Function require_valid_versao 

pub fn require_valid_versao<E>(caixa: &Caixa) -> Result<&str, E>
where
    E: From<ManifestError>,

Compound per-Caixa :versao-slot entry gate: routes a &Caixa’s top-level manifest-version scalar through the canonical crate::manifest::Caixa::validate_versao two-arm cascade (empty-first → crate::ManifestError::VersaoEmpty, SemVer-2-shape-invalid → [crate::ManifestError::VersaoInvalid { versao, reason }]) and hands back the validated &str on success, so a downstream renderer that consumes the manifest’s :versao operationally can read the compound “gate + borrow” step as one call site rather than a hand-spelled caixa.validate_versao()?; let v = caixa.versao(); two-step.

The single existing production call site collapses onto this helper — [caixa_tatara::process_for_aplicacao]’s per-Aplicacao :versao presence gate (pre-lift: an inline if caixa.versao().is_empty() { return Err(Error::MissingVersao); } checked only the empty arm; the SemVer-2-shape-invalid arm was a runtime, not build-time, contract on every author who bypassed crate::manifest::Caixa::validate_versao at the feira build gate — a struct-literal Caixa { versao: "0.1".into(), .. } through the public field, a fixture that mutates caixa.versao after crate::manifest::Caixa::from_lisp, the deferred AplicacaoIntent::version carrier the tatara reconciler hands to Helm’s SemVer-2-strict Chart.yaml::version field — silently landed a semver-malformed byte-string at the emit boundary and surfaced far from the source caixa.lisp as a Helm chart-install rejection with no field naming the offending :versao).

The compound-gate posture matches the peer per-Servico require_v0_servico_shape compound entry gate and the peer per-Aplicacao require_aplicacao_view / per-Acao require_acao_view compound entry gates: each collapses a hand-spelled prelude (typed kind gate → typed-slot presence gate → typed-view validation) onto one substrate helper the caller reads as intent. Every future per-Caixa renderer that consumes :versao operationally (a sui-supercacheci::canteiro::emit_gha per-Acao workflow renderer stamping the run with the caixa’s version, the deferred per-Caixa CR materializer’s admission webhook, a future feira publish verb that materializes a v<versao> git tag from the typed slot) gets the two-arm cascade paired with the validated-:versao return contract for free with one call, instead of re-inlining a subset of the substrate’s own gate cascade.

The generic error type E accepts every renderer’s local thiserror Error enum that carries crate::ManifestError via #[from] (caixa_tatara::Error, and every future per-Caixa renderer that wires the #[from] arm as the substrate-canonical versao-view carrier). Type inference at the call site resolves E from the caller’s ? return type, matching the sibling require_v0_servico_shape / require_aplicacao_view / require_acao_view convention.

Errors

Returns the caller’s E wrapping a crate::ManifestError when crate::manifest::Caixa::validate_versao rejects the caixa’s :versao — crate::ManifestError::VersaoEmpty on the empty arm, [crate::ManifestError::VersaoInvalid { versao, reason }] on the SemVer-2-shape-invalid arm. Order matches the underlying crate::manifest::Caixa::validate_versao cascade: the empty arm fires first so a literal "" surfaces the narrower self-locating diagnostic rather than the misleading SemVer-parser output for the empty string.