Enum UpgradeError

Source

pub enum UpgradeError {
Show 17 variants    FromInvalid {
        from: String,
        reason: String,
    },
    ModuleEmpty {
        kind: &'static str,
    },
    ModuleInvalid {
        kind: &'static str,
        module: String,
        reason: String,
    },
    EmptyScript,
    AbsoluteScript {
        script: PathBuf,
    },
    ParentEscapeScript {
        script: PathBuf,
    },
    NonLispExtensionScript {
        script: PathBuf,
    },
    DuplicateFrom {
        from: String,
    },
    FromNotBeforeVersao {
        from: String,
        versao: String,
    },
    RestartNotExclusive {
        from: String,
        restart_count: usize,
        other_kinds: Vec<&'static str>,
    },
    StateChangeWithoutPriorLoad {
        from: String,
        script: PathBuf,
    },
    PurgeWithoutPriorLoad {
        from: String,
        kind: &'static str,
        module: String,
    },
    DuplicateCleanup {
        from: String,
        module: String,
        kinds: Vec<&'static str>,
    },
    DuplicateLoadModule {
        from: String,
        module: String,
    },
    DuplicateStateChange {
        from: String,
        script: PathBuf,
    },
    StateChangeAfterCleanup {
        from: String,
        script: PathBuf,
        prior_cleanup_kind: &'static str,
        prior_cleanup_module: String,
    },
    StateChangeWithoutOnStateChangeCallback {
        from: String,
        script: PathBuf,
    },
}

Variants§

§

FromInvalid

Fields

§from: String

§reason: String

§

ModuleEmpty

Fields

§kind: &'static str

§

ModuleInvalid

Fields

§kind: &'static str

§module: String

§reason: String

§

EmptyScript

§

AbsoluteScript

Fields

§script: PathBuf

§

ParentEscapeScript

Fields

§script: PathBuf

§

NonLispExtensionScript

Fields

§script: PathBuf

§

DuplicateFrom

Fields

§from: String

§

FromNotBeforeVersao

Fields

§from: String

§versao: String

§

RestartNotExclusive

Fields

§from: String

§restart_count: usize

§other_kinds: Vec<&'static str>

§

StateChangeWithoutPriorLoad

Fields

§from: String

§script: PathBuf

§

PurgeWithoutPriorLoad

Fields

§from: String

§kind: &'static str

§module: String

§

DuplicateCleanup

Fields

§from: String

§module: String

§kinds: Vec<&'static str>

§

DuplicateLoadModule

Fields

§from: String

§module: String

§

DuplicateStateChange

Fields

§from: String

§script: PathBuf

§

StateChangeAfterCleanup

Fields

§from: String

§script: PathBuf

§prior_cleanup_kind: &'static str

§prior_cleanup_module: String

§

StateChangeWithoutOnStateChangeCallback

Fields

§from: String

§script: PathBuf

Implementations§

Source §

impl UpgradeError

Source

pub fn state_change_without_prior_load(from: &str, script: &Path) -> Self

Construct an UpgradeError::StateChangeWithoutPriorLoad naming the offending (:from <prior-versao>) and (:state-change <script>) pair. Folds the uniform Self::StateChangeWithoutPriorLoad { from: from.to_string(), script: script.to_path_buf() } two-field struct-literal onto one substrate primitive so every wire-up on this variant reads through one dispatch rather than the pre-lift three-line open-coded block. The from string threads verbatim from UpgradeFromEntry::prior_versao and the script path from UpgradeInstruction::declared_path at the call site.

Source

pub fn duplicate_state_change(from: &str, script: &Path) -> Self

Construct an UpgradeError::DuplicateStateChange naming the offending (:from <prior-versao>) and (:state-change <script>) pair. Folds the uniform Self::DuplicateStateChange { from: from.to_string(), script: script.to_path_buf() } two-field struct-literal onto one substrate primitive so every wire-up on this variant reads through one dispatch rather than the pre-lift three-line open-coded block. The from string threads verbatim from UpgradeFromEntry::prior_versao and the script path from UpgradeInstruction::declared_path at the call site.

