Constant GATEWAY_API_KEY_MATCHES 

pub const GATEWAY_API_KEY_MATCHES: &str = "matches";

Canonical K8s Gateway API HTTPRoute per-rule route-match container-axis key every gateway_routes-emitted HTTPRoute per-rule block mounts its per-rule [{path: {type, value}}] route-match fan-out list under (spec.rules[].matches[]). Pairs with the sibling GATEWAY_API_KEY_BACKEND_REFS (a6c5679) — the Gateway API v1 CRD schema pins per-rule request-selection through the spec.rules[].matches[] container axis (each entry names one HTTPRouteMatch predicate the request line + headers + query must satisfy for the rule’s backend fan-out to apply) alongside the per-rule route→Servico backend fan-out under spec.rules[].backendRefs[], so drift on the per-rule route-match axis is exactly as load-bearing as drift on the sibling per-rule backend-destination axis it accompanies (the K8s apiserver-side Gateway API CRD schema validator drops any per-rule block whose route-match container axis carries an unrecognized key — a "match" / "routeMatches" / "predicates" typo silently emits an HTTPRoute whose per-rule request-selection axis the Gateway API implementation’s per-rule L7 dispatch loop no-ops entirely: no request predicate is evaluated, the rule matches every request unconditionally at the wildcard predicate, and every external :entrada path filter the rule was authored to enforce drops at the gateway-class-controller’s per-rule reconcile with no field naming the route-match-axis-drift root cause).

The single source of truth the rendered Aplicacao Gateway-API-side ingress bundle’s per-HTTPRoute per-rule route-match-axis-naming reaches for:

• the rendered HTTPRoute document’s per-rule spec.rules[].matches[] axis (caixa-mesh/src/lib.rs — the gateway_routes per-Aplicacao HTTPRoute’s per-rule rule.insert("matches", …) call seeded from the Aplicacao’s :entrada :paths slot).

The per-rule route-match container axis names the same Gateway- API-implementation-side per-rule request-selection predicate fan- out container as the sibling GATEWAY_API_KEY_BACKEND_REFS per-rule backend-destination container axis it accompanies, and must move together on any future Gateway API rebrand (an upstream SIG-Network Gateway API v2 rename of the route-match axis from matches to match / routeMatches / predicates, coordinated with the Gateway API deprecation cycle). Until this lift landed the axis carried an inline matches literal at the one production-code occurrence in caixa-mesh/src/lib.rs (the gateway_routes per-rule rule.insert("matches", …) call) plus a matching test-fixture navigation inside the in-file httproute_rule_keys_pin_overlay_position pin’s contains_key("matches") presence assertion — two occurrences of the same load-bearing Gateway-API-CRD-matches-axis-key convention, drift-prone by construction. A drift on the production site to "match" / "routeMatches" / "predicates" would have surfaced as a Gateway API implementation-side schema validator drop at apply time (the affected per-rule route-match axis the CRD schema validator recognizes as unknown), with the per-rule request predicate degrading to the wildcard match at the gateway-class-controller’s per-rule reconcile with no field naming the route-match-drift root cause. A drift on the test- fixture side silently masks the emission-side pin (contains_key("matches") returns false under both the drifted-key emitter and the drifted-key probe).

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the GATEWAY_API_KEY_BACKEND_REFS (a6c5679) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_HOSTNAMES (b77f744) / GATEWAY_API_KEY_HOSTNAME (c96fa22) / GATEWAY_API_KEY_TIMEOUTS (db31108) / GATEWAY_API_KEY_RETRY (231bbf5) lifts established on the sibling canonical-Gateway-API-HTTPRoute-body-axis surface — completes the per-rule top-level-axis lifted-string set (matches, backendRefs, timeouts, retry) the httproute_rule_keys_pin_overlay_position pin binds against, so every one of the four per-rule top-level axes now threads a lifted &'static str apiece. The render-side consumer now threads the same &'static str through its rule.insert(…) call so a future Gateway API rebrand on the per-rule route-match axis (or an upstream SIG-Network Gateway API v2 rename to a per-CRD sibling name) lands in one place; every future renderer that reaches for the canonical per-HTTPRoute per-rule route-match axis (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao HTTPRoute fan-out, a future per-edge GRPCRoute renderer whose per-rule request-match predicate nests under the same axis convention, a future per-route header-match / query-match renderer whose per-predicate list binds against this same axis) inherits the same value by construction with no opportunity for per-renderer drift.

Same “the typed constant lives in one place” discipline the GATEWAY_API_KEY_BACKEND_REFS (a6c5679) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_HOSTNAMES (b77f744) / GATEWAY_API_KEY_HOSTNAME (c96fa22) / GATEWAY_API_KEY_TIMEOUTS (db31108) / GATEWAY_API_KEY_RETRY (231bbf5) lifts apply on the peer canonical-Gateway-API-HTTPRoute-per-rule-body-axis surface.