Enum PathShapeViolation 

pub enum PathShapeViolation {
    Empty,
    Absolute,
    ParentEscape,
}

Tagged reason a caixa-author-supplied path can fail the sandboxed-relative shape gate every callback / script path must pass for the layout checker’s root.join(p) to stay inside the caixa root.

Returned by is_sandboxed_relative_path so each per-axis caller — crate::BehaviorSpec::validate on :behavior :on-* paths (b0c8389), crate::UpgradeInstruction::validate’s StateChange arm on :upgrade-from :state-change :script (26da2c7), every future axis admitting a user-supplied path — match-and-wraps the tag into its own typed *Invalid { slot, path } enum variant so the diagnostic still names which slot carried the malformed value. The tag is axis-agnostic; the wrapping per-axis variant carries the slot identity.

Sibling discriminator-style of the per-arm reason substrings every value-shape predicate already exposes (is_dns_1123_label, is_gateway_api_http_path, …) — but typed rather than string- shaped, because the per-axis variants for path violations were already split three ways (EmptyPath / AbsolutePath / ParentEscape in BehaviorError; EmptyScript / AbsoluteScript / ParentEscapeScript in UpgradeError), so collapsing them to a single *PathInvalid { reason } variant would regress the diagnostic shape rather than preserve it.

Variants

Empty

The path string is empty — PathBuf::new() or the canonical “I declared the slot but left the value blank” authoring footgun. root.join(PathBuf::new()) resolves to root itself, silently pointing the runtime’s LisleLoader at the project root rather than a file.

Absolute

The path is absolute — Path::join replaces the base with an absolute right-hand side, so root.join("/etc/passwd") resolves to "/etc/passwd" and escapes the project sandbox entirely. The Lunatic-style sandbox discipline (theory/INSPIRATIONS.md §III.1) requires every author-supplied path to live under the caixa root.

ParentEscape

The path contains a Component::ParentDir component anywhere — root.join("../sibling/x") traverses above the caixa root, the same sandbox-escape vector via parent-directory traversal. Caught regardless of where the .. component sits (leading, mid-path, trailing) so a future relaxation that only checks one position surfaces at this one predicate.

Implementations

impl PathShapeViolation

pub const fn is_empty(&self) -> bool

pub const fn is_absolute(&self) -> bool

pub const fn is_parent_escape(&self) -> bool

impl PathShapeViolation

pub const ALL: &'static [Self]

Exhaustive iteration surface for every consumer that walks the closed three-arm PathShapeViolation discriminator set — the paired byte-parity pin on the gen_platform::IsVariant-derived per-arm is_* predicate family, a future feira lint --explain-path-shape=<axis> per-arm listing of the accepted violation kinds, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, any future property-test harness that sweeps every arm to compute per-arm diagnostic coverage. A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) extends this slice as one edit and every consumer picks up the new entry by construction; the compiler-checked exhaustiveness on the sibling match arms in is_sandboxed_relative_path and require_sandboxed_lisp_path is the build-time guarantee that no arm forgets to grow.

Peer of the sibling closed-set fieldless typed enums’ crate::CaixaKind::ALL (6b1f4fb) / crate::CaixaDialeto::ALL (dd4f541) / crate::aplicacao::PlacementStrategy::ALL (18c7342) / crate::aplicacao::RateLimitUnit::ALL (6bce03d) / crate::dep::DepList::ALL (45ee563) / crate::supervisor::RestartStrategy::ALL (4eec29c) / crate::supervisor::RestartPolicy::ALL (dd32ccf) exhaustive-iteration surfaces — the tenth closed-set typed enum on the caixa surface to converge onto the same one-canonical-arm-list-per-enum discipline, and the first render-side path-shape-diagnostic axis (as distinct from an OTP-shape M2 slot or an M3 mesh slot) to reach it. Order matches variant declaration order verbatim (Empty → Absolute → ParentEscape) so the slice is the canonical ordering every exhaustive dispatch site (the Empty → Absolute → ParentEscape arm-ordering is_sandboxed_relative_path and every per-axis caller in crate::manifest::ManifestError preserve for diagnostic-precedence continuity) defers to.

pub const WIRE_NAMES: &'static [&'static str]

Substrate-canonical exhaustive accept-set on the PathShapeViolation lowercase-kebab wire-form byte-string axis — the closed three-arm roster of every byte-string Self::as_str returns, routed byte-for-byte through the paired RENDER_PATH_SHAPE_VIOLATION_WIRE_EMPTY / RENDER_PATH_SHAPE_VIOLATION_WIRE_ABSOLUTE / RENDER_PATH_SHAPE_VIOLATION_WIRE_PARENT_ESCAPE lifted pub const scalars the Self::as_str emitter (and the std::fmt::Display / AsRef<str> / From<{Self,&Self}> for {&'static str, String, Cow<'static, str>, Box<str>, Arc<str>} trait triple + quintuple routed through it) walks — and byte-for-byte the same three strings the paired Self::from_wire and TryFrom<&str> reverse projections accept.

Peer of the sibling crate::CaixaKind::WIRE_NAMES (bd708bd) / crate::supervisor::RestartStrategy::WIRE_NAMES (3033f45) / crate::supervisor::RestartPolicy::WIRE_NAMES (ce9412b) / crate::aplicacao::PlacementStrategy::WIRE_NAMES (3e5b194) rosters on the PascalCase wire byte-string axis, the sibling crate::CaixaKind::LABELS (427fe75) / crate::aplicacao::WitShape::LABELS (9d9f585) rosters on the lowercase-kebab census-label axis, the sibling crate::aplicacao::RateLimitUnit::SUFFIXES (b553ec9) roster on the single-char canonical-suffix axis, the sibling crate::upgrade::UpgradeInstruction::LISP_FORMS (1898d77) / crate::upgrade::UpgradeInstruction::WIRE_FORMS (cc42c0e) rosters on the OTP-appup two-axis roster split, and the sibling crate::dep::DepList::AUTHOR_KEYS (af6ad3a) roster on the two-list dep-graph axis — the same closed-set exhaustive-accept- set roster discipline extended here onto the first render-side path-shape-diagnostic closed-set typed enum, the tenth substrate-side closed-set typed enum on the roster axis and the first outside the top-level manifest surface to converge onto the discipline. The sibling crate::dialeto::CaixaDialeto closed-set typed enum on the tatara-lisp dialect axis remains the next natural peer, still carrying only crate::dialeto::CaixaDialeto::ALL.

