Function require_supervisor_view 

pub fn require_supervisor_view<E>(caixa: &Caixa) -> Result<SupervisorSpec, E>
where
    E: From<KindMismatch> + From<ManifestError> + From<SupervisorError>,

Compound per-Supervisor entry gate: the canonical four-arm require_kind(caixa, CaixaKind::Supervisor)? + caixa.validate_restart_window()? + caixa.supervisor_view().expect(…) + spec.validate()? + validate_no_self_supervision(spec.children(), caixa.nome())? cascade — the byte-for-byte [crate::layout::StandardLayout::verify] feira build author-time gate on the supervision-tree kind arm — collapsed onto one call the caller reads as intent (“gate the input on the V0 Supervisor shape and hand back a validated crate::supervisor::SupervisorSpec”) rather than four hand-spelled steps.

This is the fourth and final per-kind compound entry gate: it closes the asymmetry the sibling per-Servico require_v0_servico_shape, per-Aplicacao require_aplicacao_view, and per-Acao require_acao_view gates left open — Supervisor was the only typed-name-graph kind whose four-arm V0-shape cascade lived only open-coded in the layout pipeline, with no substrate primitive a per-Supervisor renderer could route through to inherit it. Every per-kind renderer’s entry-gate cascade now lives in exactly one substrate primitive.

The cascade names one contract with four axes: :kind is Supervisor (this is a per-Supervisor consumer’s input, not a Biblioteca / Binario / Servico / Aplicacao / Acao mis-hand-off); the raw :restart-window string parses through the shared crate::supervisor::duration_codec (crate::manifest::Caixa::validate_restart_window) — this arm fires before the typed view is folded because crate::manifest::Caixa::supervisor_view soft-swallows a malformed :restart-window to restart_window: None (the canonical “never reset” sentinel), so a value like ":restart-window \"1.5s\"" that bypassed this gate would launder into a never-reset supervisor far from the source caixa.lisp rather than fire the parse diagnostic; the folded crate::supervisor::SupervisorSpec passes its own typed shape validation (crate::supervisor::SupervisorSpec::validate: the OTP MaxIntensity/Period restart-intensity invariant, per-child DNS-1123 :caixa names, semver-valid :versao constraints, SimpleOneForOne-carries-zero-static-children, the set-not-multiset duplicate-child gate, and so on across every supervisor-tree slot); and no :children :caixa entry names the supervisor’s own :nome (crate::supervisor::validate_no_self_supervision, the cross-slot self-edge gate the typed view cannot run because it carries the children but not the parent :nome — a one-node supervision-tree cycle the wasm-operator’s hierarchical reconciler would otherwise be handed as a node that is its own parent). All four axes must hold together — every per-Supervisor consumer’s entry-point sees the same V0 Supervisor-shape contract the feira build author-time gate enforces, so a renderer routing through this compound gate admits exactly the set of Supervisors the author-time gate admits.

No per-Supervisor renderer exists yet (Supervisor “runs nothing — supervises children”; it renders to hierarchical reconciliation, not a per-Servico Helm chart or per-Aplicacao mesh fan-out). This gate exists so the deferred per-Supervisor consumers named across the supervisor-slot doc surface — the wasm-operator’s hierarchical reconciliation scheduler, the M4 mesh.pleme.io/v1alpha1/Supervisor CR materializer’s per-CR admission webhook, a future feira validate --supervisor per-caixa admission verb — inherit the compound gate by construction with one call, instead of re-inlining the four-arm cascade (which is exactly the drift the sibling gates were lifted to close: a renderer that folds supervisor_view and validates it still admits a malformed-:restart-window or self-supervising Supervisor unless it also open-codes the two cross-slot arms). Precedent for lifting a compound gate ahead of its second consumer is the sibling require_valid_versao gate, which the docstring notes collapses “a single existing production call site” onto the primitive.

The generic error type E accepts every future per-Supervisor consumer’s local thiserror Error enum that carries KindMismatch, crate::manifest::ManifestError, and crate::supervisor::SupervisorError via #[from]. Type inference at the call site resolves E from the caller’s ? return type, though a caller that assigns the result directly to a Result<SupervisorSpec, Error> binding may need a turbofish (::<Error>) — matching the sibling require_aplicacao_view::<Error> / require_v0_servico_shape::<Error> turbofish convention the peer per-kind call sites already read.

Errors

Returns the caller’s E wrapping a KindMismatch when caixa.kind != CaixaKind::Supervisor, a crate::manifest::ManifestError when the raw :restart-window string fails the shared duration codec (crate::manifest::Caixa::validate_restart_window), or a crate::supervisor::SupervisorError when the folded crate::supervisor::SupervisorSpec fails its typed-shape validation (crate::supervisor::SupervisorSpec::validate) or names itself as a :children entry (crate::supervisor::SupervisorError::ChildSupervisesSelf, the cross-slot self-edge gate the typed view cannot run because it carries the children but not the parent :nome). Order matches the layout pipeline this compound gate mirrors: the kind gate fires first (a :kind Servico caixa with supervisor slots surfaces the kind mismatch — the more actionable diagnostic), the raw-string parse gate fires next (so a malformed :restart-window surfaces its self-locating raw-value diagnostic rather than the laundered-to-None soft-pass the typed view would let through), then the typed-shape gate, then the self-supervision gate last (a malformed self-referential child surfaces its narrower per-child shape diagnostic before the self-edge refusal).

Panics

Never in practice — the internal crate::manifest::Caixa::supervisor_view unwrap is guarded by the preceding require_kind-on-Supervisor gate, and crate::manifest::Caixa::supervisor_view’s own doc pin guarantees Some-return iff caixa.kind().is_supervisor(). A future supervisor_view refactor that decouples Some-return from caixa.kind().is_supervisor() would trip this panic at the first per-Supervisor consumer call site, not silently return Err(E) at every one — the panic message names the substrate invariant so the offending edit is obvious.