [(token: String, expected: ViewingPreference)] = [
+            ("my_messages", .myMessages),
+            ("all_messages", .allMessages),
+            ("followers_only", .followersOnly),
+            ("following_only", .followingOnly)
+        ]
+
+        for expectation in expectations {
+            let settings = UserSettings(from: dto(viewingPreference: expectation.token))
+            XCTAssertEqual(
+                settings.viewingPreference,
+                expectation.expected,
+                "\(expectation.token) did not decode to the expected case"
+            )
+            XCTAssertEqual(
+                settings.updateRequest.viewingPreference,
+                expectation.token,
+                "\(expectation.token) did not round-trip back onto the wire"
+            )
+        }
+    }
+
+    // MARK: - Invalid input
+
+    /// An unrecognised token must not throw and must not be rewritten: it is
+    /// carried verbatim for round-trip, and only the *scope* falls back to All.
+    func test_givenUnrecognisedViewingPreference_whenMapping_thenFallsBackToAllWithoutLosingTheToken() {
+        let settings = UserSettings(from: dto(viewingPreference: "quantum_only"))
+
+        XCTAssertEqual(settings.viewingPreference, .other("quantum_only"))
+        XCTAssertEqual(settings.viewingPreference.defaultScope, .all)
+        XCTAssertEqual(
+            settings.updateRequest.viewingPreference,
+            "quantum_only",
+            "A save must not clobber a preference this build doesn't understand"
+        )
     }
 
     func test_givenMissingFields_whenMapping_thenFallsBackToDefaults() {
         let settings = UserSettings(from: dto())   // all preference fields nil
         XCTAssertEqual(settings, .default)
+        XCTAssertEqual(settings.viewingPreference, .allMessages)
+        XCTAssertEqual(settings.notificationTrayLimit, 20)
     }
 
+    // MARK: - Boundary (the issue's 9/10/30/31 and 9/10/40/41 cases)
+
+    func test_givenOutOfRangeMessagesPerPage_whenMapping_thenClampsToTheWebsRange() {
+        // Below, at, at, above — the two interior values must pass through.
+        XCTAssertEqual(UserSettings(from: dto(messagesPerPage: 9)).messagesPerPage, 10)
+        XCTAssertEqual(UserSettings(from: dto(messagesPerPage: 10)).messagesPerPage, 10)
+        XCTAssertEqual(UserSettings(from: dto(messagesPerPage: 30)).messagesPerPage, 30)
+        XCTAssertEqual(UserSettings(from: dto(messagesPerPage: 31)).messagesPerPage, 30)
+        // The legacy value the old `5...100 step 5` control could save.
+        XCTAssertEqual(UserSettings(from: dto(messagesPerPage: 5)).messagesPerPage, 10)
+        XCTAssertEqual(UserSettings(from: dto(messagesPerPage: 100)).messagesPerPage, 30)
+    }
+
+    func test_givenOutOfRangeNotificationTrayLimit_whenMapping_thenClampsToTheWebsRange() {
+        XCTAssertEqual(UserSettings(from: dto(notificationTrayLimit: 9)).notificationTrayLimit, 10)
+        XCTAssertEqual(UserSettings(from: dto(notificationTrayLimit: 10)).notificationTrayLimit, 10)
+        XCTAssertEqual(UserSettings(from: dto(notificationTrayLimit: 40)).notificationTrayLimit, 40)
+        XCTAssertEqual(UserSettings(from: dto(notificationTrayLimit: 41)).notificationTrayLimit, 40)
+    }
+
+    /// Clamping has to hold on *write* too, not just on read — a view model
+    /// assigning straight into the working copy must not be able to produce a
+    /// body the web would reject.
