Enum PathShapeViolation 

pub enum PathShapeViolation {
    Empty,
    Absolute,
    ParentEscape,
}

Tagged reason a caixa-author-supplied path can fail the sandboxed-relative shape gate every callback / script path must pass for the layout checker’s root.join(p) to stay inside the caixa root.

Returned by is_sandboxed_relative_path so each per-axis caller — crate::BehaviorSpec::validate on :behavior :on-* paths (b0c8389), crate::UpgradeInstruction::validate’s StateChange arm on :upgrade-from :state-change :script (26da2c7), every future axis admitting a user-supplied path — match-and-wraps the tag into its own typed *Invalid { slot, path } enum variant so the diagnostic still names which slot carried the malformed value. The tag is axis-agnostic; the wrapping per-axis variant carries the slot identity.

Sibling discriminator-style of the per-arm reason substrings every value-shape predicate already exposes (is_dns_1123_label, is_gateway_api_http_path, …) — but typed rather than string- shaped, because the per-axis variants for path violations were already split three ways (EmptyPath / AbsolutePath / ParentEscape in BehaviorError; EmptyScript / AbsoluteScript / ParentEscapeScript in UpgradeError), so collapsing them to a single *PathInvalid { reason } variant would regress the diagnostic shape rather than preserve it.

Variants

Empty

The path string is empty — PathBuf::new() or the canonical “I declared the slot but left the value blank” authoring footgun. root.join(PathBuf::new()) resolves to root itself, silently pointing the runtime’s LisleLoader at the project root rather than a file.

Absolute

The path is absolute — Path::join replaces the base with an absolute right-hand side, so root.join("/etc/passwd") resolves to "/etc/passwd" and escapes the project sandbox entirely. The Lunatic-style sandbox discipline (theory/INSPIRATIONS.md §III.1) requires every author-supplied path to live under the caixa root.

ParentEscape

The path contains a Component::ParentDir component anywhere — root.join("../sibling/x") traverses above the caixa root, the same sandbox-escape vector via parent-directory traversal. Caught regardless of where the .. component sits (leading, mid-path, trailing) so a future relaxation that only checks one position surfaces at this one predicate.

Implementations

impl PathShapeViolation

pub const fn is_empty(&self) -> bool

pub const fn is_absolute(&self) -> bool

pub const fn is_parent_escape(&self) -> bool

impl PathShapeViolation

pub const ALL: &'static [Self]

Exhaustive iteration surface for every consumer that walks the closed three-arm PathShapeViolation discriminator set — the paired byte-parity pin on the gen_platform::IsVariant-derived per-arm is_* predicate family, a future feira lint --explain-path-shape=<axis> per-arm listing of the accepted violation kinds, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, any future property-test harness that sweeps every arm to compute per-arm diagnostic coverage. A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) extends this slice as one edit and every consumer picks up the new entry by construction; the compiler-checked exhaustiveness on the sibling match arms in is_sandboxed_relative_path and require_sandboxed_lisp_path is the build-time guarantee that no arm forgets to grow.

Peer of the sibling closed-set fieldless typed enums’ crate::CaixaKind::ALL (6b1f4fb) / crate::CaixaDialeto::ALL (dd4f541) / crate::aplicacao::PlacementStrategy::ALL (18c7342) / crate::aplicacao::RateLimitUnit::ALL (6bce03d) / crate::dep::DepList::ALL (45ee563) / crate::supervisor::RestartStrategy::ALL (4eec29c) / crate::supervisor::RestartPolicy::ALL (dd32ccf) exhaustive-iteration surfaces — the tenth closed-set typed enum on the caixa surface to converge onto the same one-canonical-arm-list-per-enum discipline, and the first render-side path-shape-diagnostic axis (as distinct from an OTP-shape M2 slot or an M3 mesh slot) to reach it. Order matches variant declaration order verbatim (Empty → Absolute → ParentEscape) so the slice is the canonical ordering every exhaustive dispatch site (the Empty → Absolute → ParentEscape arm-ordering is_sandboxed_relative_path and every per-axis caller in crate::manifest::ManifestError preserve for diagnostic-precedence continuity) defers to.

pub const fn as_str(self) -> &'static str

Substrate-canonical per-PathShapeViolation lowercase-kebab-tag scalar accessor every consumer that renders the three-arm path-shape violation axis as user-facing text keys off — returns the per-arm byte-string ("empty" / "absolute" / "parent-escape") as a &'static str, the same lowercase tags a future feira lint --explain-path-shape=<axis> per-arm listing, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, or a tracing::field::Value::Str-arm structured-log recorder on the caixa-build pipeline’s per-slot path-gate emission path would have otherwise reached via a format!("{:?}", violation).to_lowercase() round-trip through the std::fmt::Debug derive — with two silent drift footguns the substrate-canonical accessor closes at build time:

• the std::fmt::Debug derive’s per-arm output is not a stability guarantee (Rust’s own convention gives it as no guarantee at all), so a #[derive(Debug)] swap for a hand-rolled impl Debug that pretty-prints the arm with per-arm context ("Empty(no path supplied)", "Absolute(escapes sandbox)", "ParentEscape(traverses above root)") would silently reroute every diagnostic tag through a stale byte-string with no downstream signal until an operator scrolled the feira lint / feira build terminal output;
• format!("{:?}", violation).to_lowercase() also collapses ParentEscape to "parentescape" rather than the kebab-case "parent-escape" every other substrate-side kebab-slug axis (the sibling [caixa_provedor::FerriteRuntime::variant_slug]-emitted "ferrite-safe" / "ferrite-arena" tags, the crate::CaixaKind::as_str-emitted lowercase-single-word kind tags) already carries — allocating a fresh String per render pass on top of the tag drift.