Downstream consumers of the closed accepted-wire-form set — a future feira lint --explain-path-shape=<empty|absolute|parent-escape> CLI-side “did you mean” hint whose candidate-list must byte-match the wire byte-string Self::as_str emits (rather than the PascalCase source-side variant name), a future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook rejection body’s per-slot path-gate enumeration of the accepted-violation- tag set on an unknown-slug miss, a future feira lint --explain path-shape per-arm listing whose per-slot histogram column walks the roster to render every arm’s tally (including zero-count arms — a hand-rolled projection off Self::ALL alone would need a companion per-variant-to-tag map at every consumer; this roster closes the two-axis walk in one lifted const), a future tracing::field::valuable::Value::List structured-log accepted-wire-form emit on the caixa-build pipeline’s per-slot path-gate emission path — now reach for one lifted substrate-primitive roster rather than open-coding a three-string array literal (["empty", "absolute", "parent-escape"]) whose arm-set has no compile-time link back to the typed PathShapeViolation enum. A future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items the sibling Self::ALL and Self::from_wire doc blocks already name) extends this roster as a single edit — paired with the Self::as_str match’s compiler-checked exhaustiveness on the new arm — and every consumer picks up the new wire form by construction.

Length is pinned load-bearing at PathShapeViolation::ALL.len() (three) by [tests::path_shape_violation_wire_names_covers_every_arm], every variant’s Self::as_str projection is pinned to a member of the roster so a silent skew between the emitter’s arm-set and this const’s arm-set trips at caixa-core test time rather than at a downstream consumer’s accepted-set enumeration miss, every entry is pinned to open with a lowercase ASCII byte (matching the substrate-wide kebab-slug convention every peer closed-set enum whose canonical projection is a lowercase-kebab tag carries), and the roster’s declaration order is pinned byte-for-byte against the variant declaration order (Empty → Absolute → ParentEscape) so a future arm-swap on the roster or the paired RENDER_PATH_SHAPE_VIOLATION_WIRE_* constants trips at caixa-core test time under assert_eq! rather than at a downstream per-slot diagnostic-precedence table’s ordering miss.

pub const fn as_str(self) -> &'static str

Substrate-canonical per-PathShapeViolation lowercase-kebab-tag scalar accessor every consumer that renders the three-arm path-shape violation axis as user-facing text keys off — returns the per-arm byte-string ("empty" / "absolute" / "parent-escape") as a &'static str, the same lowercase tags a future feira lint --explain-path-shape=<axis> per-arm listing, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, or a tracing::field::Value::Str-arm structured-log recorder on the caixa-build pipeline’s per-slot path-gate emission path would have otherwise reached via a format!("{:?}", violation).to_lowercase() round-trip through the std::fmt::Debug derive — with two silent drift footguns the substrate-canonical accessor closes at build time:

• the std::fmt::Debug derive’s per-arm output is not a stability guarantee (Rust’s own convention gives it as no guarantee at all), so a #[derive(Debug)] swap for a hand-rolled impl Debug that pretty-prints the arm with per-arm context ("Empty(no path supplied)", "Absolute(escapes sandbox)", "ParentEscape(traverses above root)") would silently reroute every diagnostic tag through a stale byte-string with no downstream signal until an operator scrolled the feira lint / feira build terminal output;
• format!("{:?}", violation).to_lowercase() also collapses ParentEscape to "parentescape" rather than the kebab-case "parent-escape" every other substrate-side kebab-slug axis (the sibling [caixa_provedor::FerriteRuntime::variant_slug]-emitted "ferrite-safe" / "ferrite-arena" tags, the crate::CaixaKind::as_str-emitted lowercase-single-word kind tags) already carries — allocating a fresh String per render pass on top of the tag drift.

Peer of the sibling substrate-wide closed-set fieldless typed- enum canonical-lowercase-tag scalar accessors [caixa_arch::ArchVerdict::as_str] (f3da79b — the paired proof-outcome axis on the sibling caixa-arch closed-set enum), [caixa_arch::InvariantKind::as_str] (87c875a — the sibling caixa-arch severity axis), [caixa_lint::Severity::as_str] / [caixa_lint::FixSafety::as_str] (72782f7 — caixa-lint), crate::CaixaKind::as_str / crate::CaixaDialeto::as_str / crate::CaixaVersion::as_str, and the sibling M2/M3 caixa-core closed-set typed-enum as_str family (crate::supervisor::RestartStrategy::as_str / crate::supervisor::RestartPolicy::as_str / crate::aplicacao::PlacementStrategy::as_str / crate::aplicacao::RateLimitUnit::as_suffix / crate::dep::DepList::as_str) — extends the substrate-wide “one canonical lowercase-tag accessor per closed-set fieldless typed enum” discipline onto the caixa-core render-side path-shape-diagnostic axis, the first render-side path-shape- diagnostic closed-set enum to reach it.

pub const fn — matches the sibling gen_platform::IsVariant-derive-generated per-arm is_* predicates’ const fn posture, so every future substrate-side const-context consumer (a const _: () = assert!(…) module- scope pin on a per-fixture typed PathShapeViolation, a future const fn per-violation rejection-body composer, a compile-time HashMap<&'static str, _>-shaped per-violation policy table) reaches the paired byte-string through one substrate-primitive dispatch at compile time as at runtime.

A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) reaches the paired std::fmt::Display impl + AsRef<str> impl + every downstream .as_str() consumer through one match-arm edit here, not a coordinated rewrite of every open-coded format!("{:?}", …) re-inlining. Named as_str (not label / tag / slug) to match the sibling closed-set-enum as_str convention the substrate already carries verbatim across every peer typed enum whose canonical projection is a plain &'static str (as distinct from the sibling [caixa_provedor::FerriteRuntime::variant_slug] and crate::WitTarget::label domain-named projections on enums carrying a paired non-string projection axis).

pub fn from_wire(s: &str) -> Option<Self>

Substrate-canonical reverse projection on the PathShapeViolation closed-set render-side path-shape-diagnostic axis — parses the lowercase-kebab per-arm byte-string Self::as_str emits back to the typed variant, or None when s is outside the closed three-arm accept-set ("empty" / "absolute" / "parent-escape"). Walks exactly the same three byte-strings the sibling Self::as_str forward emitter returns, so the parse and emit halves of the round-trip migrate through one caixa-core edit on any future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes): the compiler-checked exhaustiveness on Self::as_str’s match self arms and the round-trip pin [tests::path_shape_violation_from_wire_accepts_every_as_str_output] together lock the two halves mutually.