+    func test_givenOutOfRangeAssignment_whenBuildingUpdateRequest_thenSendsClampedValues() {
+        var settings = UserSettings.default
+
+        settings.messagesPerPage = 100
+        settings.notificationTrayLimit = 1
+
+        XCTAssertEqual(settings.messagesPerPage, 30)
+        XCTAssertEqual(settings.notificationTrayLimit, 10)
+        XCTAssertEqual(settings.updateRequest.messagesPerPage, 30)
+        XCTAssertEqual(settings.updateRequest.notificationTrayLimit, 10)
+    }
+
+    // MARK: - Update request
+
     func test_givenSettings_whenBuildingUpdateRequest_thenSendsManagedFieldsOnly() {
         let settings = UserSettings(
             defaultPubliclyVisible: false,
             showPreviews: true,
             showAdvancedPostSettings: true,
             isPrivateAccount: false,
-            messagesPerPage: 25
+            messagesPerPage: 25,
+            viewingPreference: .myMessages,
+            notificationTrayLimit: 30
         )
 
         let request = settings.updateRequest
@@ -65,10 +159,11 @@ final class UserSettingsTests: XCTestCase {
         XCTAssertEqual(request.showAdvancedPostSettings, true)
         XCTAssertEqual(request.isPrivateAccount, false)
         XCTAssertEqual(request.messagesPerPage, 25)
+        XCTAssertEqual(request.viewingPreference, "my_messages")
+        XCTAssertEqual(request.notificationTrayLimit, 30)
         // Profile-only fields stay nil so a settings save never clobbers them.
         XCTAssertNil(request.displayName)
         XCTAssertNil(request.bio)
         XCTAssertNil(request.theme)
-        XCTAssertNil(request.viewingPreference)
     }
 }
diff --git a/Packages/InterlinedDomain/Tests/InterlinedDomainTests/ViewPreferencesWiringTests.swift b/Packages/InterlinedDomain/Tests/InterlinedDomainTests/ViewPreferencesWiringTests.swift
new file mode 100644
index 0000000..378ca9b
--- /dev/null
+++ b/Packages/InterlinedDomain/Tests/InterlinedDomainTests/ViewPreferencesWiringTests.swift
@@ -0,0 +1,190 @@
+import XCTest
+import InterlinedKit
+@testable import InterlinedDomain
+
+/// BDD-named coverage for the service-side wiring of the account's View
+/// Preferences (work-consolidation.md G35 / issue #43):
+///
+/// - the `.followers` timeline scope short-circuits like `.following`, because
+///   the API has no follower feed (re-verified live 2026-09-09);
+/// - `NotificationsService.tray(limit:)` sends *and* enforces the account's
+///   notification tray limit;
+/// - `UserService.setShowAdvancedPostSettings` writes exactly one field, which
+///   is what lets the composer's gear persist without carrying a stale
+///   settings snapshot.
+final class ViewPreferencesWiringTests: XCTestCase {
+
+    // MARK: - Timeline: .followers scope (App Store — Coming Soon gating)
+
+    func test_givenFollowersScope_whenLoadingTimeline_thenReturnsEmptyPageWithoutAPICall() async throws {
+        // Given — nothing enqueued: any accidental API call makes the stub throw.
+        let api = StubAPIClient()
+        let service = MessagesService(api: api)
+
+        // When
+        let page = try await service.timeline(scope: .followers, tag: nil, limit: 20, offset: 0)
+
+        // Then — empty page, and the network was never touched. Sending the
+        // request would return the *unfiltered* timeline under a "Followers"
+        // label, which is worse than an honest empty state.
+        XCTAssertTrue(page.messages.isEmpty)
+        XCTAssertFalse(page.hasMore)
+        XCTAssertNil(page.nextOffset)
+        let recorded = await api.recorded
+        XCTAssertTrue(recorded.isEmpty, "No API request must be made for the .followers scope")
+    }
+
+    func test_givenFollowersScopeWithStore_whenLoadingTimeline_thenCacheIsNotWritten() async throws {
+        // Boundary: a wired cache must not be poisoned with an empty page,
+        // which would then be served as a "cached" result to the real feeds.