Peer of the sibling substrate-wide closed-set fieldless typed- enum canonical-lowercase-tag scalar accessors [caixa_arch::ArchVerdict::as_str] (f3da79b — the paired proof-outcome axis on the sibling caixa-arch closed-set enum), [caixa_arch::InvariantKind::as_str] (87c875a — the sibling caixa-arch severity axis), [caixa_lint::Severity::as_str] / [caixa_lint::FixSafety::as_str] (72782f7 — caixa-lint), crate::CaixaKind::as_str / crate::CaixaDialeto::as_str / crate::CaixaVersion::as_str, and the sibling M2/M3 caixa-core closed-set typed-enum as_str family (crate::supervisor::RestartStrategy::as_str / crate::supervisor::RestartPolicy::as_str / crate::aplicacao::PlacementStrategy::as_str / crate::aplicacao::RateLimitUnit::as_suffix / crate::dep::DepList::as_str) — extends the substrate-wide “one canonical lowercase-tag accessor per closed-set fieldless typed enum” discipline onto the caixa-core render-side path-shape-diagnostic axis, the first render-side path-shape- diagnostic closed-set enum to reach it.

pub const fn — matches the sibling gen_platform::IsVariant-derive-generated per-arm is_* predicates’ const fn posture, so every future substrate-side const-context consumer (a const _: () = assert!(…) module- scope pin on a per-fixture typed PathShapeViolation, a future const fn per-violation rejection-body composer, a compile-time HashMap<&'static str, _>-shaped per-violation policy table) reaches the paired byte-string through one substrate-primitive dispatch at compile time as at runtime.

A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) reaches the paired std::fmt::Display impl + AsRef<str> impl + every downstream .as_str() consumer through one match-arm edit here, not a coordinated rewrite of every open-coded format!("{:?}", …) re-inlining. Named as_str (not label / tag / slug) to match the sibling closed-set-enum as_str convention the substrate already carries verbatim across every peer typed enum whose canonical projection is a plain &'static str (as distinct from the sibling [caixa_provedor::FerriteRuntime::variant_slug] and crate::WitTarget::label domain-named projections on enums carrying a paired non-string projection axis).

pub fn from_wire(s: &str) -> Option<Self>

Substrate-canonical reverse projection on the PathShapeViolation closed-set render-side path-shape-diagnostic axis — parses the lowercase-kebab per-arm byte-string Self::as_str emits back to the typed variant, or None when s is outside the closed three-arm accept-set ("empty" / "absolute" / "parent-escape"). Walks exactly the same three byte-strings the sibling Self::as_str forward emitter returns, so the parse and emit halves of the round-trip migrate through one caixa-core edit on any future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes): the compiler-checked exhaustiveness on Self::as_str’s match self arms and the round-trip pin [tests::path_shape_violation_from_wire_accepts_every_as_str_output] together lock the two halves mutually.

Prior to this lift the substrate carried only the forward Self → &str projection on the path-shape-violation axis (the Self::as_str emitter, the paired std::fmt::Display impl routed through it, the paired AsRef<str> impl routed through it) — every future consumer that wanted to promote the render- side path-shape-violation tag back to the typed enum (a future feira lint --explain-path-shape=<empty|absolute|parent-escape> CLI arg-parse that binds the wire byte-string into the typed enum before dispatching to the per-arm listing body, a future M4 mesh.pleme.io/v1alpha1/Caixa CR materializer’s admission- webhook rejection-body parser that re-binds a prior audit’s Self::as_str output to the typed enum before threading it into the per-slot diagnostic-precedence table, a future tracing::field::Value::Str-arm structured-log re-loader that hydrates a prior caixa-build pipeline’s per-slot path-gate emission back to the typed enum for cross-run violation-histogram diff) would have had to re-inline a three- arm match s cascade that expressed no compile-time link back to the typed PathShapeViolation enum.

Same closed-set-reverse-projection discipline the sibling crate::CaixaKind::from_wire (2aa6d23), crate::CaixaDialeto::from_wire (d0e65ea), crate::supervisor::RestartStrategy::from_wire (4eec29c), crate::supervisor::RestartPolicy::from_wire (dd32ccf), crate::aplicacao::PlacementStrategy::from_wire (18c7342), crate::dep::DepList::from_wire (45ee563), and [caixa_arch::InvariantKind::from_wire] (b9e4e61) typed enums carry on the peer wire-side str → Self axes — extends the substrate-wide (as_str, from_wire) round-trip family onto the caixa-core render-side path-shape-diagnostic closed-set enum (the first render-side path-shape-diagnostic axis to reach it), matching the same two-way str ↔ Self round-trip every sibling closed-set enum already carries. Method-named from_wire (not from_str) to match the peer shapes verbatim and side-step a clippy::should_implement_trait lint that a plain from_str name would otherwise trigger without paired std::str::FromStr impl scaffolding this axis does not carry today. Returns Option<Self> (rather than Result<Self, _>) to match the peer shapes: the caller picks the diagnostic form appropriate for its use site (a feira lint --explain-path-shape CLI arg-parse renders its own per-verb error message; an admission-webhook rejection body wraps the None outcome with the accepted-set enumeration PathShapeViolation::ALL.iter(). map(PathShapeViolation::as_str) for operator diagnostics).

Trait Implementations

impl AsRef<str> for PathShapeViolation

Route the standard-library AsRef<str> projection on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the trait- idiomatic .as_ref() (a future HashMap::get::<str>(violation.as_ref()) per-violation policy- table lookup, a Command::arg shell-out composing the canonical violation tag into a feira lint --path-shape=<tag> filter, any impl AsRef<str>-bound generic function) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded .as_str() re-inlining at every wire-up.

Peer of the substrate-wide sibling closed-set-enum AsRef<str>-through-as_str family already carried by [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (ce9d1e3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::CaixaDialeto, crate::aplicacao::PlacementStrategy, crate::aplicacao::RateLimitUnit, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, crate::dep::DepList, and crate::CaixaVersion, plus the peer [caixa_provedor::FerriteRuntime] AsRef<str>-through- variant_slug route (f919cda) — extends the axis onto the caixa- core render-side path-shape-diagnostic closed-set enum, closing the (as_str, Display, AsRef<str>) canonical-projection triple on the first render-side path-shape-diagnostic closed-set fieldless typed enum on the caixa surface to converge onto it.

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for PathShapeViolation

fn clone(&self) -> PathShapeViolation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PathShapeViolation

impl Debug for PathShapeViolation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for PathShapeViolation

Route the derived-style std::fmt::Display impl on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the standard- library {} formatting axis (a future feira lint --explain-path-shape=<axis> per-arm listing line naming the violation, a tracing::field::Value::from(violation) structured- log recorder on the caixa-build pipeline’s per-slot path-gate emission path, any format!("{violation}") interpolation in a future audit surface) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded per-arm match at every wire-up.