Prior to this lift the substrate carried only the forward Self → &str projection on the path-shape-violation axis (the Self::as_str emitter, the paired std::fmt::Display impl routed through it, the paired AsRef<str> impl routed through it) — every future consumer that wanted to promote the render- side path-shape-violation tag back to the typed enum (a future feira lint --explain-path-shape=<empty|absolute|parent-escape> CLI arg-parse that binds the wire byte-string into the typed enum before dispatching to the per-arm listing body, a future M4 mesh.pleme.io/v1alpha1/Caixa CR materializer’s admission- webhook rejection-body parser that re-binds a prior audit’s Self::as_str output to the typed enum before threading it into the per-slot diagnostic-precedence table, a future tracing::field::Value::Str-arm structured-log re-loader that hydrates a prior caixa-build pipeline’s per-slot path-gate emission back to the typed enum for cross-run violation-histogram diff) would have had to re-inline a three- arm match s cascade that expressed no compile-time link back to the typed PathShapeViolation enum.

Same closed-set-reverse-projection discipline the sibling crate::CaixaKind::from_wire (2aa6d23), crate::CaixaDialeto::from_wire (d0e65ea), crate::supervisor::RestartStrategy::from_wire (4eec29c), crate::supervisor::RestartPolicy::from_wire (dd32ccf), crate::aplicacao::PlacementStrategy::from_wire (18c7342), crate::dep::DepList::from_wire (45ee563), and [caixa_arch::InvariantKind::from_wire] (b9e4e61) typed enums carry on the peer wire-side str → Self axes — extends the substrate-wide (as_str, from_wire) round-trip family onto the caixa-core render-side path-shape-diagnostic closed-set enum (the first render-side path-shape-diagnostic axis to reach it), matching the same two-way str ↔ Self round-trip every sibling closed-set enum already carries. Method-named from_wire (not from_str) to match the peer shapes verbatim and side-step a clippy::should_implement_trait lint that a plain from_str name would otherwise trigger without paired std::str::FromStr impl scaffolding this axis does not carry today. Returns Option<Self> (rather than Result<Self, _>) to match the peer shapes: the caller picks the diagnostic form appropriate for its use site (a feira lint --explain-path-shape CLI arg-parse renders its own per-verb error message; an admission-webhook rejection body wraps the None outcome with the accepted-set enumeration PathShapeViolation::ALL.iter(). map(PathShapeViolation::as_str) for operator diagnostics).

Trait Implementations

impl AsRef<[u8]> for PathShapeViolation

Trait-idiomatic byte-view surface on the render-side sandbox-escape three-arm path-shape-diagnostic PathShapeViolation closed-set fieldless typed enum.

Every consumer that binds its input through the standard-library [AsRef<[u8]>] trait bound — a byte-keyed HashMap<K: AsRef<[u8]>, V> per-path-shape-violation policy table lookup on any future feira lint --explain-path-shape=<tag> / admission-webhook rejection body dispatcher, a blake3::Hasher::update / ring::digest::Context::update / sha2::Sha256::update byte-input surface on any future per-caixa path-gate diagnostic-histogram content-address digest folded into the [crate::Lacre] closure so downstream cache-keys partition on the three violation arms (Empty, Absolute, ParentEscape) at content-address time, an std::io::Write::write_all-bound structured-log per-arm byte-sink on the caixa-build pipeline’s per-slot path-gate emission path — reaches the substrate primitive through one trait dispatch rather than open-coding the two-hop violation.as_str().as_bytes() composition at every call site. Routed byte-for-byte through the PathShapeViolation::as_str pub const fn accessor the paired str-view (AsRef<str>, std::fmt::Display, PathShapeViolation::as_str) and the five reverse-projection (&'static str, String, Cow<'static, str>, Box<str>, std::sync::Arc<str>, std::rc::Rc<str>) return-shape axes already resolve through, so any future divergence between the byte-view and str-view axes trips at caixa-core test time rather than at a downstream byte-consumer’s silent split.

Extends the substrate-wide byte-view campaign the sibling crate::CaixaKind first-mover (69d8d86) opened onto the first render-side path-shape-diagnostic closed-set enum on the caixa-core surface — the ninth in-repo closed-set fieldless typed enum peer to pick up the discipline, after crate::CaixaKind, crate::dialeto::CaixaDialeto, crate::dep::DepList, crate::aplicacao::PlacementStrategy, crate::aplicacao::RateLimitUnit, crate::supervisor::RestartStrategy + crate::supervisor::RestartPolicy, and crate::aplicacao::WitShape (0e2d0f2 — the M3-mesh-:contratos :wit classifier peer one commit prior). Pin load-bearing by [tests::path_shape_violation_as_ref_bytes_routes_through_as_str_accessor] — fail-before-pass-after byte-parity pin against PathShapeViolation::as_str .as_bytes() across the three-arm PathShapeViolation::ALL emit-set, cross-axis witness against the paired str-view / six reverse-projection axes’ .as_bytes() byte-tails, a <T: AsRef<[u8]>>-bound-consumer witness, and a blake3::Hasher::update-shape byte-input surface witness on both owned and borrowed input shapes.

fn as_ref(&self) -> &[u8]

Converts this type into a shared reference of the (usually inferred) input type.

impl AsRef<str> for PathShapeViolation

Route the standard-library AsRef<str> projection on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the trait- idiomatic .as_ref() (a future HashMap::get::<str>(violation.as_ref()) per-violation policy- table lookup, a Command::arg shell-out composing the canonical violation tag into a feira lint --path-shape=<tag> filter, any impl AsRef<str>-bound generic function) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded .as_str() re-inlining at every wire-up.

Peer of the substrate-wide sibling closed-set-enum AsRef<str>-through-as_str family already carried by [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (ce9d1e3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::CaixaDialeto, crate::aplicacao::PlacementStrategy, crate::aplicacao::RateLimitUnit, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, crate::dep::DepList, and crate::CaixaVersion, plus the peer [caixa_provedor::FerriteRuntime] AsRef<str>-through- variant_slug route (f919cda) — extends the axis onto the caixa- core render-side path-shape-diagnostic closed-set enum, closing the (as_str, Display, AsRef<str>) canonical-projection triple on the first render-side path-shape-diagnostic closed-set fieldless typed enum on the caixa surface to converge onto it.