+        let api = StubAPIClient()
+        let store = InMemoryMessageStore()
+        let service = MessagesService(api: api, store: store)
+
+        _ = try await service.timeline(scope: .followers, tag: nil, limit: 20, offset: 0)
+
+        let cached = await store.cachedTimeline(scope: .followers, tag: nil)
+        XCTAssertTrue(cached.isEmpty)
+    }
+
+    func test_givenServedScope_whenLoadingTimeline_thenStillCallsTheAPI() async throws {
+        // Guard against the short-circuit widening: `.all` must keep fetching.
+        let api = StubAPIClient()
+        await api.enqueue(json: Fixtures.paginatedMessages(ids: ["m-1"]))
+        let service = MessagesService(api: api)
+
+        _ = try await service.timeline(scope: .all, tag: nil, limit: 20, offset: 0)
+
+        let recorded = await api.recorded
+        XCTAssertEqual(recorded.first?.path, "/api/messages")
+    }
+
+    // MARK: - Notification tray limit
+
+    func test_givenTrayLimit_whenLoadingTray_thenSendsItAndTrimsTheRenderedRows() async throws {
+        // Given — the server returns more rows than the account's limit. Under
+        // `scope=tray` it ignores the query parameter (probed 2026-09-09), so
+        // the client-side cap is what makes the preference observable.
+        let api = StubAPIClient()
+        let items = (1...5).map { Fixtures.notificationObject(id: "n-\($0)") }
+        await api.enqueue(json: Fixtures.notificationTrayEnvelope(unreadCount: 4, items: items))
+        let service = NotificationsService(api: api)
+
+        // When
+        let tray = try await service.tray(limit: 2)
+
+        // Then — trimmed rows, untouched unread count, and the limit on the wire.
+        XCTAssertEqual(tray.items.map(\.id), ["n-1", "n-2"])
+        XCTAssertEqual(
+            tray.unreadCount,
+            4,
+            "The server-authoritative unread badge must not be understated by trimming rows"
+        )
+        let recorded = await api.recorded
+        XCTAssertEqual(recorded.first?.query["scope"], "tray")
+        XCTAssertEqual(recorded.first?.query["limit"], "2")
+    }
+
+    func test_givenNoTrayLimit_whenLoadingTray_thenOmitsTheParameterAndKeepsEveryRow() async throws {
+        // Boundary: `nil` leaves the page size entirely to the server, which
+        // applies the account's own `notificationTrayLimit`.
+        let api = StubAPIClient()
+        let items = (1...3).map { Fixtures.notificationObject(id: "n-\($0)") }
+        await api.enqueue(json: Fixtures.notificationTrayEnvelope(unreadCount: 3, items: items))
+        let service = NotificationsService(api: api)
+
+        let tray = try await service.tray(limit: nil)
+
+        XCTAssertEqual(tray.items.count, 3)
+        let recorded = await api.recorded
+        XCTAssertNil(recorded.first?.query["limit"])
+    }
+
+    func test_givenFewerRowsThanTheLimit_whenLoadingTray_thenReturnsThemAllUntouched() async throws {
+        // Boundary: the cap must never pad, and must be a no-op below the limit.
+        let api = StubAPIClient()
+        await api.enqueue(json: Fixtures.notificationTrayEnvelope(
+            unreadCount: 1,
+            items: [Fixtures.notificationObject(id: "n-1")]
+        ))
+        let service = NotificationsService(api: api)
+
+        let tray = try await service.tray(limit: 40)
+
+        XCTAssertEqual(tray.items.map(\.id), ["n-1"])
+    }
+
+    func test_givenTrayEndpointFails_whenLoadingTrayWithLimit_thenPropagatesTheError() async throws {
+        // Upstream failure: the cap must not swallow an error into an empty tray.
