Constant COINS_BY_PARENT_MAX_LIMIT 

pub const COINS_BY_PARENT_MAX_LIMIT: u32 = 1_000;

The largest page control.wallet.coinsByParent will accept, derived from the transport’s own frame limit rather than chosen for feel.

dig-ipc-protocol caps a control frame at MAX_FRAME_BYTES = 1 MiB (its SPEC.md § bounds), and that is the hard ceiling every answer on this plane has to fit inside. A WalletCoinRecord is at most ~350 bytes of JSON — three 64-hex hashes at 66 bytes quoted, a 20-digit u64, two 10-digit heights, and their keys — so the arithmetic that fixes this number is:

1 MiB / 350 B  ~=  2,996 records is where a page STOPS FITTING
1,000 records  ~=  350 KB, roughly a third of the frame

The cap is set at a third of what fits, not at what fits, so the envelope, the freshness fields and any future additive member cannot push a legal page over the transport’s limit. A larger value would put the contract’s own maximum inside the region where a conforming node’s honest answer is undeliverable — the failure would surface as a truncated frame, not as a refusal.