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for PathShapeViolation

fn clone(&self) -> PathShapeViolation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PathShapeViolation

impl Debug for PathShapeViolation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for PathShapeViolation

Route the derived-style std::fmt::Display impl on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the standard- library {} formatting axis (a future feira lint --explain-path-shape=<axis> per-arm listing line naming the violation, a tracing::field::Value::from(violation) structured- log recorder on the caixa-build pipeline’s per-slot path-gate emission path, any format!("{violation}") interpolation in a future audit surface) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded per-arm match at every wire-up.

Follows the same closed-set-typed-enum Display-through-as_str convention the substrate-wide siblings [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (6ad94f3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::aplicacao::PlacementStrategy, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, and crate::dep::DepList already carry, plus the peer [caixa_provedor::FerriteRuntime] Display-through-variant_slug route (f919cda) on the sibling caixa-provedor axis whose canonical projection is domain-named — closes the PathShapeViolation closed-set enum’s (as_str, Display, AsRef<str>) canonical-projection triple.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PathShapeViolation

impl From<&PathShapeViolation> for &'static str

Trait-idiomatic forward projection on PathShapeViolation from a borrowed input onto the &'static str axis — the borrowed-input companion to the paired owned-input [From<PathShapeViolation> for &'static str] impl immediately above. Routes byte-for-byte through the same substrate-primitive PathShapeViolation::as_str pub const fn accessor so every consumer that binds a &PathShapeViolation through the standard-library .into() / [From<&Self> for &'static str] axis (a PathShapeViolation::ALL.iter().map(<&'static str>::from).collect::<Vec<_>>() per-arm accept-set materializer — whose iterator over &'static [PathShapeViolation] yields &PathShapeViolation, not PathShapeViolation, so the owned-input From<PathShapeViolation> axis alone forces every call site through an explicit .copied() / dereference / Copy-bound restatement rather than the direct trait-idiomatic projection; a future generic <T: Copy + for<'a> Into<&'static str>>-bound diagnostic column over the substrate-wide closed-set typed-enum family that walks the iter().map(Into::into) shape verbatim; the future feira lint --explain-path-shape per-axis listing that composes the accepted-tag enumeration from an iterated PathShapeViolation::ALL.iter().map(|v| v.into()) pipe rather than a per-arm match v { … } cascade; a future HashMap::<&'static str, PathShapeViolation>::from_iter( PathShapeViolation::ALL.iter().map(|v| (v.into(), *v)))-style per-violation reverse-lookup table the sibling TryFrom<&str> impl cannot compose without this borrowed-input axis in place) reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical- kebab emit-set the paired owned-input [From<PathShapeViolation> for &'static str], the sibling std::fmt::Display, AsRef<str>, and PathShapeViolation::as_str surfaces already return.

Ninth peer on the substrate-wide trait-idiomatic borrowed-input forward-projection family opened on crate::dep::DepList (64aa742) and extended onto crate::CaixaKind (5ab993a), crate::CaixaDialeto (807b0b5), the paired M2 OTP-shape crate::supervisor::RestartStrategy (e941836) and crate::supervisor::RestartPolicy (842c7f3), and the M3 mesh-primitive slot enums crate::aplicacao::PlacementStrategy (4d941d8), crate::aplicacao::WitShape (3187bd0), and crate::aplicacao::RateLimitUnit (f4b9e6b — the third and last M3 mesh-primitive slot enum, closing the M3 arm of the campaign). Rust’s From trait does not auto-derive the From<&Self> sibling from a From<Self> impl (the blanket impl<T, U> From<&T> for U where T: Copy, U: From<T> does not exist in core), so every closed-set typed enum that carries the owned-input axis but not the borrowed- input axis forces every borrowed-input call site through a .copied() / <&'static str>::from(*violation) / violation.as_str() detour whose type bounds have no compile-time link to the substrate primitive. PathShapeViolation is the first outside-manifest-surface (render-side, path-shape-diagnostic) closed-set typed enum to converge onto the substrate-wide borrowed- input campaign — the M2 / M3 slot enums and the two-list dep-graph axis form the manifest-surface arm; this lift opens the render-side arm on the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant, on the same trajectory the paired owned-input axis lift (070a6de) already carried onto the same enum as the first-outside-manifest-surface peer on the owned axis.

Same three-path convergence discipline as the paired owned-input impl (this borrowed-input axis, the paired owned-input [From<PathShapeViolation> for &'static str], and PathShapeViolation::as_str all route through the same three-arm inline canonical-kebab byte-strings), so a future variant addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items PathShapeViolation::ALL and PathShapeViolation::as_str doc blocks already name) reaches every one of the six sibling forward- projection paths (std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, [From<Self> for &'static str], this [From<&Self> for &'static str], and the paired reverse TryFrom<&str> that dispatches on the same three inline canonical- kebab byte-strings by construction) through exactly one caixa-core edit on the PathShapeViolation::as_str pub const fn accessor.

The PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction — so the borrowed-input forward axis and the reverse TryFrom<&str> axis compose directly without the intermediate wire-vocab hop the peer crate::CaixaKind axis pair requires. The round-trip witness pin below locks this direct composition on the render-side path-shape-diagnostic enum’s trait-idiomatic axis pair.

