Function restriction 

pub fn restriction(
    f: &Core,
    defs: &BTreeMap<Arc<str>, Def>,
    captured: &BTreeSet<VarId>,
) -> Result<Membership, Refusal>

Try to read a filter’s predicate as a membership test against another collection.

filter_list(xs, lambda x: map_contains(m, k(x))) is the intersection of xs with m’s keys and its negation is the difference — crate::plan::Op::Restrict, and docs/99 §99.9 item 7. The two conditions are recognise’s, for recognise’s reasons: m may read only what the function captured, so the collection is a node the plan can index once, and k may read only the element, so the probe is a function of the row alone.

What it does not share with recognise is the search. A join is recognised at a site inside a body, because a loop does other things as well as look up; a filter’s predicate is the whole of what the operator computes, so a predicate that is a membership test and something else is not this shape at all. Splitting p(x) and map_contains(m, k(x)) into two operators is a rewrite the fuser owns rather than a recognition, and it is named as absent in §99.10 rather than attempted here.