Source

pub fn state_change_without_on_state_change_callback( from: &str, script: &Path, ) -> Self

Construct an UpgradeError::StateChangeWithoutOnStateChangeCallback naming the offending (:from <prior-versao>) and (:state-change <script>) pair. Folds the uniform Self::StateChangeWithoutOnStateChangeCallback { from: from.to_string(), script: script.to_path_buf() } two-field struct-literal onto one substrate primitive so every wire-up on this variant reads through one dispatch rather than the pre-lift three-line open-coded block. The from string threads verbatim from UpgradeFromEntry::prior_versao and the script path from UpgradeInstruction::declared_path at the call site.

Source §

impl UpgradeError

Source

pub fn absolute_script(script: &Path) -> Self

Construct an UpgradeError::AbsoluteScript naming the offending (:state-change <script>). Folds the uniform Self::AbsoluteScript { script: script.to_path_buf() } one-field struct-literal onto one substrate primitive so every closure passed to crate::render::require_sandboxed_lisp_path at UpgradeInstruction::validate on this variant reads through one dispatch rather than the pre-lift three-line open-coded block. The script path threads verbatim from UpgradeInstruction::declared_path at the call site.

Source

pub fn parent_escape_script(script: &Path) -> Self

Construct an UpgradeError::ParentEscapeScript naming the offending (:state-change <script>). Folds the uniform Self::ParentEscapeScript { script: script.to_path_buf() } one-field struct-literal onto one substrate primitive so every closure passed to crate::render::require_sandboxed_lisp_path at UpgradeInstruction::validate on this variant reads through one dispatch rather than the pre-lift three-line open-coded block. The script path threads verbatim from UpgradeInstruction::declared_path at the call site.

Source

pub fn non_lisp_extension_script(script: &Path) -> Self

Construct an UpgradeError::NonLispExtensionScript naming the offending (:state-change <script>). Folds the uniform Self::NonLispExtensionScript { script: script.to_path_buf() } one-field struct-literal onto one substrate primitive so every closure passed to crate::render::require_sandboxed_lisp_path at UpgradeInstruction::validate on this variant reads through one dispatch rather than the pre-lift three-line open-coded block. The script path threads verbatim from UpgradeInstruction::declared_path at the call site.

Source §

impl UpgradeError

Source

pub fn from_invalid(from: &str, reason: &str) -> Self

Construct an UpgradeError::FromInvalid naming the offending (:from <prior-versao>) and the offending :reason axis value. Folds the uniform Self::FromInvalid { from: from.to_string(), reason: reason.to_string() } two-field struct-literal onto one substrate primitive so every in-crate wire-up on this variant reads through one dispatch rather than the pre-lift four-line open-coded block. Both from: &str and reason: &str parameters accept &str literals and &String (via Deref coercion) so every existing wire-up threads through the ctor without a pre-conversion.

Source

pub fn from_not_before_versao(from: &str, versao: &str) -> Self

Construct an UpgradeError::FromNotBeforeVersao naming the offending (:from <prior-versao>) and the offending :versao axis value. Folds the uniform Self::FromNotBeforeVersao { from: from.to_string(), versao: versao.to_string() } two-field struct-literal onto one substrate primitive so every in-crate wire-up on this variant reads through one dispatch rather than the pre-lift four-line open-coded block. Both from: &str and versao: &str parameters accept &str literals and &String (via Deref coercion) so every existing wire-up threads through the ctor without a pre-conversion.

Source

pub fn duplicate_load_module(from: &str, module: &str) -> Self

Construct an UpgradeError::DuplicateLoadModule naming the offending (:from <prior-versao>) and the offending :module axis value. Folds the uniform Self::DuplicateLoadModule { from: from.to_string(), module: module.to_string() } two-field struct-literal onto one substrate primitive so every in-crate wire-up on this variant reads through one dispatch rather than the pre-lift four-line open-coded block. Both from: &str and module: &str parameters accept &str literals and &String (via Deref coercion) so every existing wire-up threads through the ctor without a pre-conversion.