Pinned load-bearing by [tests::path_shape_violation_from_borrowed_into_static_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set via a borrowed input, plus a const-context materialization witness for the &'static str lifetime promise, plus a blanket .into() shape) and [tests::path_shape_violation_from_owned_and_borrowed_into_static_str_agree_on_every_arm] (cross-axis partition pin against the paired owned-input [From<PathShapeViolation> for &'static str] impl, plus a .iter().map(Into::into) pipe witness over PathShapeViolation::ALL, plus a direct round-trip witness through TryFrom<&str> that closes the two-way &Self → &'static str → Self round-trip on the render-side path-shape-diagnostic enum’s trait-idiomatic axis pair without the wire-vocab intermediate the peer crate::CaixaKind axis pair requires).

fn from(violation: &PathShapeViolation) -> &'static str

Converts to this type from the input type.

impl From<&PathShapeViolation> for String

Trait-idiomatic borrowed-input, owned-String output forward projection on the render-side sandbox-escape three-arm path-shape- diagnostic PathShapeViolation closed-set typed enum — the fourth (and closing) corner of the substrate-wide {Self, &Self} × {&'static str, String} 2×2 trait-idiomatic projection family on this first outside-manifest-surface (render-side) closed-set typed enum. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor (via str::to_owned) so every consumer that holds a borrowed [&PathShapeViolation] and needs an owned String — a future serde_json::Value::String(String::from(&violation)) structured-payload composer over a borrowed field, a future Iterator::map over &[PathShapeViolation] that projects to owned keys through .iter().map(String::from) (whose iterator yields &PathShapeViolation, not PathShapeViolation, so the owned-input [From<PathShapeViolation> for String] axis alone forces every call site through an explicit .copied() / spurious Copy deref restatement rather than the direct trait-idiomatic projection), a future HashMap::<String, PathShapeViolation>::from_iter that keys off a borrowed-iteration axis where dereferencing the violation would force an unnecessary Copy at every step, the future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook rejection body composer that names the accepted-:path-shape enumeration through an iterated PathShapeViolation::ALL.iter().map(String::from).collect() pipe rather than a per-arm cascade, the future caixa-build pipeline’s per-slot path-gate structured-log emit whose borrowed-iteration axis over declared violations projects to owned keys by construction — reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-kebab byte-strings the paired std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, and the three other trait-idiomatic forward-projection impls ([From<PathShapeViolation> for &'static str], [From<&PathShapeViolation> for &'static str], [From<PathShapeViolation> for String]) already return.

Tenth peer on the substrate-wide trait-idiomatic borrowed-input, owned-String output forward-projection family opened on crate::supervisor::RestartStrategy (579385f), closed on the M2 OTP-shape sibling axis pair by crate::supervisor::RestartPolicy (8465740), extended onto the two-list dep-graph peer by crate::dep::DepList (e0cb617), onto the top-level crate::CaixaKind peer by (e76436d), the dialect-classification peer crate::CaixaDialeto (d3c0d1d), the M3 mesh-primitive crate::aplicacao::PlacementStrategy (d3dc000), crate::aplicacao::WitShape (d638fd3), and crate::aplicacao::RateLimitUnit (6424e45 — closing the whole M3 triple’s 2×2 corner). First outside-manifest-surface peer on this axis — the M2 / M3 slot enums, the two-list dep-graph axis, the top-level :kind axis, and the dialect-classification axis form the manifest-surface arm; this lift closes the 2×2 on the render- side arm, on the same trajectory the paired owned-input owned- String axis (6e0479a — the ninth peer) and the paired borrowed-input owned-[&'static str] axis (cdf4e95) already took onto the same enum.

Rust’s standard library does not carry a blanket impl<T: AsRef<str>> From<&T> for String (nor an impl<T: fmt::Display> From<&T> for String), so every closed-set typed enum that carries the paired AsRef<str> / Display / From<Self> for &'static str / From<&Self> for &'static str / From<Self> for String quintuple but not the borrowed-input owned-String axis forces every borrowed-input owned-string call site through a violation.as_str().to_owned() / String::from(*violation) (with a spurious Copy) / violation.to_string() (through std::fmt::Display) detour whose type bounds have no compile-time link to the substrate primitive.

Same three-path convergence discipline as the paired owned-input impl (this borrowed-input axis, the paired owned-input [From<PathShapeViolation> for String], and PathShapeViolation::as_str all route through the same three-arm inline canonical-kebab byte-strings), so a future variant addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace- hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items PathShapeViolation::ALL and PathShapeViolation::as_str doc blocks already name) reaches every one of the paired forward-projection paths through exactly one caixa-core edit on the PathShapeViolation::as_str pub const fn accessor.

The PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction — so the borrowed- input owned-String forward axis and the reverse TryFrom<&str> axis compose directly (via the owned-String’s String::as_str borrow) without the intermediate wire-vocab hop the peer crate::CaixaKind axis pair requires. The round-trip witness pin below locks this direct composition on the render-side path-shape-diagnostic enum’s borrowed-input owned-String axis pair.

Pinned load-bearing by [tests::path_shape_violation_from_into_borrowed_owned_string_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set through the borrowed-input surface) and [tests::path_shape_violation_from_into_borrowed_owned_string_agrees_with_paired_axes_on_every_arm] (cross-axis partition pin against the paired owned-input owned- String [From<PathShapeViolation> for String] impl, the paired borrowed-input owned-[&'static str] [From<&PathShapeViolation> for &'static str] impl, the paired owned-input owned-[&'static str] [From<PathShapeViolation> for &'static str] impl — every corner of the 2×2 — plus a .iter().map(String::from) pipe witness over PathShapeViolation::ALL (whose iterator yields &PathShapeViolation by construction, so the borrowed-input owned-String axis is what routes the pipe through the substrate-primitive PathShapeViolation::as_str accessor without a spurious Copy deref), plus a direct round-trip witness through TryFrom<&str> on the owned-String’s String::as_str borrow that closes the two-way &Self → String → Self round-trip on the trait-idiomatic borrowed-input owned-String forward + reverse axis pair — no intermediate wire-vocab hop like the peer crate::CaixaKind axis pair requires).

fn from(violation: &PathShapeViolation) -> String

Converts to this type from the input type.

impl From<&PathShapeViolation> for Cow<'static, str>

Trait-idiomatic borrowed-input, std::borrow::Cow<'static, str> output forward projection on the render-side sandbox-escape three-arm path-shape-diagnostic PathShapeViolation closed-set typed enum — the borrowed-input companion to the paired owned-input [From<PathShapeViolation> for std::borrow::Cow<'static, str>] impl immediately above (7342c32). Routes byte-for-byte through the same substrate-primitive PathShapeViolation::as_str pub const fn accessor (via std::borrow::Cow::Borrowed) so every consumer that holds a [&PathShapeViolation] and needs a std::borrow::Cow<'static, str> — a PathShapeViolation::ALL.iter().map(std::borrow::Cow::from).collect::<Vec<_>>() per-arm accept-set materializer whose iterator over &'static [PathShapeViolation] yields &PathShapeViolation (not PathShapeViolation, so the paired owned-input [From<PathShapeViolation> for std::borrow::Cow<'static, str>] axis alone forces every call site through an explicit .copied() / dereference / Copy-bound restatement rather than the direct trait-idiomatic projection), a future generic <T: for<'a> Into<std::borrow::Cow<'static, str>>>-bound emitter on a per-violation diagnostic column that walks the iter().map(Into::into) shape verbatim, a future M4 mesh.pleme.io/v1alpha1/Caixa CR materializer’s admission-webhook per-arm rejection-reason emitter that composes the accepted-path- shape-violation enumeration from an iterated PathShapeViolation::ALL.iter().map(|v| v.into()) pipe rather than a per-arm match v { … } cascade — reaches the same three "empty" / "absolute" / "parent-escape" lowercase-kebab byte- strings the paired std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, the four {Self, &Self} × {&'static str, String} 2×2 trait-idiomatic forward-projection corners, and the paired owned-input [From<PathShapeViolation> for std::borrow::Cow<'static, str>] impl already return.