Follows the same closed-set-typed-enum Display-through-as_str convention the substrate-wide siblings [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (6ad94f3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::aplicacao::PlacementStrategy, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, and crate::dep::DepList already carry, plus the peer [caixa_provedor::FerriteRuntime] Display-through-variant_slug route (f919cda) on the sibling caixa-provedor axis whose canonical projection is domain-named — closes the PathShapeViolation closed-set enum’s (as_str, Display, AsRef<str>) canonical-projection triple.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PathShapeViolation

impl From<&PathShapeViolation> for &'static str

Trait-idiomatic forward projection on PathShapeViolation from a borrowed input onto the &'static str axis — the borrowed-input companion to the paired owned-input [From<PathShapeViolation> for &'static str] impl immediately above. Routes byte-for-byte through the same substrate-primitive PathShapeViolation::as_str pub const fn accessor so every consumer that binds a &PathShapeViolation through the standard-library .into() / [From<&Self> for &'static str] axis (a PathShapeViolation::ALL.iter().map(<&'static str>::from).collect::<Vec<_>>() per-arm accept-set materializer — whose iterator over &'static [PathShapeViolation] yields &PathShapeViolation, not PathShapeViolation, so the owned-input From<PathShapeViolation> axis alone forces every call site through an explicit .copied() / dereference / Copy-bound restatement rather than the direct trait-idiomatic projection; a future generic <T: Copy + for<'a> Into<&'static str>>-bound diagnostic column over the substrate-wide closed-set typed-enum family that walks the iter().map(Into::into) shape verbatim; the future feira lint --explain-path-shape per-axis listing that composes the accepted-tag enumeration from an iterated PathShapeViolation::ALL.iter().map(|v| v.into()) pipe rather than a per-arm match v { … } cascade; a future HashMap::<&'static str, PathShapeViolation>::from_iter( PathShapeViolation::ALL.iter().map(|v| (v.into(), *v)))-style per-violation reverse-lookup table the sibling TryFrom<&str> impl cannot compose without this borrowed-input axis in place) reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical- kebab emit-set the paired owned-input [From<PathShapeViolation> for &'static str], the sibling std::fmt::Display, AsRef<str>, and PathShapeViolation::as_str surfaces already return.

Ninth peer on the substrate-wide trait-idiomatic borrowed-input forward-projection family opened on crate::dep::DepList (64aa742) and extended onto crate::CaixaKind (5ab993a), crate::CaixaDialeto (807b0b5), the paired M2 OTP-shape crate::supervisor::RestartStrategy (e941836) and crate::supervisor::RestartPolicy (842c7f3), and the M3 mesh-primitive slot enums crate::aplicacao::PlacementStrategy (4d941d8), crate::aplicacao::WitShape (3187bd0), and crate::aplicacao::RateLimitUnit (f4b9e6b — the third and last M3 mesh-primitive slot enum, closing the M3 arm of the campaign). Rust’s From trait does not auto-derive the From<&Self> sibling from a From<Self> impl (the blanket impl<T, U> From<&T> for U where T: Copy, U: From<T> does not exist in core), so every closed-set typed enum that carries the owned-input axis but not the borrowed- input axis forces every borrowed-input call site through a .copied() / <&'static str>::from(*violation) / violation.as_str() detour whose type bounds have no compile-time link to the substrate primitive. PathShapeViolation is the first outside-manifest-surface (render-side, path-shape-diagnostic) closed-set typed enum to converge onto the substrate-wide borrowed- input campaign — the M2 / M3 slot enums and the two-list dep-graph axis form the manifest-surface arm; this lift opens the render-side arm on the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant, on the same trajectory the paired owned-input axis lift (070a6de) already carried onto the same enum as the first-outside-manifest-surface peer on the owned axis.

Same three-path convergence discipline as the paired owned-input impl (this borrowed-input axis, the paired owned-input [From<PathShapeViolation> for &'static str], and PathShapeViolation::as_str all route through the same three-arm inline canonical-kebab byte-strings), so a future variant addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items PathShapeViolation::ALL and PathShapeViolation::as_str doc blocks already name) reaches every one of the six sibling forward- projection paths (std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, [From<Self> for &'static str], this [From<&Self> for &'static str], and the paired reverse TryFrom<&str> that dispatches on the same three inline canonical- kebab byte-strings by construction) through exactly one caixa-core edit on the PathShapeViolation::as_str pub const fn accessor.

The PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction — so the borrowed-input forward axis and the reverse TryFrom<&str> axis compose directly without the intermediate wire-vocab hop the peer crate::CaixaKind axis pair requires. The round-trip witness pin below locks this direct composition on the render-side path-shape-diagnostic enum’s trait-idiomatic axis pair.

Pinned load-bearing by [tests::path_shape_violation_from_borrowed_into_static_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set via a borrowed input, plus a const-context materialization witness for the &'static str lifetime promise, plus a blanket .into() shape) and [tests::path_shape_violation_from_owned_and_borrowed_into_static_str_agree_on_every_arm] (cross-axis partition pin against the paired owned-input [From<PathShapeViolation> for &'static str] impl, plus a .iter().map(Into::into) pipe witness over PathShapeViolation::ALL, plus a direct round-trip witness through TryFrom<&str> that closes the two-way &Self → &'static str → Self round-trip on the render-side path-shape-diagnostic enum’s trait-idiomatic axis pair without the wire-vocab intermediate the peer crate::CaixaKind axis pair requires).

fn from(violation: &PathShapeViolation) -> &'static str

Converts to this type from the input type.