Source §

impl UpgradeError

Source

pub fn duplicate_from(entry: &UpgradeFromEntry) -> Self

Construct an UpgradeError::DuplicateFrom naming the offending duplicate (:from <prior-versao>) entry, projecting through the paired UpgradeFromEntry::prior_versao scalar accessor on the substrate primitive. Folds the uniform Self::DuplicateFrom { from: entry.prior_versao().to_string() } one-field struct-literal onto one substrate primitive so every wire-up on this variant reads through one dispatch, matching the sibling crate::AplicacaoError::contrato_self_loop (b30edfe) substrate-primitive-projection ctor’s shape on the peer [AplicacaoError] envelope. The entry: &UpgradeFromEntry parameter accepts the borrowed entry verbatim so the paired prior_versao().to_string() projection is spelled once — inside the ctor body — rather than at every wire-up site.

Source

pub fn purge_without_prior_load( from: &str, kind: &'static str, module: &str, ) -> Self

Construct an UpgradeError::PurgeWithoutPriorLoad naming the offending (:from <prior-versao>) entry, the offending cleanup instruction’s :kind lisp-form (:soft-purge / :purge), and its :module target. Folds the uniform Self::PurgeWithoutPriorLoad { from: from.to_string(), kind, module: module.to_string() } three-field struct-literal onto one substrate primitive so every wire-up on this sole-variant cleanup-family load-before-cleanup ordering-refusal envelope reads through one dispatch rather than the pre-lift seven-line open-coded block.

The from: &str parameter accepts &str literals and &String via Deref coercion so the sole in-crate wire-up site threads UpgradeFromEntry::prior_versao verbatim without a pre-conversion. The kind: &'static str parameter accepts the lisp-form &'static str UpgradeInstruction::lisp_form returns for the two UpgradeInstruction::is_cleanup arms — M2_UPGRADE_INSTRUCTION_KIND_SOFT_PURGE / M2_UPGRADE_INSTRUCTION_KIND_PURGE — verbatim without a per-arm re-projection at the ctor path. The module: &str parameter takes the &str UpgradeInstruction::declared_module returns via .expect("is_cleanup() implies declared_module() is Some") at the caller — the is_cleanup-implies-declared_module-is- Some composition pin at [tests::upgrade_instruction_is_cleanup_implies_declared_module_is_some] makes the .expect(…) structurally infallible at build time.

Peer of the sibling one-off standalone-ctor UpgradeError::duplicate_from on the paired one-slot { from: String } envelope on the same UpgradeError envelope, and of the sibling AplicacaoError::contrato_endpoint_not_absolute (cdf1a2c) three-slot { de, para, endpoint: String } sole- variant standalone ctor on the peer AplicacaoError envelope. Closes the last unlifted { from: String, kind: &'static str, module: String } three-slot open-coded struct-literal wire-up on the OTP-appup load-before-cleanup ordering axis, sibling of the peer sub-family generated by [upgrade_from_axis_ctors!] (41d08db, three variants on { from: String, <axis>: String }) on the paired ordering / uniqueness / callback-declaration axes, and of the peer standalone UpgradeError::duplicate_from (7e52aec) one-slot ctor on the sibling cross-entry duplicate- :from gate. Every future consumer that raises this refusal outside UpgradeFromEntry::validate_purge_ordering — a deferred wasm-operator’s install_release/1 per-entry load-before-cleanup re-checker at hot-upgrade dispatch time, a future feira validate --upgrade-from per-caixa admission verb re-running the load-before-cleanup gate on demand, a per-Caixa overlay resolver rejecting a cluster-local :soft-purge / :purge overlay lacking a preceding :load-module — reaches the variant through one call rather than re-inlining the seven-line struct-literal in lockstep with the sole in-crate wire-up site.

Source

pub fn state_change_after_cleanup( from: &str, script: &Path, prior_cleanup_kind: &'static str, prior_cleanup_module: &str, ) -> Self

