Module gate 

The refusals. One place decides when a shaping request cannot be honoured.

Until v1.2.6 every impossible request was answered with an empty set and exit 0, which a caller cannot tell from “the data is not there”. Four measured shapes produced that:

• GAP-SG-202 — a projection or predicate key that exists in no element.
• GAP-SG-203 — a predicate aimed at an envelope member, redirected onto an array the caller never named and deleting it whole.
• GAP-SG-204 — a knob declared against an envelope with no result array at all, so it could not possibly act.
• GAP-SG-201 — a predicate judging only the page the query returned.

Why refusals live here and not in the shaping primitives

super::shape is stateless and knows nothing about commands, ceilings or intent; keeping the verdict out of it is what lets one implementation serve every subcommand. This module is the only one allowed to fail.

The fence

super::apply runs at OUTPUT time, after the handler already did its work. Refusing there for a command that changed durable state would report failure for an operation that succeeded, and a caller that retries a succeeded remember writes the memory twice. So a surface marked super::AgentSurface::mutates is never refused — it is annotated instead. That is a deliberate asymmetry: a diagnostic lost is cheaper than data duplicated.

Structs

Findings

What resolution learned, for the agent_surface record.

Functions

evaluate

Decides whether surface may be applied to the envelope described by scope.

evaluate_stream

GAP-SG-215: the same verdict, for a payload that is a STREAM of records.