impl From<&PathShapeViolation> for String

Trait-idiomatic borrowed-input, owned-String output forward projection on the render-side sandbox-escape three-arm path-shape- diagnostic PathShapeViolation closed-set typed enum — the fourth (and closing) corner of the substrate-wide {Self, &Self} × {&'static str, String} 2×2 trait-idiomatic projection family on this first outside-manifest-surface (render-side) closed-set typed enum. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor (via str::to_owned) so every consumer that holds a borrowed [&PathShapeViolation] and needs an owned String — a future serde_json::Value::String(String::from(&violation)) structured-payload composer over a borrowed field, a future Iterator::map over &[PathShapeViolation] that projects to owned keys through .iter().map(String::from) (whose iterator yields &PathShapeViolation, not PathShapeViolation, so the owned-input [From<PathShapeViolation> for String] axis alone forces every call site through an explicit .copied() / spurious Copy deref restatement rather than the direct trait-idiomatic projection), a future HashMap::<String, PathShapeViolation>::from_iter that keys off a borrowed-iteration axis where dereferencing the violation would force an unnecessary Copy at every step, the future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook rejection body composer that names the accepted-:path-shape enumeration through an iterated PathShapeViolation::ALL.iter().map(String::from).collect() pipe rather than a per-arm cascade, the future caixa-build pipeline’s per-slot path-gate structured-log emit whose borrowed-iteration axis over declared violations projects to owned keys by construction — reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-kebab byte-strings the paired std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, and the three other trait-idiomatic forward-projection impls ([From<PathShapeViolation> for &'static str], [From<&PathShapeViolation> for &'static str], [From<PathShapeViolation> for String]) already return.

Tenth peer on the substrate-wide trait-idiomatic borrowed-input, owned-String output forward-projection family opened on crate::supervisor::RestartStrategy (579385f), closed on the M2 OTP-shape sibling axis pair by crate::supervisor::RestartPolicy (8465740), extended onto the two-list dep-graph peer by crate::dep::DepList (e0cb617), onto the top-level crate::CaixaKind peer by (e76436d), the dialect-classification peer crate::CaixaDialeto (d3c0d1d), the M3 mesh-primitive crate::aplicacao::PlacementStrategy (d3dc000), crate::aplicacao::WitShape (d638fd3), and crate::aplicacao::RateLimitUnit (6424e45 — closing the whole M3 triple’s 2×2 corner). First outside-manifest-surface peer on this axis — the M2 / M3 slot enums, the two-list dep-graph axis, the top-level :kind axis, and the dialect-classification axis form the manifest-surface arm; this lift closes the 2×2 on the render- side arm, on the same trajectory the paired owned-input owned- String axis (6e0479a — the ninth peer) and the paired borrowed-input owned-[&'static str] axis (cdf4e95) already took onto the same enum.

Rust’s standard library does not carry a blanket impl<T: AsRef<str>> From<&T> for String (nor an impl<T: fmt::Display> From<&T> for String), so every closed-set typed enum that carries the paired AsRef<str> / Display / From<Self> for &'static str / From<&Self> for &'static str / From<Self> for String quintuple but not the borrowed-input owned-String axis forces every borrowed-input owned-string call site through a violation.as_str().to_owned() / String::from(*violation) (with a spurious Copy) / violation.to_string() (through std::fmt::Display) detour whose type bounds have no compile-time link to the substrate primitive.

Same three-path convergence discipline as the paired owned-input impl (this borrowed-input axis, the paired owned-input [From<PathShapeViolation> for String], and PathShapeViolation::as_str all route through the same three-arm inline canonical-kebab byte-strings), so a future variant addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace- hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items PathShapeViolation::ALL and PathShapeViolation::as_str doc blocks already name) reaches every one of the paired forward-projection paths through exactly one caixa-core edit on the PathShapeViolation::as_str pub const fn accessor.

The PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction — so the borrowed- input owned-String forward axis and the reverse TryFrom<&str> axis compose directly (via the owned-String’s String::as_str borrow) without the intermediate wire-vocab hop the peer crate::CaixaKind axis pair requires. The round-trip witness pin below locks this direct composition on the render-side path-shape-diagnostic enum’s borrowed-input owned-String axis pair.

Pinned load-bearing by [tests::path_shape_violation_from_into_borrowed_owned_string_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set through the borrowed-input surface) and [tests::path_shape_violation_from_into_borrowed_owned_string_agrees_with_paired_axes_on_every_arm] (cross-axis partition pin against the paired owned-input owned- String [From<PathShapeViolation> for String] impl, the paired borrowed-input owned-[&'static str] [From<&PathShapeViolation> for &'static str] impl, the paired owned-input owned-[&'static str] [From<PathShapeViolation> for &'static str] impl — every corner of the 2×2 — plus a .iter().map(String::from) pipe witness over PathShapeViolation::ALL (whose iterator yields &PathShapeViolation by construction, so the borrowed-input owned-String axis is what routes the pipe through the substrate-primitive PathShapeViolation::as_str accessor without a spurious Copy deref), plus a direct round-trip witness through TryFrom<&str> on the owned-String’s String::as_str borrow that closes the two-way &Self → String → Self round-trip on the trait-idiomatic borrowed-input owned-String forward + reverse axis pair — no intermediate wire-vocab hop like the peer crate::CaixaKind axis pair requires).

fn from(violation: &PathShapeViolation) -> String

Converts to this type from the input type.

impl From<&PathShapeViolation> for Cow<'static, str>

Trait-idiomatic borrowed-input, std::borrow::Cow<'static, str> output forward projection on the render-side sandbox-escape three-arm path-shape-diagnostic PathShapeViolation closed-set typed enum — the borrowed-input companion to the paired owned-input [From<PathShapeViolation> for std::borrow::Cow<'static, str>] impl immediately above (7342c32). Routes byte-for-byte through the same substrate-primitive PathShapeViolation::as_str pub const fn accessor (via std::borrow::Cow::Borrowed) so every consumer that holds a [&PathShapeViolation] and needs a std::borrow::Cow<'static, str> — a PathShapeViolation::ALL.iter().map(std::borrow::Cow::from).collect::<Vec<_>>() per-arm accept-set materializer whose iterator over &'static [PathShapeViolation] yields &PathShapeViolation (not PathShapeViolation, so the paired owned-input [From<PathShapeViolation> for std::borrow::Cow<'static, str>] axis alone forces every call site through an explicit .copied() / dereference / Copy-bound restatement rather than the direct trait-idiomatic projection), a future generic <T: for<'a> Into<std::borrow::Cow<'static, str>>>-bound emitter on a per-violation diagnostic column that walks the iter().map(Into::into) shape verbatim, a future M4 mesh.pleme.io/v1alpha1/Caixa CR materializer’s admission-webhook per-arm rejection-reason emitter that composes the accepted-path- shape-violation enumeration from an iterated PathShapeViolation::ALL.iter().map(|v| v.into()) pipe rather than a per-arm match v { … } cascade — reaches the same three "empty" / "absolute" / "parent-escape" lowercase-kebab byte- strings the paired std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, the four {Self, &Self} × {&'static str, String} 2×2 trait-idiomatic forward-projection corners, and the paired owned-input [From<PathShapeViolation> for std::borrow::Cow<'static, str>] impl already return.