+        let api = StubAPIClient()
+        await api.enqueue(failure: .httpStatus(code: 503, serverMessage: "down"))
+        let service = NotificationsService(api: api)
+
+        do {
+            _ = try await service.tray(limit: 20)
+            XCTFail("Expected an APIError")
+        } catch let error as APIError {
+            XCTAssertEqual(error, .httpStatus(code: 503, serverMessage: "down"))
+        }
+    }
+
+    // MARK: - Single-field advanced-post-settings write (composer gear)
+
+    func test_givenGearToggle_whenPersisting_thenPatchesOnlyThatFieldAndReturnsServerTruth() async throws {
+        // Given — the server echoes the account with the preference now on.
+        let api = StubAPIClient()
+        await api.enqueue(json: """
+        {
+          "message": "User updated successfully",
+          "user": {
+            "id": "u1", "email": "ada@example.com", "username": "ada",
+            "emailVerified": true, "customerStatus": "subscriber",
+            "showAdvancedPostSettings": true, "messagesPerPage": 20,
+            "viewingPreference": "all_messages", "notificationTrayLimit": 20,
+            "createdAt": "2026-01-01T00:00:00.000Z"
+          }
+        }
+        """)
+        let service = UserService(api: api)
+
+        // When
+        let updated = try await service.setShowAdvancedPostSettings(true)
+
+        // Then — the caller gets the server's authoritative view…
+        XCTAssertTrue(updated.showAdvancedPostSettings)
+        // …and the request went to the verified PATCH route.
+        let recorded = await api.recorded
+        XCTAssertEqual(recorded.first?.method, "PATCH")
+        XCTAssertEqual(recorded.first?.path, "/api/user/update")
+    }
+
+    func test_givenSingleFieldWrite_whenBuildingTheBody_thenEveryOtherKeyIsOmitted() throws {
+        // Invalid-by-omission guard: `UpdateUserRequest` drops nil fields, so a
+        // one-field write can never clobber a page size or viewing preference
+        // set moments earlier in Settings.
+        let body = UpdateUserRequest(showAdvancedPostSettings: false)
+
+        let data = try JSONEncoder().encode(body)
+        let object = try XCTUnwrap(
+            JSONSerialization.jsonObject(with: data) as? [String: Any]
+        )
+
+        XCTAssertEqual(Array(object.keys), ["showAdvancedPostSettings"])
+        XCTAssertEqual(object["showAdvancedPostSettings"] as? Bool, false)
+    }
+
+    func test_givenUpdateFails_whenPersistingTheGear_thenThrows() async throws {
+        // Upstream failure: the composer relies on this throwing to roll its
+        // optimistic flip back.
+        let api = StubAPIClient()
+        await api.enqueue(failure: .httpStatus(code: 500, serverMessage: "boom"))
+        let service = UserService(api: api)
+
+        do {
+            _ = try await service.setShowAdvancedPostSettings(true)
+            XCTFail("Expected an APIError")
+        } catch let error as APIError {
+            XCTAssertEqual(error, .httpStatus(code: 500, serverMessage: "boom"))
+        }
+    }
+}
diff --git a/Packages/InterlinedDomain/Tests/InterlinedDomainTests/ViewingPreferenceTests.swift b/Packages/InterlinedDomain/Tests/InterlinedDomainTests/ViewingPreferenceTests.swift
new file mode 100644
index 0000000..2f85151
--- /dev/null
+++ b/Packages/InterlinedDomain/Tests/InterlinedDomainTests/ViewingPreferenceTests.swift
@@ -0,0 +1,94 @@
+import XCTest
+@testable import InterlinedDomain
+
+/// BDD-named coverage for `ViewingPreference` — the domain projection of
+/// `UserDTO.viewingPreference` (work-consolidation.md G35 / issue #43).
+///
+/// The wire vocabulary asserted here was read off the live web Settings form on
+/// 2026-09-09 (`<select id="viewingPreference">`), not guessed, so these cases
+/// double as a contract record: if the server ever renames a token, the
+/// round-trip test is what will notice.