Construct an UpgradeError::StateChangeAfterCleanup naming the offending (:from <prior-versao>) entry, the offending (:state-change …) :script path, and the prior cleanup instruction’s :kind lisp-form (:soft-purge / :purge) + :module target. Folds the uniform Self::StateChangeAfterCleanup { from: from.to_string(), script: script.to_path_buf(), prior_cleanup_kind, prior_cleanup_module: prior_cleanup_module.to_string() } four-field struct-literal onto one substrate primitive so every wire-up on this sole- variant migrate-after-cleanup ordering-refusal envelope reads through one dispatch rather than the pre-lift seven-line open- coded block. Closes the last unlifted { from: String, script: PathBuf, prior_cleanup_kind: &'static str, prior_cleanup_module: String } four-slot open-coded struct-literal wire-up on the OTP-appup migrate-before-cleanup ordering axis, filling the missing four-slot rung on the UpgradeError-side ctor-family ladder alongside the sibling one-slot UpgradeError::duplicate_from (7e52aec) and three-slot UpgradeError::purge_without_prior_load (9752da1) standalone ctors, the two-slot [upgrade_from_axis_ctors!] (41d08db) / [upgrade_from_script_ctors!] (8e67041) macro-generated families, and the one-slot [upgrade_script_only_ctors!] (7468ca9) family. Sole in-crate wire-up site is inside UpgradeFromEntry::validate_state_change_before_cleanup’s migrate-family sticky-latch dispatch — the third of three within-entry cross-instruction OTP-appup ordering gates the module doc pins (validate_state_change_ordering on the load → migrate boundary via [upgrade_from_script_ctors!]-generated state_change_without_prior_load; validate_purge_ordering on the load → cleanup boundary via purge_without_prior_load; validate_state_change_before_cleanup on the migrate → cleanup boundary via this ctor — now).

The from: &str parameter accepts &str literals and &String via Deref coercion so the sole in-crate wire-up site threads UpgradeFromEntry::prior_versao (a &str accessor) verbatim without a pre-conversion. The script: &std::path::Path parameter accepts &Path (direct Path::new(…)) and &PathBuf (from UpgradeInstruction::declared_path’s Option<&PathBuf> via Deref coercion) so the wire-up threads the sticky-latch script projection through the ctor without a pre-conversion; the uniform script.to_path_buf() one-field construction is spelled once — inside the ctor body — rather than at every wire-up site. The prior_cleanup_kind: &'static str parameter accepts the lisp-form &'static str UpgradeInstruction::lisp_form returns for the two UpgradeInstruction::is_cleanup arms — M2_UPGRADE_INSTRUCTION_KIND_SOFT_PURGE / M2_UPGRADE_INSTRUCTION_KIND_PURGE — verbatim without a per-arm re-projection at the ctor path. The prior_cleanup_module: &str parameter takes the &str UpgradeInstruction::declared_module returns via .expect("is_cleanup() implies declared_module() is Some") at the caller — the is_cleanup-implies-declared_module- is-Some composition pin at [tests::upgrade_instruction_is_cleanup_implies_declared_module_is_some] makes the .expect(…) structurally infallible at build time.

Every future consumer that raises this refusal outside UpgradeFromEntry::validate_state_change_before_cleanup — a deferred wasm-operator’s install_release/1 per-entry migrate-before-cleanup re-checker at hot-upgrade dispatch time, a future feira validate --upgrade-from per-caixa admission verb re-running the migrate-before-cleanup gate on demand, a per-Caixa overlay resolver rejecting a cluster-local :state-change overlay authored after a :soft-purge / :purge, the M4 mesh.pleme.io/v1alpha1/Caixa CR admission webhook re-checking a per-:upgrade-from-patched candidate before the migrate-before-cleanup gate re-fires — reaches the variant through one call rather than re-inlining the seven-line struct-literal in lockstep with the sole in-crate wire-up site.

Source

pub fn duplicate_cleanup( from: &str, module: &str, kinds: Vec<&'static str>, ) -> Self

Construct an UpgradeError::DuplicateCleanup naming the offending (:from <prior-versao>) entry, the colliding :module target, and the ordered pair of colliding cleanup :kind lisp- forms (:soft-purge / :purge). Folds the uniform Self::DuplicateCleanup { from: from.to_string(), module: module.to_string(), kinds } three-field struct-literal onto one substrate primitive so every wire-up on this sole-variant within- entry per-module cleanup-singularity refusal envelope reads through one dispatch rather than the pre-lift five-line open-coded block. Closes the last unlifted { from: String, module: String, kinds: Vec<&'static str> } three-slot open-coded struct-literal wire-up on the OTP-appup per-module cleanup-singularity axis, filling a peer three-slot rung on the UpgradeError-side ctor- family ladder alongside the sibling three-slot UpgradeError::purge_without_prior_load (9752da1) standalone ctor on the paired within-entry load → cleanup ordering axis, the one-slot UpgradeError::duplicate_from (7e52aec) standalone ctor on the sibling cross-entry duplicate-:from gate, the four- slot UpgradeError::state_change_after_cleanup (be68237) standalone ctor on the migrate → cleanup boundary, the two-slot [upgrade_from_axis_ctors!] (41d08db) / [upgrade_from_script_ctors!] (8e67041) macro-generated families, and the one-slot [upgrade_script_only_ctors!] (7468ca9) family. Sole in-crate wire-up site is inside UpgradeFromEntry::validate_cleanup_singularity’s per-module cleanup-family dedup arm.

