1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
//! GAP-SG-201: what the QUERY already discarded, declared so the output surface
//! can stop describing a set it never saw.
//!
//! `--filter type=skill list` answers 39 over 1892 memories. The same request
//! with `--limit 50` answered `0`, with `exit 0`, because the predicate was
//! handed the fifty rows SQL returned rather than the corpus the caller asked
//! about. Both numbers are produced by the same code; only one of them is an
//! answer to the question.
//!
//! The surface cannot see this on its own. It receives a serialized envelope,
//! downstream of `LIMIT`, and an array of fifty is indistinguishable from a
//! corpus of fifty. So the command that applied the ceiling declares it here,
//! and the surface reads the declaration.
//!
//! # Why a process-wide cell rather than a field on every response
//!
//! This binary is one-shot: one process runs one subcommand and emits one
//! envelope. A cell is therefore not ambient state that could belong to someone
//! else — it is the single fact about the single query this process ran. The
//! same reasoning already governs [`super::AgentSurface`]. Threading a new field
//! through six response structs would also change six published schemas to carry
//! a fact none of them is about.
//!
//! # Pagination is not top-k
//!
//! [`CeilingKind`] is the distinction the refusal turns on, and it is not
//! cosmetic. `list --limit 50` pages a countable universe: 50 of 1892 is a
//! recorte, and a predicate over it answers the wrong question. `hybrid-search
//! -k 5` does not page anything — the five best matches ARE the result set the
//! caller asked for, and filtering them is a legitimate operation on a complete
//! answer. Refusing there would break every semantic search that carries a
//! filter while curing nothing.
use ;
use OnceLock;
/// What the caller declares `--filter` may observe.
///
/// Absent, the surface refuses a predicate over a truncated page rather than
/// answering about a set it never saw. Present, the caller has said which
/// reading it meant, and the surface obeys.
/// What kind of ceiling the query applied.
/// Where the ceiling's value came from.
/// The ceiling one query applied, as the command that applied it saw it.
static CEILING: = new;
/// Declares the ceiling this process's query applied. First call wins.
///
/// Called by the command at the point it resolves the effective limit, which is
/// also where it knows the source and, for a paginated command, the total.
/// The declared ceiling, or `None` when the command declared none.
/// Wire spelling for a count that the OUTPUT ceiling reduced.
const COUNT_SCOPE_EMITTED: &str = "emitted";
/// Wire spelling for a count of every element that satisfied the predicates.
const COUNT_SCOPE_MATCHED: &str = "matched";
/// Wire spelling for a count taken over a page the QUERY had already cut.
const COUNT_SCOPE_PAGE: &str = "page";
/// Names which of three sets `--count-only` actually counted.
///
/// GAP-SG-201. The field existed and reported two of the three readings: it
/// compared the emitted count against the matched one, which detects
/// `--max-items` and is structurally blind to the SQL `LIMIT` upstream of it.
/// Both numbers are measured AFTER the query returned its page, so fifty rows
/// out of 107 111 answered `matched` — the strongest of the three labels — on a
/// command line that named no limit.
///
/// The query ceiling therefore wins the precedence. It is upstream of
/// `--max-items`, so when it cut rows the count describes a page no matter what
/// the output ceiling did afterwards; reporting `emitted` there would name the
/// smaller omission and hide the larger one.
///
/// This still matters after [`super::gate`] refuses a count over a page, because
/// that refusal has an escape: a caller who declares `--filter-scope page` is let
/// through, and until now was let through to a label that said `matched`. The
/// refusal governs the default path; this governs the accepted one.
///
/// It lives HERE rather than beside the shaping because it is a statement about
/// the ceiling, not about the reshaping — the same reason [`insert_query_ceiling`]
/// is its neighbour.
pub
/// The label used when an envelope carries no result array to count.
///
/// Such an envelope is one thing, and no ceiling can make it fewer, so the count
/// always describes what matched.
pub const COUNT_SCOPE_SCALAR: &str = COUNT_SCOPE_MATCHED;
/// Writes what the QUERY had already removed, when the command declared it.
///
/// GAP-SG-201: reported whatever the verdict, because a top-k is never refused
/// and this is how its narrowness stops being invisible.
///
/// Shared by the shaping path and the inert one for the same reason the target
/// is: both are facts about the PROCESS, not about the reshaping. Until v1.2.7
/// this lived inside `base_meta` alone, so `deep-research "x"` with no knob
/// reported its resolved target and stayed silent about having cut the ranking
/// to five — the exact asymmetry the inert path was created to remove.
pub