Deliberately returns std::borrow::Cow::Borrowed rather than std::borrow::Cow::Owned — the substrate-primitive PathShapeViolation::as_str accessor’s return carries the &'static str lifetime by construction (each match arm resolves to an inline &'static str literal), so the zero-alloc borrowed arm is the type-correct projection with no runtime allocation on the borrowed-input surface just as on the paired owned-input surface.

Closes the {Self, &Self} input-shape corner on the third outside-M3 caixa-core peer (and the first outside-manifest-surface / render-side peer) of the substrate-wide std::borrow::Cow<'static, str> forward-projection campaign, opened one commit prior (7342c32) on the paired owned-input impl. Rust’s standard library does not carry a blanket impl<T: AsRef<str>> From<&T> for std::borrow::Cow<'static, str> (nor an impl<T: fmt::Display> From<&T> for std::borrow::Cow<'static, str>, nor a Copy-based impl<T: Copy, U: From<T>> From<&T> for U), so every closed-set fieldless typed enum peer on the substrate that carries the paired owned-input [Cow<'static, str>] axis but not the borrowed-input axis forces every borrowed-input [Cow<'static, str>]-parameterized call site through a spurious Copy deref (std::borrow::Cow::from(*violation)) or a std::borrow::Cow::Borrowed(violation.as_str()) open-code whose type bounds have no compile-time link to the substrate primitive.

Matches the closure discipline ebeb9e0 landed on the outside-M3 crate::CaixaDialeto axis one commit after 8322511, 702cdf4 on the two-list dep-graph crate::dep::DepList axis one commit after 6858bac, afdf0f4 on the M3-mesh-shape crate::aplicacao::PlacementStrategy one commit after eee504d, 25690ef on crate::aplicacao::WitShape one commit after 8634dec, 53346fb on crate::aplicacao::RateLimitUnit one commit after 1d59925 (closing the whole M3 mesh-shape tier), d45c409 on the top-level crate::CaixaKind one commit after 99c1735, and 9b3e4b3 / ee577fd on the M2 OTP-shape crate::supervisor::RestartStrategy / crate::supervisor::RestartPolicy sibling peers one commit after 7dd28b3 / 0612398. The remaining outside-caixa-core peers (InvariantKind, ArchVerdict, Severity, FixSafety, Semantic, FerriteRuntime) are the remaining future targets on the axis.

Unlike the peer crate::CaixaKind pair (whose forward emit lands on the lowercase Portuguese diagnostic vocabulary while the reverse parse lands on the PascalCase wire vocabulary, forcing the round-trip through an intermediate crate::CaixaKind::wire_name hop), PathShapeViolation is a render-side diagnostic axis with no wire/diagnostic vocabulary split — the PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction, so the borrowed-input std::borrow::Cow<'static, str> projection this impl exposes composes directly with the paired trait-idiomatic reverse TryFrom<&str> axis on the projection’s std::borrow::Cow::as_ref borrow — no intermediate wire-vocab hop required.

Pinned load-bearing by [tests::path_shape_violation_from_borrowed_into_static_cow_str_routes_through_as_str_accessor] (byte-parity + zero-alloc std::borrow::Cow::Borrowed-arm pin against PathShapeViolation::as_str across the three-arm PathShapeViolation::ALL through the borrowed-input surface, plus a blanket-derived Into<std::borrow::Cow<'static, str>> shape witness that also lands on std::borrow::Cow::Borrowed) and [tests::path_shape_violation_from_borrowed_into_static_cow_str_agrees_with_paired_axes_on_every_arm] (cross-axis partition pin against the paired owned-input [From<PathShapeViolation> for std::borrow::Cow<'static, str>], the paired borrowed-input owned-&'static str [From<&PathShapeViolation> for &'static str], and the paired borrowed-input owned-String [From<&PathShapeViolation> for String] impls plus ToString::to_string-through- std::fmt::Display, a .iter().map(std::borrow::Cow::from) pipe witness over PathShapeViolation::ALL — whose iterator yields &PathShapeViolation by construction, so the borrowed-input axis is what routes the pipe without a spurious Copy deref and every collected element satisfies the zero-alloc std::borrow::Cow::Borrowed-arm predicate — plus a direct round- trip witness through TryFrom<&str> on the projection’s std::borrow::Cow::as_ref borrow that closes the two-way &Self → Cow<'static, str> → Self round-trip on the borrowed-input axis without the wire-vocab intermediate hop the peer crate::CaixaKind axis pair requires).

fn from(violation: &PathShapeViolation) -> Cow<'static, str>

Converts to this type from the input type.

impl From<PathShapeViolation> for &'static str

Standard-library trait-idiomatic forward projection on the PathShapeViolation closed-set typed enum. Routes byte-for-byte through the paired substrate-primitive PathShapeViolation::as_str pub const fn accessor so <&'static str>::from(violation) / violation.into::<&'static str>() reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-kebab emit-set the sibling method-named accessor dispatches through and the sibling [std::fmt::Display for PathShapeViolation] / [AsRef<str> for PathShapeViolation] impls also route through.

Extends the substrate-wide closed-set-enum trait-idiomatic forward-projection family (crate::supervisor::RestartStrategy via 523157d, crate::supervisor::RestartPolicy via 9fb37d0, crate::CaixaKind via edb827b, crate::CaixaDialeto via c189a6f, crate::aplicacao::PlacementStrategy via afa3562, crate::aplicacao::WitShape via 56998ec, crate::aplicacao::RateLimitUnit via 7fdfbf4) onto the first render-side path-shape-diagnostic closed-set enum on the caixa surface — the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant. Closes the trait- idiomatic forward-projection family on the caixa-core-side closed-set fieldless typed-enum surface — every caixa-core enum that already carries the paired trait-idiomatic reverse projection TryFrom<&str> now also carries the trait-idiomatic forward projection, so a downstream impl From<T> for &'static str-bound generic consumer reaches every caixa-core closed-set enum through one uniform trait dispatch.