The from: &str parameter accepts &str literals and &String via Deref coercion so the sole in-crate wire-up threads UpgradeFromEntry::prior_versao (a &str accessor) verbatim without a pre-conversion. The module: &str parameter takes the &str UpgradeInstruction::declared_module returns via .expect("is_cleanup() implies declared_module() is Some") at the caller — the is_cleanup-implies-declared_module-is-Some composition pin at [tests::upgrade_instruction_is_cleanup_implies_declared_module_is_some] makes the .expect(…) structurally infallible at build time. The kinds: Vec<&'static str> parameter takes the ordered pair vec![prior_kind, kind] built at the caller from the two UpgradeInstruction::lisp_form &'static str returns (M2_UPGRADE_INSTRUCTION_KIND_SOFT_PURGE / M2_UPGRADE_INSTRUCTION_KIND_PURGE) — the same substrate- primitive &'static str projection the paired three-slot UpgradeError::purge_without_prior_load ctor threads on the sibling load → cleanup ordering axis.

Every future consumer that raises this refusal outside UpgradeFromEntry::validate_cleanup_singularity — a deferred wasm-operator’s install_release/1 per-entry per-module cleanup-singularity re-checker at hot-upgrade dispatch time, a future feira validate --upgrade-from per-caixa admission verb re-running the singularity pass on demand, a per-Caixa overlay resolver rejecting a cluster-local :soft-purge / :purge overlay that collides with a base-entry cleanup on the same module, the M4 mesh.pleme.io/v1alpha1/Caixa CR admission webhook re-checking a per-:upgrade-from-patched candidate before the singularity gate re-fires — reaches the variant through one call rather than re-inlining the five-line struct-literal in lockstep with the sole in-crate wire-up site.

Source

pub fn restart_not_exclusive( from: &str, restart_count: usize, other_kinds: Vec<&'static str>, ) -> Self

Construct an UpgradeError::RestartNotExclusive naming the offending (:from <prior-versao>) entry, the observed (:restart) instruction count, and the ordered list of non-:restart instruction lisp-forms the entry mixed with the terminal fallback. Folds the uniform Self::RestartNotExclusive { from: from.to_string(), restart_count, other_kinds } three-field struct-literal onto one substrate primitive so every wire-up on this sole-variant within- entry (:restart)-exclusivity refusal envelope reads through one dispatch rather than the pre-lift five-line open-coded block. Closes the last unlifted { from: String, restart_count: usize, other_kinds: Vec<&'static str> } three-slot open-coded struct-literal wire-up on the OTP-appup within-entry (:restart)-fallback-exclusivity axis — the last-remaining open-coded emission site the sibling UpgradeError::duplicate_cleanup (10a5b48) commit body pinned as the natural next lift on the UpgradeError envelope. Fills a peer three-slot rung on the UpgradeError-side ctor-family ladder alongside the sibling three-slot UpgradeError::purge_without_prior_load (9752da1) standalone ctor on the paired within-entry load → cleanup ordering axis and UpgradeError::duplicate_cleanup (10a5b48) standalone ctor on the per-module cleanup-singularity axis, the one-slot UpgradeError::duplicate_from (7e52aec) standalone ctor on the cross-entry duplicate-:from gate, the four-slot UpgradeError::state_change_after_cleanup (be68237) standalone ctor on the migrate → cleanup boundary, the two-slot [upgrade_from_axis_ctors!] (41d08db) / [upgrade_from_script_ctors!] (8e67041) macro-generated families, and the one-slot [upgrade_script_only_ctors!] (7468ca9) family. Sole in-crate wire-up site is inside UpgradeFromEntry::validate_restart_exclusive’s mixed-(:restart) arm.