Deliberately returns std::borrow::Cow::Borrowed rather than std::borrow::Cow::Owned — the substrate-primitive PathShapeViolation::as_str accessor’s return carries the &'static str lifetime by construction (each match arm resolves to an inline &'static str literal), so the zero-alloc borrowed arm is the type-correct projection with no runtime allocation on the borrowed-input surface just as on the paired owned-input surface.

Closes the {Self, &Self} input-shape corner on the third outside-M3 caixa-core peer (and the first outside-manifest-surface / render-side peer) of the substrate-wide std::borrow::Cow<'static, str> forward-projection campaign, opened one commit prior (7342c32) on the paired owned-input impl. Rust’s standard library does not carry a blanket impl<T: AsRef<str>> From<&T> for std::borrow::Cow<'static, str> (nor an impl<T: fmt::Display> From<&T> for std::borrow::Cow<'static, str>, nor a Copy-based impl<T: Copy, U: From<T>> From<&T> for U), so every closed-set fieldless typed enum peer on the substrate that carries the paired owned-input [Cow<'static, str>] axis but not the borrowed-input axis forces every borrowed-input [Cow<'static, str>]-parameterized call site through a spurious Copy deref (std::borrow::Cow::from(*violation)) or a std::borrow::Cow::Borrowed(violation.as_str()) open-code whose type bounds have no compile-time link to the substrate primitive.

Matches the closure discipline ebeb9e0 landed on the outside-M3 crate::CaixaDialeto axis one commit after 8322511, 702cdf4 on the two-list dep-graph crate::dep::DepList axis one commit after 6858bac, afdf0f4 on the M3-mesh-shape crate::aplicacao::PlacementStrategy one commit after eee504d, 25690ef on crate::aplicacao::WitShape one commit after 8634dec, 53346fb on crate::aplicacao::RateLimitUnit one commit after 1d59925 (closing the whole M3 mesh-shape tier), d45c409 on the top-level crate::CaixaKind one commit after 99c1735, and 9b3e4b3 / ee577fd on the M2 OTP-shape crate::supervisor::RestartStrategy / crate::supervisor::RestartPolicy sibling peers one commit after 7dd28b3 / 0612398. The remaining outside-caixa-core peers (InvariantKind, ArchVerdict, Severity, FixSafety, Semantic, FerriteRuntime) are the remaining future targets on the axis.

Unlike the peer crate::CaixaKind pair (whose forward emit lands on the lowercase Portuguese diagnostic vocabulary while the reverse parse lands on the PascalCase wire vocabulary, forcing the round-trip through an intermediate crate::CaixaKind::wire_name hop), PathShapeViolation is a render-side diagnostic axis with no wire/diagnostic vocabulary split — the PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction, so the borrowed-input std::borrow::Cow<'static, str> projection this impl exposes composes directly with the paired trait-idiomatic reverse TryFrom<&str> axis on the projection’s std::borrow::Cow::as_ref borrow — no intermediate wire-vocab hop required.

Pinned load-bearing by [tests::path_shape_violation_from_borrowed_into_static_cow_str_routes_through_as_str_accessor] (byte-parity + zero-alloc std::borrow::Cow::Borrowed-arm pin against PathShapeViolation::as_str across the three-arm PathShapeViolation::ALL through the borrowed-input surface, plus a blanket-derived Into<std::borrow::Cow<'static, str>> shape witness that also lands on std::borrow::Cow::Borrowed) and [tests::path_shape_violation_from_borrowed_into_static_cow_str_agrees_with_paired_axes_on_every_arm] (cross-axis partition pin against the paired owned-input [From<PathShapeViolation> for std::borrow::Cow<'static, str>], the paired borrowed-input owned-&'static str [From<&PathShapeViolation> for &'static str], and the paired borrowed-input owned-String [From<&PathShapeViolation> for String] impls plus ToString::to_string-through- std::fmt::Display, a .iter().map(std::borrow::Cow::from) pipe witness over PathShapeViolation::ALL — whose iterator yields &PathShapeViolation by construction, so the borrowed-input axis is what routes the pipe without a spurious Copy deref and every collected element satisfies the zero-alloc std::borrow::Cow::Borrowed-arm predicate — plus a direct round- trip witness through TryFrom<&str> on the projection’s std::borrow::Cow::as_ref borrow that closes the two-way &Self → Cow<'static, str> → Self round-trip on the borrowed-input axis without the wire-vocab intermediate hop the peer crate::CaixaKind axis pair requires).

fn from(violation: &PathShapeViolation) -> Cow<'static, str>

Converts to this type from the input type.

impl From<&PathShapeViolation> for Box<str>

Trait-idiomatic borrowed-input, Box<str> output forward projection on the render-side sandbox-escape three-arm path-shape-diagnostic PathShapeViolation closed-set typed enum. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor via Box::<str>::from on the returned &'static str, so every consumer that binds a let key: Box<str> = (&violation).into();- shaped call site or a PathShapeViolation::ALL.iter().map(Box::<str>::from)-shaped pipe (whose iterator over &'static [PathShapeViolation] yields &PathShapeViolation by construction) — a per-path-shape-violation census-key materializer that stashes the path-shape-diagnostic discriminator in a Box<str>-typed heap-owned scalar for cheap clone off a borrowed handle, a future M4 admission-webhook rejection body whose per-arm Box<str> field composes from a borrowed PathShapeViolation handle off a &PathShapeViolation borrow, a future feira lint --explain-path-shape per-axis listing that iterates PathShapeViolation::ALL into per-arm owned Box<str> labels — reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-lowercase kebab byte-strings the sibling {Self, &Self} × {&'static str, String, Cow<'static, str>} forward- projection corner and the paired owned-input [From<PathShapeViolation> for Box<str>] already return.