Pairs with the sibling [TryFrom<&str> for PathShapeViolation] impl (e67e48a) to close the two-way Self ↔ &'static str round-trip on the trait-idiomatic axis pair, mirroring the pre-existing method-named PathShapeViolation::as_str + PathShapeViolation::from_wire pair on the substrate-primitive axis pair.

Return type is &'static str by construction — every PathShapeViolation::as_str arm resolves to an inline "empty" / "absolute" / "parent-escape" &'static str literal, so the trait’s return-type promise is upheld structurally without a String::leak cast or a per-arm inline literal outside the paired PathShapeViolation::as_str dispatch.

The paired PathShapeViolation::as_str accessor’s three-arm emit-set is the single source of truth — every future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items the sibling PathShapeViolation::ALL doc block already names) grows the trait-idiomatic forward axis by construction: one caixa-core edit on PathShapeViolation::as_str extends every one of the sibling forward-projection paths (std::fmt::Display, AsRef<str>, PathShapeViolation::as_str itself, and this [From<Self> for &'static str]) without a coordinated rewrite across every future Into<&'static str>-bound consumer’s arm-set.

Pinned load-bearing by [tests::path_shape_violation_from_into_static_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set, plus a const-context materialization witness for the &'static str lifetime promise routed through the paired PathShapeViolation::as_str pub const fn accessor, plus a paired .into() shape assertion covering the blanket-derived Into<&'static str> shape) and [tests::path_shape_violation_from_into_static_str_and_as_str_partition_the_emit_set] (partition pin asserting <&'static str as From<PathShapeViolation>>::from and PathShapeViolation::as_str agree on every arm, plus a two-way direct round-trip witness through the paired trait-idiomatic TryFrom<&str> axis that closes the two-way Self ↔ &'static str round-trip on the trait-idiomatic axis pair — the emit-side PathShapeViolation::as_str and the parse-side PathShapeViolation::from_wire dispatch on the same three inline canonical-kebab byte-strings by construction, so round-tripping composes the two trait impls directly).

fn from(violation: PathShapeViolation) -> &'static str

Converts to this type from the input type.

impl From<PathShapeViolation> for String

Trait-idiomatic owned-String forward projection on the render-side path-shape-diagnostic closed-set typed enum PathShapeViolation — the owned-heap-string companion to the paired [&'static str]-returning [From<PathShapeViolation> for &'static str] / [From<&PathShapeViolation> for &'static str] impls immediately above, extending the owned-input owned-String arm of the substrate-wide {Self, &Self} × {&'static str, String} 2×2 trait-idiomatic projection family onto the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor (via str::to_owned) so every consumer that binds a PathShapeViolation through the standard-library .into() / [From<Self> for String] (equivalently Into<String>) axis — a future serde_json::Value::String(violation.into()) structured-payload composer where the Value::String arm typing demands an owned String and the sibling [&'static str]-returning axes force an explicit .to_owned() / String::from restatement at every call site, a future HashMap::<String, PathShapeViolation>::from_iter( PathShapeViolation::ALL.iter().map(|v| (String::from(*v), *v))) per-violation lookup where the map’s key type is owned String rather than [&'static str], a future Cow::<'static, str>::Owned(violation.into()) composer on a future M4 mesh.pleme.io/v1alpha1/Caixa CR materializer’s admission-webhook rejection body’s owned-arm, the future caixa-build pipeline’s per-slot path-gate serde_json::json!({ "violation": violation }) structured-log emit where the JSON serializer’s [Serialize] impl on String owns the emit-path — reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-kebab emit-set the paired std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, and the two [&'static str]-returning forward-projection impls already return.

Ninth peer on the substrate-wide trait-idiomatic owned-String forward-projection family opened on crate::supervisor::RestartStrategy (7baa18a) and extended onto crate::supervisor::RestartPolicy (7851725), crate::CaixaKind (231a18c), crate::CaixaDialeto (88942cd), crate::dep::DepList (32b0ee8), crate::aplicacao::PlacementStrategy (1154c2f), crate::aplicacao::WitShape (79a8723), and crate::aplicacao::RateLimitUnit (c7d687d — the third and last M3 mesh-primitive slot enum on the manifest-surface arm). Rust’s standard library does not carry a blanket impl<T: AsRef<str>> From<T> for String (nor an impl<T: fmt::Display> From<T> for String), so every closed-set typed enum that carries the paired AsRef<str> / Display / From<Self> for &'static str / From<&Self> for &'static str quadruple but not the owned-String axis forces every owned-string call site through a .to_string() / .as_str().to_owned() / String::from(violation.as_str()) detour whose type bounds have no compile-time link to the substrate primitive. PathShapeViolation is the first outside-manifest-surface (render-side, path-shape-diagnostic) closed-set typed enum to converge onto the owned-String arm of the campaign — the M2 / M3 slot enums and the two-list dep-graph axis form the manifest-surface arm; this lift opens the render-side arm on the sandbox-escape three-arm accept-set on the same trajectory the paired borrowed- input &'static str axis lift (cdf4e95) already took.

Same three-path convergence discipline as the paired [&'static str]-returning impls (this owned-String axis, the paired [From<PathShapeViolation> for &'static str], the paired [From<&PathShapeViolation> for &'static str], and PathShapeViolation::as_str all route through the same three-arm inline canonical-kebab byte-strings), so a future variant addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items PathShapeViolation::ALL and PathShapeViolation::as_str doc blocks already name) reaches every one of the sibling forward- projection paths through exactly one caixa-core edit on the PathShapeViolation::as_str pub const fn accessor.

The PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction — so the owned-input owned-String forward axis and the reverse TryFrom<&str> axis compose directly (via the owned-String’s String::as_str borrow) without the intermediate wire-vocab hop the peer crate::CaixaKind axis pair requires. The round-trip witness pin below locks this direct composition on the render-side path-shape-diagnostic enum’s owned-String axis pair.