The from: &str parameter accepts &str literals and &String via Deref coercion so the sole in-crate wire-up threads UpgradeFromEntry::prior_versao (a &str accessor) verbatim without a pre-conversion. The restart_count: usize parameter takes the observed (:restart) occurrence count built at the caller from instructions.iter().filter(|i| i.is_restart()).count() — the same IsVariant-derived arm-discriminator dispatch the paired other_kinds projection routes through — so the diagnostic surfaces the duplication mode unambiguously even when other_kinds is empty (the ((:restart) (:restart)) shape the sibling validate_rejects_restart_duplicated test pins with restart_count: 2, other_kinds: vec![]). The other_kinds: Vec<&'static str> parameter takes the ordered list of non- :restart instruction lisp-forms built at the caller from instructions.iter().filter(|i| !i.is_restart()).map( UpgradeInstruction::lisp_form).collect() — the same substrate- primitive &'static str projection the peer three-slot UpgradeError::purge_without_prior_load / UpgradeError::duplicate_cleanup ctors thread on the sibling within-entry cleanup axes.

Every future consumer that raises this refusal outside UpgradeFromEntry::validate_restart_exclusive — a deferred wasm-operator’s install_release/1 per-entry (:restart)- exclusivity re-checker at hot-upgrade dispatch time, a future feira validate --upgrade-from per-caixa admission verb re-running the exclusivity pass on demand, a per-Caixa overlay resolver rejecting a cluster-local (:restart) overlay that mixes with a base-entry typed sequence, the M4 mesh.pleme.io/v1alpha1/Caixa CR admission webhook re-checking a per-:upgrade-from-patched candidate before the exclusivity gate re-fires — reaches the variant through one call rather than re-inlining the five-line struct-literal in lockstep with the sole in-crate wire-up site.

Source

pub fn module_invalid( kind: &'static str, module: &str, reason: impl Into<String>, ) -> Self

Construct an UpgradeError::ModuleInvalid naming the offending instruction’s :kind lisp-form (:load-module / :soft-purge / :purge), the malformed :module value, and the parser-shaped reason from crate::render::is_dns_1123_label. Folds the uniform Self::ModuleInvalid { kind, module: module.to_string(), reason } three-field struct-literal onto one substrate primitive so every wire-up on this variant reads through one dispatch rather than the pre-lift open-coded closure block inside [validate_module]’s crate::render::require_valid_dns_1123_label shape-arm.

The kind: &'static str parameter accepts the lisp-form UpgradeInstruction::lisp_form returns for the three UpgradeInstruction::declared_module-bearing arms — crate::render::M2_UPGRADE_INSTRUCTION_KIND_LOAD_MODULE / crate::render::M2_UPGRADE_INSTRUCTION_KIND_SOFT_PURGE / crate::render::M2_UPGRADE_INSTRUCTION_KIND_PURGE — verbatim without a per-arm re-projection at the ctor path. The module: &str parameter threads the offending author-supplied :module value verbatim from UpgradeInstruction::declared_module. The reason: impl Into<String> bound accepts both &str literals and the String crate::render::is_dns_1123_label returns via .into(), matching the peer crate::AplicacaoError::contrato_caixa_invalid / crate::SupervisorError::child_caixa_invalid / crate::DepError::nome_invalid { *, reason: String } three-slot invalid-arm ctor discipline on the sibling DNS-1123-label per-envelope shape.

Peer of the sibling standalone-ctor crate::AplicacaoError::contrato_caixa_invalid (3d1e484) on the paired crate::AplicacaoError envelope’s :contratos per-edge caixa-reference axis — same pub fn <ctor>(kind, module: &str, reason: impl Into<String>) -> Self shape closing the invalid-arm side of a require_valid_dns_1123_label two-closure cascade, so [validate_module]’s cascade now reads through one substrate primitive on the invalid-arm rather than an open-coded four-line struct-literal in lockstep with the sole in-crate wire-up site.

