I agree that there should be some type of max-limit, so that a bad client can't set a limit=1000000 and crash the system. In that case, I think your options are either to send 400 Bad Request that limit is out of range, or 200 and correct the request by reducing the actual limit to max-limit. If we had a proper input validation system for REST, then it might make sense to have some type of filter through the 400 for us.
I had intended for /items/ to be page-able, it might not have too much meaning if you don't have any type of search powers to order or filter the results, but we can still allow for iteration. I think we want /items list, /collections/:id/ item-list, and /communities/:id/ item-list, as well as search at each place.
I do like having a response-metadata, but I didn't want to conflict with item-metadata (dc.title, ...), or potentially metadata-for-all, so if you've got an idea on how-not to clash go for it. I chatted with my local metadata librarian, and she said descriptive-metadata is probably where dc.title goes, structural-metadata is the relationship of the objects to each other and their order (this is usually METS, so I'm not interested in pursuing that). In our case, I think request-metadata would be the best I can come up with, for the thing that tells you the: offset, limit, totalItems, order, search, ...
I don't want to be a bottleneck, so you can feel free to work on your own branch against DSpace/DSpace:master. We can all PR each other, and then send another PR upstream to DSpace/DSpace.
Yeah, my master is a bit-out-of-date, but GitHub doesn't seem to have a problem taking PR's from new branches.
I wonder if we would want to make a feature branch on DSpace/DSpace called feature-rest-search or something