Pinned load-bearing by [tests::path_shape_violation_from_into_owned_string_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set via the owned-String surface) and [tests::path_shape_violation_from_into_owned_string_and_static_str_agree_on_every_arm] (cross-axis partition pin against the paired owned-input [&'static str]-returning [From<PathShapeViolation> for &'static str] impl and the sibling ToString::to_string surface routed through std::fmt::Display, plus a .iter().copied().map(String::from) pipe witness over PathShapeViolation::ALL, plus a direct round-trip witness through the paired trait-idiomatic reverse TryFrom<&str> axis on the owned-String’s String::as_str borrow that closes the two-way Self → String → Self round-trip on the render-side path-shape-diagnostic enum’s owned-String axis pair without the wire-vocab intermediate the peer crate::CaixaKind axis pair requires).

fn from(violation: PathShapeViolation) -> String

Converts to this type from the input type.

impl From<PathShapeViolation> for Cow<'static, str>

Trait-idiomatic owned-input, std::borrow::Cow<'static, str> output forward projection on the render-side sandbox-escape three-arm path-shape-diagnostic PathShapeViolation closed-set typed enum — routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor (via std::borrow::Cow::Borrowed) so every consumer that binds a PathShapeViolation through the standard-library .into() / [From<Self> for std::borrow::Cow<'static, str>] (equivalently Into<std::borrow::Cow<'static, str>>) axis — a future axum::response::IntoResponse body composer whose typing folds a per-arm rejection line into a std::borrow::Cow<'static, str> boundary, a future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook rejection body composer whose typing rules out the sibling AsRef<str> borrowed return and the sibling [From<Self> for &'static str] axis’s non-std::borrow::Cow- parameterized shape, a future substrate-wide per-arm diagnostic surface that folds either the zero-alloc std::borrow::Cow::Borrowed arm (for the closed-set arms whose byte-string is inline-lifted) or the std::borrow::Cow::Owned arm (for a caller that mutates the projection) through one uniform trait dispatch, a future generic <T: Into<std::borrow::Cow<'static, str>>>-bound emitter on a per-path-shape structured-log or admission-webhook rejection body — reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-kebab byte-strings the paired std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, and the four {Self, &Self} × {&'static str, String} 2×2 trait- idiomatic forward-projection corners ([From<PathShapeViolation> for &'static str], [From<&PathShapeViolation> for &'static str], [From<PathShapeViolation> for String], [From<&PathShapeViolation> for String]) already return, rather than an open-coded per-call-site std::borrow::Cow::Borrowed(violation.as_str()) / std::borrow::Cow::Owned(violation.to_string()) / String::from(violation).into() composition whose type bounds have no compile-time link back to the substrate primitive.

Deliberately returns std::borrow::Cow::Borrowed rather than std::borrow::Cow::Owned — the substrate-primitive PathShapeViolation::as_str accessor’s return carries the &'static str lifetime by construction (each match arm resolves to an inline "empty" / "absolute" / "parent-escape" &'static str literal with static lifetime), so the zero-alloc borrowed arm is the type-correct projection with no runtime allocation. The paired std::borrow::Cow::Owned arm stays reachable at the call site through the existing [From<PathShapeViolation> for String] axis composed with std::borrow::Cow::from on the resulting owned String — a caller who chose to mutate the projection lands on the owned arm by their own composition, not by the substrate-primitive projection silently allocating on their behalf.

Ninth peer on the substrate-wide trait-idiomatic std::borrow::Cow<'static, str> forward-projection family opened on the top-level crate::CaixaKind by 99c1735 (closed on the {Self, &Self} input-shape corner by d45c409), extended onto the M2 OTP-shape tier by 7dd28b3 / 9b3e4b3 (opens/closes on crate::supervisor::RestartStrategy) and 0612398 / ee577fd (opens/closes on crate::supervisor::RestartPolicy, closing the M2 OTP-shape tier), extended onto the M3 mesh-shape tier by 8634dec / 25690ef (opens/closes on crate::aplicacao::WitShape), eee504d / afdf0f4 (opens/closes on crate::aplicacao::PlacementStrategy), and 1d59925 / 53346fb (opens/closes on crate::aplicacao::RateLimitUnit, closing the M3 mesh-shape tier), extended onto the outside-M3 caixa-core tier by 6858bac / 702cdf4 (opens/closes on crate::dep::DepList) and 8322511 / ebeb9e0 (opens/closes on crate::CaixaDialeto) — extends the axis onto the render-side sandbox-escape three-arm path-shape-diagnostic PathShapeViolation closed-set fieldless typed enum (the third outside-M3 caixa-core peer, and the first outside-manifest-surface / render-side peer on this axis — the M2 / M3 slot enums, the two-list dep-graph axis, the top-level :kind axis, and the dialect-classification axis form the manifest-surface arm; this lift opens the render-side arm, on the same trajectory the paired [&'static str]-returning owned-input axis (070a6de) and the paired owned-input owned-String axis (6e0479a) already took onto the same enum). Rust’s standard library does not carry a blanket impl<T: AsRef<str>> From<T> for std::borrow::Cow<'static, str> (nor an impl<T: fmt::Display> From<T> for std::borrow::Cow<'static, str>), so every closed-set fieldless typed enum peer on the substrate that carries the paired AsRef<str> / std::fmt::Display / [From<Self> for &'static str] / [From<&Self> for &'static str] / [From<Self> for String] / [From<&Self> for String] sextet but not the std::borrow::Cow<'static, str> axis forces every std::borrow::Cow<'static, str>-parameterized call site through a std::borrow::Cow::Borrowed(violation.as_str()) / std::borrow::Cow::Owned(violation.to_string()) / String::from(violation).into() detour whose type bounds have no compile-time link to the substrate primitive.

The remaining outside-caixa-core closed-set fieldless typed enum peers on the substrate surface (InvariantKind, ArchVerdict, Severity, FixSafety, Semantic, FerriteRuntime) are the future targets of this campaign — each carries the same paired sextet that this axis extends onto.