Rust’s standard library carries impl From<&str> for Box<str> and impl From<String> for Box<str> but no blanket impl<T: AsRef<str>> From<&T> for Box<str> (nor a Copy-based impl<T: Copy, U: From<T>> From<&T> for U), so this borrowed-input axis is a distinct trait-idiomatic surface that the pipe shape PathShapeViolation::ALL.iter().map(Box::<str>::from) reaches through this impl and no other — without it, the same pipe would force an explicit .copied() restatement (.iter().copied() .map(Box::<str>::from)) whose type bounds have no compile-time link back to the substrate primitive, and a let key: Box<str> = (&violation).into();-shaped call site would force an explicit Copy deref (Box::<str>::from(*violation)) or a Box::<str>::from(violation.as_str()) open-code with the same defect.

Closes the {Self, &Self} input-shape corner on the first render-side path-shape-diagnostic caixa-core-internal closed-set fieldless typed enum peer of the substrate-wide trait-idiomatic Box<str> forward- projection campaign — the first caixa-core-internal peer to converge onto the axis (as distinct from the M2 OTP-shape supervisor peers and the M3 mesh-shape aplicacao peers, which sit on the manifest surface, and the outside-caixa-core peers on the caixa-arch / caixa-lint / caixa-theme / caixa-provedor surfaces) — matching the trajectory the paired caixa-theme [caixa_theme::style::Semantic] pair (0cd7dc3, both corners in one axis), the caixa-provedor [caixa_provedor::FerriteRuntime] pair (14886a8, both corners in one axis), the M2 OTP-shape crate::supervisor::RestartStrategy / crate::supervisor::RestartPolicy pair, and the M3 mesh-shape crate::aplicacao::PlacementStrategy / crate::aplicacao::WitShape / crate::aplicacao::RateLimitUnit triple walked before it.

Same discipline as the paired outside-caixa-core, crate::supervisor, and crate::aplicacao Box<str> {Self, &Self}-closers: forward emit (this impl, the paired owned- input [From<PathShapeViolation> for Box<str>] impl, the sibling {&'static str, String, Cow<'static, str>} forward-projection corner, std::fmt::Display, AsRef<str>, PathShapeViolation::as_str) and reverse parse (PathShapeViolation::from_wire, TryFrom<&str>) route through the same three inline canonical-kebab byte-strings PathShapeViolation::as_str returns by construction, so the round-trip composes directly without the wire-vocab intermediate hop the peer crate::CaixaKind axis pair requires.

Pinned load-bearing by [tests::path_shape_violation_from_borrowed_into_box_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm PathShapeViolation::ALL emit-set on the borrowed-input surface, plus a blanket-derived Into shape witness, plus a .iter().map(Box::<str>::from) pipe witness over PathShapeViolation::ALL — whose iterator yields &PathShapeViolation by construction, so the borrowed-input Box<str> axis is what routes the pipe through the substrate- primitive PathShapeViolation::as_str accessor without a spurious Copy deref).

fn from(violation: &PathShapeViolation) -> Box<str>

Converts to this type from the input type.

impl From<&PathShapeViolation> for Arc<str>

Trait-idiomatic borrowed-input, std::sync::Arc<str> output forward projection on the render-side sandbox-escape three-arm path-shape- diagnostic PathShapeViolation closed-set typed enum — the borrowed-input companion to the paired owned-input [From<PathShapeViolation> for std::sync::Arc<str>] impl one commit above that closes the caixa-core-internal tier of the substrate-wide trait-idiomatic std::sync::Arc<str> forward-projection campaign. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor via std::sync::Arc::<str>::from on the returned &'static str, so every consumer that binds a let key: std::sync::Arc<str> = (&violation).into();-shaped call site or a PathShapeViolation::ALL.iter().map(std::sync::Arc::<str>::from)- shaped pipe (whose iterator over &'static [PathShapeViolation] yields &PathShapeViolation by construction) reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-lowercase-kebab byte-strings the paired owned-input [From<PathShapeViolation> for std::sync::Arc<str>] and the sibling {Self, &Self} × {&'static str, String, Cow<'static, str>, Box<str>} forward-projection corner already return.

Rust’s standard library carries impl From<&str> for std::sync::Arc<str> and impl From<String> for std::sync::Arc<str> but no blanket impl<T: AsRef<str>> From<&T> for std::sync::Arc<str> (nor a Copy- based impl<T: Copy, U: From<T>> From<&T> for U), so this borrowed- input axis is a distinct trait-idiomatic surface that the pipe shape PathShapeViolation::ALL.iter().map(std::sync::Arc::<str>::from) reaches through this impl and no other — without it, the same pipe would force a spurious Copy deref (std::sync::Arc::<str>::from((*violation).as_str())) or a .copied() restatement whose type bounds have no compile-time link back to the substrate primitive, and a let key: std::sync::Arc<str> = (&violation).into();-shaped call site would force an explicit Copy deref (std::sync::Arc::<str>::from(*violation)) or a std::sync::Arc::<str>::from(violation.as_str()) open-code with the same defect.

Closes the {Self, &Self} input-shape corner on the caixa-core- internal tier of the substrate-wide trait-idiomatic std::sync::Arc<str> forward-projection campaign for the last remaining caixa-core-internal closed-set fieldless typed enum peer — matching the {Self, &Self} × {&'static str, String, Cow<'static, str>, Box<str>} 2×4 forward-projection matrix the peer projection surfaces already close on this same enum, and completing the caixa-core- internal Arc tier uniformly across all four caixa-core-internal peers (crate::CaixaKind, crate::dep::DepList, crate::dialeto::CaixaDialeto, and this crate::render::PathShapeViolation) on both input-shape corners.