+final class ViewingPreferenceTests: XCTestCase {
+
+    // MARK: - Happy path
+
+    func test_givenDocumentedTokens_whenDecoding_thenMapsToTypedCases() {
+        XCTAssertEqual(ViewingPreference(wireToken: "my_messages"), .myMessages)
+        XCTAssertEqual(ViewingPreference(wireToken: "all_messages"), .allMessages)
+        XCTAssertEqual(ViewingPreference(wireToken: "followers_only"), .followersOnly)
+        XCTAssertEqual(ViewingPreference(wireToken: "following_only"), .followingOnly)
+    }
+
+    func test_givenTypedCases_whenEncoding_thenProducesTheDocumentedTokens() {
+        XCTAssertEqual(ViewingPreference.myMessages.wireToken, "my_messages")
+        XCTAssertEqual(ViewingPreference.allMessages.wireToken, "all_messages")
+        XCTAssertEqual(ViewingPreference.followersOnly.wireToken, "followers_only")
+        XCTAssertEqual(ViewingPreference.followingOnly.wireToken, "following_only")
+    }
+
+    func test_givenEachSelectableValue_whenResolvingScope_thenPicksTheMatchingFeed() {
+        XCTAssertEqual(ViewingPreference.myMessages.defaultScope, .mine)
+        XCTAssertEqual(ViewingPreference.allMessages.defaultScope, .all)
+        XCTAssertEqual(ViewingPreference.followersOnly.defaultScope, .followers)
+        XCTAssertEqual(ViewingPreference.followingOnly.defaultScope, .following)
+    }
+
+    func test_givenSelectableList_whenOfferedToTheUser_thenMatchesTheWebFormsOptions() {
+        XCTAssertEqual(
+            ViewingPreference.selectable.map(\.wireToken),
+            ["my_messages", "all_messages", "followers_only", "following_only"]
+        )
+        XCTAssertEqual(
+            ViewingPreference.selectable.map(\.displayName),
+            ["My Messages", "All Messages", "Followers Only", "Following Only"]
+        )
+    }
+
+    // MARK: - Invalid input
+
+    func test_givenUnrecognisedToken_whenDecoding_thenPreservesItAndDefaultsToAll() {
+        let preference = ViewingPreference(wireToken: "mentions_only")
+
+        XCTAssertEqual(preference, .other("mentions_only"))
+        XCTAssertEqual(preference.defaultScope, .all, "An unknown filter must not blank the feed")
+        XCTAssertEqual(preference.wireToken, "mentions_only", "The token must survive a round-trip")
+        XCTAssertFalse(
+            ViewingPreference.selectable.contains(preference),
+            "An unknown token is never offered as a choice"
+        )
+    }
+
+    // MARK: - Upstream / backend availability
+
+    /// Re-verified live 2026-09-09: `GET /api/messages` honours only
+    /// `onlyMine`; every follower-filter parameter returns the full timeline.
+    /// So both follower feeds must report themselves unavailable, which is what
+    /// drives the timeline's "coming soon" state instead of a mislabelled feed.
+    func test_givenFollowerPreferences_whenCheckingBackendSupport_thenReportsUnavailable() {
+        XCTAssertFalse(ViewingPreference.followersOnly.hasBackendFeed)
+        XCTAssertFalse(ViewingPreference.followingOnly.hasBackendFeed)
+        XCTAssertFalse(TimelineScope.followers.hasBackendFeed)
+        XCTAssertFalse(TimelineScope.following.hasBackendFeed)
+
+        XCTAssertTrue(ViewingPreference.myMessages.hasBackendFeed)
+        XCTAssertTrue(ViewingPreference.allMessages.hasBackendFeed)
+        XCTAssertTrue(TimelineScope.all.hasBackendFeed)
+        XCTAssertTrue(TimelineScope.mine.hasBackendFeed)
+    }
+
+    // MARK: - Boundary
+
+    func test_givenBlankToken_whenDecoding_thenTreatsItAsUnrecognisedRatherThanCrashing() {
+        // Whitespace-only and empty tokens are boundary inputs the server has
+        // never sent but could; they must degrade to the safe `.all` scope.
