Counting is a trust boundary. If the implementation cannot identify the model, encode the selected format, or prove its count quality, it returns an error instead of manufacturing a number.

Boundaries

The estimator rejects a nil receiver, nil context, canceled context, invalid model key, unsupported API format, and encoder failure. ContextCounterFunc rejects missing callbacks, invalid quality, model mismatch, and capability quality mismatch. Capability validation rejects unknown transport, retention, quality, or tokenizer revision.

Behavior

Do not replace a failed preflight count with a message-length guess. Surface the typed error to the admission policy. A caller that intentionally allows a heuristic must construct and validate a counter whose capability says so; that choice is explicit and auditable.

count, err := counter.CountContext(ctx, req)
if err != nil {
	// No invocation is authorized from this path.
	return err
}
if count.Quality == contextcount.CountQualityUnknown {
	return errors.New("counter returned unknown quality")
}

Source and proof

Run go test ./contextcount.