Constant GATEWAY_API_KEY_HOSTNAME 

pub const GATEWAY_API_KEY_HOSTNAME: &str = "hostname";

Canonical K8s Gateway API Gateway per-listener DNS-host-discriminator axis key every gateway_routes-emitted Gateway document mounts each listener’s virtual-host name under (spec.listeners[].hostname). Pairs with the sibling GATEWAY_API_KEY_LISTENERS (29f2415) — the Gateway API v1 CRD schema pins the per-Gateway L7-listener-set fan-out through the spec.listeners[] container axis (each entry names one listener the Gateway accepts external traffic on) and pins each entry’s per-listener DNS-host discriminator under the nested hostname axis (Gateway API v1 Listener.hostname — PreciseHostname string, optional per-listener virtual-host filter the Gateway-API-implementation-side per-Gateway reconcile loop honors when routing external inbound traffic against SNI at the TLS handshake / Host: header at the HTTP request line), so drift on the per-listener DNS-host discriminator axis is exactly as load-bearing as drift on the per-Gateway L7-listener-set container axis it nests under (the K8s apiserver-side Gateway API CRD schema validator drops any per-listener entry whose DNS-host discriminator axis carries an unrecognized key — a "host" / "vhost" / "serverName" typo silently emits a Gateway whose per-listener virtual-host filter the Gateway API implementation’s per-listener SNI / Host: header dispatch loop no-ops entirely: the listener accepts traffic on the wildcard host rather than the typed :entrada :host the Aplicacao author declared, and every external :entrada flow the listener was authored to accept lands on the wrong virtual-host filter with no field naming the DNS-host-discriminator-axis-drift root cause).

The single source of truth the rendered Aplicacao Gateway-API-side ingress bundle’s per-Gateway per-listener DNS-host-discriminator-axis- naming reaches for:

• the rendered Gateway document’s spec.listeners[].hostname axis (caixa-mesh/src/lib.rs — the gateway_routes per-Aplicacao Gateway’s per-listener listener.insert("hostname", …) call seeded from the Aplicacao’s :entrada :host slot).

The per-listener DNS-host discriminator axis names the same Gateway- API-implementation-side per-listener virtual-host filter container as the sibling GATEWAY_API_KEY_LISTENERS per-Gateway L7-listener-set container axis it nests under, and must move together on any future Gateway API rebrand (an upstream SIG-Network Gateway API v2 rename of the per-listener DNS-host discriminator axis from hostname to host / vhost / serverName, coordinated with the Gateway API deprecation cycle). Until this lift landed the axis carried an inline hostname literal at the one production-code occurrence in caixa-mesh/src/lib.rs (the gateway_routes per-Aplicacao Gateway’s per-listener listener.insert("hostname", …) call) plus a matching test-fixture navigation inside the in-file gateway_listener_carries_aplicacao_host pin’s .get("hostname") traversal — two occurrences of the same load- bearing Gateway-API-CRD-hostname-axis-key convention, drift-prone by construction. A drift on the production site to "host" / "vhost" / "serverName" would have surfaced as a Gateway API implementation- side schema validator drop at apply time (the affected listener’s per- listener DNS-host discriminator axis the CRD schema validator recognizes as unknown), with every external :entrada flow landing on the wildcard virtual-host filter rather than the typed :entrada :host at the gateway-class-controller’s per-listener dispatch with no field naming the DNS-host-discriminator-drift root cause. A drift on the test-fixture side silently masks the emission-side pin (.get("hostname") returns None under both the drifted-key emitter and the drifted-key probe — the downstream .and_then(|h| h.as_str()) chain short-circuits vacuously because the outer per-listener DNS- host discriminator lookup is itself None).

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_BACKEND_REFS (a6c5679) / CILIUM_KEY_PORTS (1087693) / CILIUM_KEY_FROM_ENDPOINTS (ecfa557) / CILIUM_KEY_INGRESS (0400a9b) / CILIUM_KEY_ENDPOINT_SELECTOR (7088789) / CILIUM_KEY_TO_PORTS (c8d9cbf) / KUBE_KEY_RULES (a205eb3) lifts established on the sibling canonical-Gateway-API-CRD-body-axis / canonical-Cilium-CNP-body-axis surfaces — nests the per-Gateway-API- CRD-body-axis lift discipline one level deeper onto the sibling per- listener body-axis surface, extending the per-Gateway-API-CRD-body- axis canonical-string-pin set (parentRefs, backendRefs, listeners, hostname, future hostnames) the M3 Aplicacao mesh renderer’s external :entrada ingress contract rests on across the Gateway API CRD-side body-shape. The render-side consumer now threads the same &'static str through its per-listener listener.insert(…) call so a future Gateway API rebrand on the per-listener DNS-host discriminator axis (or an upstream SIG-Network Gateway API v2 rename to a per-CRD sibling name) lands in one place; every future renderer that reaches for the canonical per-listener DNS-host discriminator axis (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao Gateway fan-out, a future per-listener TLS terminator renderer whose per-listener tls.certificateRefs[] resolution keys off the same per-listener virtual-host filter, a future per-cluster wildcard-host Gateway renderer whose per-listener SNI wildcard *.example.com matcher binds against this same axis) inherits the same value by construction with no opportunity for per- renderer drift.

Same “the typed constant lives in one place” discipline the GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_BACKEND_REFS (a6c5679) / CILIUM_KEY_PORTS (1087693) / CILIUM_KEY_FROM_ENDPOINTS (ecfa557) / CILIUM_KEY_INGRESS (0400a9b) / CILIUM_KEY_ENDPOINT_SELECTOR (7088789) / CILIUM_KEY_TO_PORTS (c8d9cbf) / KUBE_KEY_RULES (a205eb3) lifts apply on the peer canonical- Gateway-API-Gateway-per-listener-body-axis surface.