+        XCTAssertEqual(ViewingPreference(wireToken: "").defaultScope, .all)
+        XCTAssertEqual(ViewingPreference(wireToken: "   ").defaultScope, .all)
+        XCTAssertEqual(ViewingPreference(wireToken: "   ").wireToken, "")
+    }
+
+    func test_givenPaddedToken_whenDecoding_thenTrimsBeforeMatching() {
+        // The trim exists so a stray newline in a payload doesn't demote a
+        // perfectly good preference to `.other`.
+        XCTAssertEqual(ViewingPreference(wireToken: " following_only\n"), .followingOnly)
+    }
+}
diff --git a/Packages/InterlinedKit/Sources/InterlinedKit/DTOs/UserDTO.swift b/Packages/InterlinedKit/Sources/InterlinedKit/DTOs/UserDTO.swift
index b8c2918..28c6c76 100644
--- a/Packages/InterlinedKit/Sources/InterlinedKit/DTOs/UserDTO.swift
+++ b/Packages/InterlinedKit/Sources/InterlinedKit/DTOs/UserDTO.swift
@@ -163,8 +163,18 @@ public struct UserDTO: Decodable, Sendable, Equatable {
 
 // MARK: - UpdateUserRequest
 
-/// Request body for `POST /api/user/update`. Every field is optional so a
+/// Request body for `PATCH /api/user/update`. Every field is optional so a
 /// caller patches only what changed; nil fields are omitted from the wire body.
+///
+/// VERIFIED live 2026-09-09 (work-consolidation.md G35 / issue #43): the web
+/// client's own "View Preferences" card PATCHes exactly
+/// `{ messagesPerPage, viewingPreference, showPreviews, notificationTrayLimit }`
+/// to this route, which settles two open questions — `notificationTrayLimit` is
+/// an accepted key here (it was previously read-only on `UserDTO`), and
+/// `viewingPreference` is a snake_case token, not a display string. The web
+/// validates `messagesPerPage` to 10...30 and `notificationTrayLimit` to
+/// 10...40 before sending; `UserSettings` clamps to the same ranges so a value
+/// saved from macOS is always representable on the web.
 public struct UpdateUserRequest: Encodable, Sendable, Equatable {
     public let displayName: String?
     public let bio: String?
@@ -175,6 +185,10 @@ public struct UpdateUserRequest: Encodable, Sendable, Equatable {
     public let showPreviews: Bool?
     public let showAdvancedPostSettings: Bool?
     public let isPrivateAccount: Bool?
+    /// How many rows the notification bell tray holds (10...40, default 20).
+    /// Accepted by this route — confirmed against the web client's own PATCH
+    /// body on 2026-09-09.
+    public let notificationTrayLimit: Int?