Unlike the peer crate::CaixaKind pair (whose forward emit lands on the lowercase Portuguese diagnostic vocabulary while the reverse parse lands on the PascalCase wire vocabulary, forcing the round-trip through an intermediate crate::CaixaKind::wire_name hop), PathShapeViolation is a render-side diagnostic axis with no wire/diagnostic vocabulary split — the PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction, so the std::borrow::Cow<'static, str> projection this impl exposes composes directly with the paired trait-idiomatic reverse TryFrom<&str> axis on the projection’s std::borrow::Cow::as_ref borrow — no intermediate wire-vocab hop required.

Pinned load-bearing by [tests::path_shape_violation_from_into_static_cow_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set through the std::borrow::Cow<'static, str> surface, plus a std::borrow::Cow::Borrowed discriminator witness that the projection lands on the zero-alloc arm rather than silently allocating through std::borrow::Cow::Owned, plus a blanket- derived Into<std::borrow::Cow<'static, str>> shape witness that also lands on std::borrow::Cow::Borrowed) and [tests::path_shape_violation_from_into_static_cow_str_agrees_with_paired_axes_on_every_arm] (cross-axis partition pin against the paired owned-input [From<PathShapeViolation> for &'static str] and [From<PathShapeViolation> for String] forward-projection corners plus the sibling ToString::to_string-through-std::fmt::Display surface, plus a .iter().copied().map(std::borrow::Cow::from) pipe witness over PathShapeViolation::ALL whose zero-alloc std::borrow::Cow::Borrowed outcome is load-bearing on every arm, plus a direct round-trip witness through TryFrom<&str> on the projection’s std::borrow::Cow::as_ref borrow that closes the two-way Self → Cow<'static, str> → Self round-trip on the trait- idiomatic std::borrow::Cow<'static, str> forward + reverse axis pair without the wire-vocab intermediate hop the peer crate::CaixaKind axis pair requires).

fn from(violation: PathShapeViolation) -> Cow<'static, str>

Converts to this type from the input type.

impl Hash for PathShapeViolation

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for PathShapeViolation

fn eq(&self, other: &PathShapeViolation) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for PathShapeViolation

impl TryFrom<&str> for PathShapeViolation

Trait-idiomatic reverse projection on the PathShapeViolation closed-set render-side path-shape-diagnostic axis — routes byte-for-byte through the paired substrate-primitive PathShapeViolation::from_wire Option<Self> accessor so every future consumer that binds a canonical path-shape-violation tag through the standard-library .try_into() / TryFrom axis (a future feira lint --explain-path-shape=<empty|absolute|parent-escape> CLI arg-parse that composes into let axis: PathShapeViolation = s.try_into()?, a future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook rejection-body parser that folds a prior audit’s spec.pathShape: String through PathShapeViolation::try_from(&s)?, a generic <T: TryFrom<&str>>-bound loader over any of the substrate’s closed-set typed enums) reaches the same three-arm accept-set the sibling PathShapeViolation::from_wire resolver parses through and the sibling PathShapeViolation::as_str emits, rather than an open-coded per-arm match s { "empty" => …, "absolute" => …, "parent-escape" => …, _ => … } cascade whose arm-set has no compile-time link back to the substrate primitive.

Complements the pre-existing forward-projection triple (std::fmt::Display, AsRef<str>, PathShapeViolation::as_str) with the paired trait-idiomatic reverse-projection axis: Rust-side newtype/typed-enum convention pairs AsRef<str> with either std::str::FromStr or TryFrom<&str> on the same primitive so a caller who can project out to a &str can also project in from one. The TryFrom<&str> axis is deliberately chosen over std::str::FromStr to sidestep the clippy::should_implement_trait lint the sibling method-named PathShapeViolation::from_wire would trigger under a FromStr impl (the same design tradeoff the peer crate::CaixaKind (3c83606), crate::CaixaDialeto (bf33136), crate::aplicacao::PlacementStrategy (6fd00cd), crate::supervisor::RestartStrategy (5b828ed), crate::supervisor::RestartPolicy (6fdd0d9), crate::aplicacao::WitShape (5472902), and crate::aplicacao::RateLimitUnit (bf78400) blocks note) — this impl closes the trait-idiomatic reverse axis without disturbing the method-named from_wire shape every peer closed-set typed enum already carries.

type Error = () matches the sibling PathShapeViolation::from_wire’s Option<Self> return-shape’s deliberate deferral of error typing: the caller picks the diagnostic form appropriate for its use site (a future feira lint --explain-path-shape CLI arg-parse composes its own per-verb “unknown path-shape axis: — accepted: {…}” message enumerating PathShapeViolation::ALL, a future M4 admission-webhook rejection body wraps the Err(()) outcome with the accepted-set enumeration for operator diagnostics, a Result::map_err at the call site lifts the axis-error to a per-verb error type). Same shape the peer sibling reverse-projection axes carry.

The paired TryFrom<&str> impl reaches the same three-arm accept-set the PathShapeViolation::from_wire resolver dispatches through, so any future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items the sibling PathShapeViolation::ALL doc block already names) grows the trait-idiomatic axis by construction: one caixa-core edit on PathShapeViolation::from_wire extends both the method-named reverse projection every existing consumer keys off and the trait-idiomatic reverse projection this impl exposes, without a coordinated rewrite across every future TryFrom<&str>-bound consumer’s arm-set.

Extends the substrate-wide closed-set-enum trait-idiomatic reverse-projection family (crate::CaixaKind via 3c83606, crate::CaixaDialeto via bf33136, crate::aplicacao::PlacementStrategy via 6fd00cd, crate::supervisor::RestartStrategy via 5b828ed, crate::supervisor::RestartPolicy via 6fdd0d9, crate::aplicacao::WitShape via 5472902, and crate::aplicacao::RateLimitUnit via bf78400) onto the first render-side path-shape-diagnostic closed-set enum on the caixa surface — the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant.

Pinned load-bearing by [tests::path_shape_violation_try_from_str_routes_through_from_wire_accessor] (byte-parity pin against PathShapeViolation::from_wire across the three-arm accept-set) and [tests::path_shape_violation_try_from_str_rejects_unknown_byte_strings] (rejection witness against silent accept-set widening).

type Error = ()

The type returned in the event of a conversion error.

fn try_from(s: &str) -> Result<Self, Self::Error>

Performs the conversion.