Function mapping_string_keys 

pub fn mapping_string_keys(mapping: &Mapping) -> Vec<String>

Collect the string-shaped keys of a serde_yaml::Mapping as owned Strings — the canonical shape the assert-side diagnostic blocks routed across caixa-mesh’s per-Placement / caixa-helm’s per-Chart.yaml / per-ChartDependency / per-values.yaml serde-derive drift-detection pins previously reached for as the three-line composition

keys = <mapping>
    .keys()
    .filter_map(|k| k.as_str().map(str::to_string))
    .collect::<Vec<_>>()

around a one-token semantic payload (the receiver <mapping> bracket the assert’s failure-message wants a full string-keyed enumeration off — the [serde_yaml::Value::to_value(&Placement) .as_mapping()] bracket the four caixa-mesh per-Placement pins compare M3_PLACEMENT_KEY_ESTRATEGIA / M3_PLACEMENT_KEY_CLUSTERS / M3_PLACEMENT_KEY_AFFINITY / M3_PLACEMENT_KEY_SHARD_KEY contains_key presence against, the [caixa-helm] cluster-bundle values.yaml parsed serde_yaml::Value::as_mapping() bracket the HELM_VALUES_KEY_ENABLED / COMPUTEUNIT_SPEC_KEY_MODULE|TRIGGER|CAPABILITIES presence pins enumerate on failure, the [caixa-helm] per-ChartDependency serde-derive round-trip mapping the HELM_CHART_DEPENDENCY_KEY_NAME|VERSION|REPOSITORY|ALIAS tetrad probe against, the [caixa-helm] per-Chart.yaml top-level dependency-list-container HELM_CHART_KEY_DEPENDENCIES contains-key pin). The three-line composition folds three stacked axes (.keys() bare iterator, per-key .and_then(|k| k.as_str()) shape gate, per-borrowed-&str .map(str::to_string) ownership promotion, terminal .collect::<Vec<_>>() type-witness) around one semantic concern: “give me every string-shape key of this mapping as owned Strings so the assert’s diagnostic can quote them back”. After this lift every routed consumer folds the three stacked axes onto mapping_string_keys(<mapping>) — one method name naming the intent, one call site reachable through the same substrate primitive by every future routed drift-detection assert.

Owned Vec<String> on purpose — the assert-side consumers interpolate the result through {keys:?} inside a format!-like macro invocation whose lifetime must outlive both the outer mapping borrow (which typically ends at the end of the same assert! expression) and the substrate primitive itself. A borrowed-Vec<&str> peer that mirrors the sibling string_keyed_entries iterator’s borrow contract (a peer the 5-site metadata.iter().filter_map(|(k, _)| k.as_str()).collect ::<Vec<&str>>() shape carries — the caixa-core skeleton-shape alphabetical-order pins on the emit-side render-determinism contract THEORY.md §V.2.7 pins) would land on a separate lift, one altitude down on the ownership-arity axis, if the routed caller surface ever grows dense enough on that receiver-arm to justify it — the same-arity carveout the sibling kube_map docs already name for the serde_yaml::Mapping-receiver overload axis.

Non-string-shape keys (serde_yaml::Value::Number / serde_yaml::Value::Bool / serde_yaml::Value::Mapping / serde_yaml::Value::Sequence / serde_yaml::Value::Null / serde_yaml::Value::Tagged arms serde_yaml admits at the [serde_yaml::Value::key] axis position) are silently dropped — the same behavior the seven routed inline sites carried via the per-key .and_then(|k| k.as_str()) shape-gate short-circuit, and mirroring the sibling string_keyed_entries iterator’s drop-not-panic contract on the same axis. The dropped keys never reach the downstream K8s YAML-key surface (which requires string keys) anyway, so their absence from the diagnostic mirrors the runtime shape the assert protects.

Peer to string_keyed_entries on the sibling read-side sub-mapping introspection axis: string_keyed_entries yields a borrowed (&str, &Value) iterator for the two production per-Servico spec.*-splice consumers routed at emit time (the [caixa_flux::programs_yaml_entry] / [caixa_helm::build_values_yaml] pair), while mapping_string_keys closes the owned-Vec<String> key-only arity for the seven test-side drift-detection asserts routed at diagnostic time. Together the two partition the sub- mapping-key enumeration axis at both arities — the per-entry (key, value) production splice via the sibling iterator, the key-only owned-scalar diagnostic via this accessor.

Every future serde-derive drift-detection assert the M3.x + M4 renderer set materializes (per-:politicas CiliumClusterwideEnvoyConfig per-policy sub-block presence pins, per-app-operator mesh.pleme.io/v1alpha1/Aplicacao CR schema pins, per-caixa-otel OpenTelemetry-Collector service.pipelines .traces.receivers[] per-grpc / http sub-block presence pins, every future per-K8s-CR schema-key drift-detection assert the M3.x + M4 renderer set adds) reaches this one helper by construction. No per-consumer three-line collect re-inline; no per-consumer .and_then(|k| k.as_str()) shape-gate drift; no coordinated rewrite across every diagnostic sub-mapping key enumeration on a future serde_yaml surface rebrand of the key-shape axis (a versioned serde_yaml::Value::Tagged arm at the key position for Server-Side-Apply per-field ownership annotations, a shift in the serde_yaml::Mapping::keys iterator borrow contract).