 
     public init(
         displayName: String? = nil,
@@ -185,7 +199,8 @@ public struct UpdateUserRequest: Encodable, Sendable, Equatable {
         viewingPreference: String? = nil,
         showPreviews: Bool? = nil,
         showAdvancedPostSettings: Bool? = nil,
-        isPrivateAccount: Bool? = nil
+        isPrivateAccount: Bool? = nil,
+        notificationTrayLimit: Int? = nil
     ) {
         self.displayName = displayName
         self.bio = bio
@@ -196,11 +211,13 @@ public struct UpdateUserRequest: Encodable, Sendable, Equatable {
         self.showPreviews = showPreviews
         self.showAdvancedPostSettings = showAdvancedPostSettings
         self.isPrivateAccount = isPrivateAccount
+        self.notificationTrayLimit = notificationTrayLimit
     }
 
     private enum CodingKeys: String, CodingKey {
         case displayName, bio, theme, defaultPubliclyVisible, messagesPerPage
         case viewingPreference, showPreviews, showAdvancedPostSettings, isPrivateAccount
+        case notificationTrayLimit
     }
 
     public func encode(to encoder: Encoder) throws {
@@ -214,6 +231,7 @@ public struct UpdateUserRequest: Encodable, Sendable, Equatable {
         try container.encodeIfPresent(showPreviews, forKey: .showPreviews)
         try container.encodeIfPresent(showAdvancedPostSettings, forKey: .showAdvancedPostSettings)
         try container.encodeIfPresent(isPrivateAccount, forKey: .isPrivateAccount)
+        try container.encodeIfPresent(notificationTrayLimit, forKey: .notificationTrayLimit)
     }
 }
 
diff --git a/Packages/InterlinedKit/Sources/InterlinedKit/Endpoints/NotificationsEndpoint.swift b/Packages/InterlinedKit/Sources/InterlinedKit/Endpoints/NotificationsEndpoint.swift
index 006170c..1aab7e7 100644
--- a/Packages/InterlinedKit/Sources/InterlinedKit/Endpoints/NotificationsEndpoint.swift
+++ b/Packages/InterlinedKit/Sources/InterlinedKit/Endpoints/NotificationsEndpoint.swift
@@ -18,11 +18,23 @@ import Foundation
 public enum Notifications {
 
     /// `GET /api/notifications` (with `scope=tray`).
-    public static func tray(scope: String = "tray") -> Request<NotificationTrayDTO> {
+    ///
+    /// `limit` is optional and omitted by default. VERIFIED live 2026-09-09
+    /// (G35 / issue #43): the route honours `limit` in its *unscoped* form
+    /// (`?limit=5` → 5 rows, `?limit=40` → 36 rows on the test account) and
+    /// falls back to the account's `notificationTrayLimit` when absent
+    /// (no params → exactly 20 rows, matching the stored preference). Under
+    /// `scope=tray` the server currently ignores `limit` and returns unread
+    /// rows only, so the preference is *also* enforced client-side by
+    /// `NotificationsService.tray(limit:)` — see the note there.
+    public static func tray(scope: String = "tray", limit: Int? = nil) -> Request<NotificationTrayDTO> {
         Request(
             method: .get,
             path: "/api/notifications",
-            query: [.string("scope", scope)],
+            query: [
+                .string("scope", scope),
+                .int("limit", limit)
+            ],
             auth: .bearer
         )
     }
diff --git a/Packages/InterlinedKit/Tests/InterlinedKitTests/NotificationsEndpointTests.swift b/Packages/InterlinedKit/Tests/InterlinedKitTests/NotificationsEndpointTests.swift
index 71f1703..a0c395e 100644
--- a/Packages/InterlinedKit/Tests/InterlinedKitTests/NotificationsEndpointTests.swift
+++ b/Packages/InterlinedKit/Tests/InterlinedKitTests/NotificationsEndpointTests.swift
@@ -34,6 +34,24 @@ final class NotificationsEndpointTests: XCTestCase {
         XCTAssertEqual(Notifications.markAllRead().path, "/api/notifications/mark-all-read")
     }
 
+    // MARK: - Tray limit (G35 / issue #43)
+
+    func test_givenTrayLimit_whenTrayBuilt_thenSendsItAlongsideScope() {
+        // Happy path: the account's `notificationTrayLimit` reaches the wire.
+        let request = Notifications.tray(limit: 25)
+
+        XCTAssertEqual(request.query.first(where: { $0.name == "scope" })?.value, "tray")
+        XCTAssertEqual(request.query.first(where: { $0.name == "limit" })?.value, "25")
+    }
+
+    func test_givenNoTrayLimit_whenTrayBuilt_thenOmitsTheParameter() {
+        // Boundary: `nil` must leave the page size to the server rather than
+        // sending `limit=` and risking a zero-row tray.