Every future consumer that raises this refusal outside [validate_module] — a deferred wasm-operator’s install_release/1 per-instruction :module re-validator at hot-upgrade dispatch time re-running the same DNS-1123-label floor against a candidate module reference, a future feira validate --upgrade-from per-caixa admission verb re-running the module-shape gate on demand, an M4 mesh.pleme.io/v1alpha1/Caixa CR admission webhook re-checking a per-:upgrade-from-patched candidate before the module-shape gate re-fires, a per-Caixa overlay resolver rejecting a cluster-local (:load-module|:soft-purge|:purge <bad-module>) overlay against a cluster-local snapshot — now reaches this variant through one call rather than re-inlining the four-line struct-literal in lockstep with the [validate_module] closure-form wire-up.

Source

pub const fn module_empty(kind: &'static str) -> Self

Construct an UpgradeError::ModuleEmpty naming the offending instruction’s :kind lisp-form (:load-module / :soft-purge / :purge) at which the appup module reference is the empty string. Folds the uniform Self::ModuleEmpty { kind } one-slot struct-literal onto one substrate primitive so the sole in-crate closure passed to crate::render::require_valid_dns_1123_label at [validate_module] on this variant reads through one dispatch rather than the pre-lift open-coded block. The kind label threads verbatim from the caller-side crate::render::M2_UPGRADE_INSTRUCTION_KIND_LOAD_MODULE / crate::render::M2_UPGRADE_INSTRUCTION_KIND_SOFT_PURGE / crate::render::M2_UPGRADE_INSTRUCTION_KIND_PURGE const roster the wire-up feeds through [validate_module]’s kind: &'static str parameter.

Sibling of the paired three-slot Self::module_invalid (3d0d64a) substrate primitive on the same crate::render::require_valid_dns_1123_label two-closure cascade at [validate_module] — the empty-arm and invalid-arm now both reach the UpgradeError envelope through one substrate primitive per typed variant, closing the pair on the OTP-appup per-instruction :module caixa-reference axis. Same shape discipline as the peer crate::AplicacaoError::contrato_caixa_empty (815cc87) one-slot { slot: &'static str } sibling that closed the peer pair on the AplicacaoError envelope’s two-arm DNS-1123-label cascade at the :contratos <slot> per-edge axis ([crate::aplicacao::validate_contrato_caixa]) — the same “one substrate primitive per typed arm on both sides of a require_valid_dns_1123_label two-closure cascade, projecting through the caller-supplied axis-tag” discipline now extended onto the M2 (:upgrade-from :instructions <kind> :module) side of the pair the M3 (:contratos <slot>) side already carries.

kind stays &'static str (not &str) — every :upgrade-from :instructions <kind> tag comes from the [crate::render::M2_UPGRADE_INSTRUCTION_KIND_*] const roster carrying program-lifetime storage, matching the enum-field type and the [validate_module] wire-up’s per-arm dispatch. A runtime-borrowed &str would silently downgrade the label lifetime and let a caller stash a non-'static borrow into the returned error. #[must_use] fires a compile warning at any wire-up that mistakenly discards the constructed error rather than routing it through return Err(…) / .map_err(…) / a closure return. pub const fn matches the peer per-envelope one-slot Copy-scalar ctor family discipline (aplicacao_placement_scalar_ctors!, layout_nome_only_ctors!, dep_nome_only_ctors!, [Self::contrato_caixa_empty]) so the ctor is usable in const position at every wire-up site.

Every future consumer that constructs ModuleEmpty outside [validate_module]’s require_valid_dns_1123_label empty-arm closure — a deferred wasm-operator’s install_release/1 per-instruction :module re-validator at hot-upgrade dispatch time re-running the same empty-arm floor against a candidate module reference, a future feira validate --upgrade-from per-caixa admission verb re-running the empty-module gate on demand, an M4 mesh.pleme.io/v1alpha1/Caixa CR admission webhook re-checking a per-:upgrade-from-patched candidate before the empty-module gate re-fires, a per-Caixa overlay resolver rejecting a cluster-local (:load-module|:soft-purge|:purge "") overlay against a cluster-local snapshot — now reaches this variant through one call rather than re-inlining the one-line struct-literal in lockstep with the sole in-crate wire-up site.