+        let request = Notifications.tray()
+
+        XCTAssertNil(request.query.first(where: { $0.name == "limit" })?.value)
+    }
+
     // MARK: - Happy path
 
     func test_givenTrayBody_whenTraySent_thenDecodesUnreadCountAndItems() async throws {
diff --git a/Packages/InterlinedKit/Tests/InterlinedKitTests/UserEndpointTests.swift b/Packages/InterlinedKit/Tests/InterlinedKitTests/UserEndpointTests.swift
index 9e5d701..8e72888 100644
--- a/Packages/InterlinedKit/Tests/InterlinedKitTests/UserEndpointTests.swift
+++ b/Packages/InterlinedKit/Tests/InterlinedKitTests/UserEndpointTests.swift
@@ -194,6 +194,44 @@ final class UserEndpointTests: XCTestCase {
         XCTAssertTrue(body.isEmpty)
     }
 
+    // MARK: - View Preferences body (G35 / issue #43)
+
+    func test_givenViewPreferences_whenUpdateBuilt_thenEncodesTheWebsFourKeys() throws {
+        // Happy path: the exact body the web's own "View Preferences" card
+        // PATCHes, verified against the live bundle 2026-09-09.
+        let request = User.update(UpdateUserRequest(
+            messagesPerPage: 15,
+            viewingPreference: "followers_only",
+            showPreviews: false,
+            notificationTrayLimit: 35
+        ))
+
+        let body = try encodedBody(request)
+        XCTAssertEqual(body["messagesPerPage"] as? Int, 15)
+        XCTAssertEqual(body["viewingPreference"] as? String, "followers_only")
+        XCTAssertEqual(body["showPreviews"] as? Bool, false)
+        XCTAssertEqual(body["notificationTrayLimit"] as? Int, 35)
+    }
+
+    func test_givenNoTrayLimit_whenUpdateBuilt_thenOmitsItSoItIsNeverClobbered() throws {
+        // Invalid-by-omission guard: patching an unrelated field must not send
+        // `notificationTrayLimit: null` and wipe the account's stored value.
+        let request = User.update(UpdateUserRequest(displayName: "Ada"))
+
+        let body = try encodedBody(request)
+        XCTAssertNil(body["notificationTrayLimit"])
+        XCTAssertNil(body["viewingPreference"])
+    }
+
+    func test_givenBoundaryTrayLimits_whenUpdateBuilt_thenEncodesThemVerbatim() throws {
+        // Boundary: the request body is a faithful mirror — range enforcement
+        // is the domain layer's job (`UserSettings` clamps), not the DTO's.
+        for limit in [10, 40] {
+            let body = try encodedBody(User.update(UpdateUserRequest(notificationTrayLimit: limit)))
+            XCTAssertEqual(body["notificationTrayLimit"] as? Int, limit)
+        }
+    }
+
     func test_givenValidPatch_whenUpdateSent_thenReturnsUpdatedUser() async throws {
         let (client, transport, _) = makeClient()
         await transport.enqueue(.json(userEnvelopeJSON))
diff --git a/Packages/InterlinedPersistence/Sources/InterlinedPersistence/Mapping/MessageRecordMapping.swift b/Packages/InterlinedPersistence/Sources/InterlinedPersistence/Mapping/MessageRecordMapping.swift
index 8a079b1..2829be6 100644
--- a/Packages/InterlinedPersistence/Sources/InterlinedPersistence/Mapping/MessageRecordMapping.swift
+++ b/Packages/InterlinedPersistence/Sources/InterlinedPersistence/Mapping/MessageRecordMapping.swift
@@ -101,9 +101,11 @@ extension TimelineScope {
         switch self {
         case .all:       return "all"
         case .mine:      return "mine"
-        // Following has no API backing yet; a stable key is still needed so
-        // any future cache entries survive enum expansion without corruption.
+        // Neither follower scope has API backing yet; stable keys are still
+        // needed so any future cache entries survive enum expansion without
+        // corruption.
         case .following: return "following"
+        case .followers: return "followers"
         }
     }
 }