Pinned load-bearing by [tests::path_shape_violation_from_borrowed_into_arc_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm PathShapeViolation::ALL emit-set on the borrowed-input surface, plus a blanket-derived Into shape witness, a cross-axis partition pin against the paired owned-input [From<PathShapeViolation> for std::sync::Arc<str>] and the sibling borrowed-input {&'static str, String, Cow<'static, str>, Box<str>} return-shape axes, and a .iter().map(std::sync::Arc::<str>::from) pipe witness over PathShapeViolation::ALL that resolves through the borrowed-input axis without a spurious Copy deref).

fn from(violation: &PathShapeViolation) -> Arc<str>

Converts to this type from the input type.

impl From<&PathShapeViolation> for Rc<str>

Trait-idiomatic borrowed-input, std::rc::Rc<str> output forward projection on the render-side sandbox-escape three-arm path-shape- diagnostic PathShapeViolation closed-set typed enum — the borrowed-input companion to the paired owned-input [From<PathShapeViolation> for std::rc::Rc<str>] impl immediately above, closing the {Self, &Self} input-shape corner of the caixa- core-internal tier of the std::rc::Rc<str> axis on the render- side path-shape-diagnostic peer. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor via std::rc::Rc::<str>::from on the returned &'static str, so a PathShapeViolation::ALL.iter().map(std::rc::Rc::<str>::from)- shaped pipe (whose iterator over &'static [PathShapeViolation] yields &PathShapeViolation by construction) reaches the same three "empty" / "absolute" / "parent-escape" canonical-lowercase- kebab byte-strings the paired owned-input axis and the sibling {Self, &Self} × {&'static str, String, Cow<'static, str>, Box<str>, std::sync::Arc<str>} forward-projection corner already return.

Rust’s standard library carries no blanket impl<T: AsRef<str>> From<&T> for std::rc::Rc<str> (nor a Copy- based impl<T: Copy, U: From<T>> From<&T> for U), so this borrowed- input axis is a distinct trait-idiomatic surface that the pipe shape PathShapeViolation::ALL.iter().map(std::rc::Rc::<str>::from) reaches through this impl and no other — without it, the same pipe would force a spurious Copy deref (std::rc::Rc::<str>::from((*violation).as_str())) or a .copied() restatement whose type bounds have no compile-time link back to the substrate primitive, and a let key: std::rc::Rc<str> = (&violation).into();-shaped call site would force an explicit Copy deref (std::rc::Rc::<str>::from(*violation)) or a std::rc::Rc::<str>::from(violation.as_str()) open-code with the same defect.

Closes the {Self, &Self} input-shape corner on the caixa-core- internal tier of the substrate-wide trait-idiomatic std::rc::Rc<str> forward-projection campaign for the render-side path-shape-diagnostic peer, matching the trajectory the paired crate::CaixaKind (e04aff0), crate::dialeto::CaixaDialeto (c5595e5), crate::aplicacao::PlacementStrategy (91b4c92), [caixa_arch::invariants::InvariantKind] (c71818b), [caixa_arch::report::ArchVerdict] (cc759ef), [caixa_lint::diagnostic::Severity] (d7c58b6), and [caixa_lint::diagnostic::FixSafety] (046cc5f) pairs walked before it on the caixa-core-internal, M3-mesh-primitive-defining, and outside-caixa-core tiers of the same axis. Leaves the remaining caixa-core-internal peer crate::dep::DepList and the outside- caixa-core peers ([caixa_theme::Semantic], [caixa_provedor::FerriteRuntime]) as the campaign’s next multi- peer targets — this commit gives them a four-peer {Self, &Self} caixa-core-internal-tier template to converge onto on the std::rc::Rc<str> axis.

Pinned load-bearing by [tests::path_shape_violation_from_borrowed_into_rc_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm PathShapeViolation::ALL emit-set on the borrowed-input surface, plus a blanket-derived Into shape witness, a cross-axis partition pin against the paired owned-input [From<PathShapeViolation> for std::rc::Rc<str>] and the sibling borrowed-input {&'static str, String, Cow<'static, str>, Box<str>, std::sync::Arc<str>} return-shape axes, and a .iter().map(std::rc::Rc::<str>::from) pipe witness over PathShapeViolation::ALL that resolves through the borrowed-input axis without a spurious Copy deref).

fn from(violation: &PathShapeViolation) -> Rc<str>

Converts to this type from the input type.

impl From<&PathShapeViolation> for Vec<u8>

Trait-idiomatic borrowed-input, owned-Vec<u8> output byte- owned reverse projection on PathShapeViolation — the borrowed-input peer of [From<PathShapeViolation> for Vec<u8>], closing the {Self, &Self} → Vec<u8> pair on the byte-owned reverse-projection axis in one lift. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor so every consumer that holds a borrowed [&PathShapeViolation] and needs an owned Vec<u8> — a future .iter().map(Vec::<u8>::from).collect() pipe over &[PathShapeViolation] (whose iterator yields &PathShapeViolation, not PathShapeViolation, so the owned- input axis alone forces every call site through an explicit .copied() / spurious Copy deref restatement rather than the direct trait-idiomatic projection), a future feira lint --explain-path-shape=<axis> emitter that walks PathShapeViolation::ALL through an Into<Vec<u8>>-bound per-arm byte-writer to surface the accepted path-shape violation tag set — reaches the same three-arm canonical-lowercase kebab byte-string emit-set the paired owned-input peer already returns.

fn from(violation: &PathShapeViolation) -> Vec<u8>

Converts to this type from the input type.

impl From<PathShapeViolation> for &'static str

Standard-library trait-idiomatic forward projection on the PathShapeViolation closed-set typed enum. Routes byte-for-byte through the paired substrate-primitive PathShapeViolation::as_str pub const fn accessor so <&'static str>::from(violation) / violation.into::<&'static str>() reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-kebab emit-set the sibling method-named accessor dispatches through and the sibling [std::fmt::Display for PathShapeViolation] / [AsRef<str> for PathShapeViolation] impls also route through.

Extends the substrate-wide closed-set-enum trait-idiomatic forward-projection family (crate::supervisor::RestartStrategy via 523157d, crate::supervisor::RestartPolicy via 9fb37d0, crate::CaixaKind via edb827b, crate::CaixaDialeto via c189a6f, crate::aplicacao::PlacementStrategy via afa3562, crate::aplicacao::WitShape via 56998ec, crate::aplicacao::RateLimitUnit via 7fdfbf4) onto the first render-side path-shape-diagnostic closed-set enum on the caixa surface — the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant. Closes the trait- idiomatic forward-projection family on the caixa-core-side closed-set fieldless typed-enum surface — every caixa-core enum that already carries the paired trait-idiomatic reverse projection TryFrom<&str> now also carries the trait-idiomatic forward projection, so a downstream impl From<T> for &'static str-bound generic consumer reaches every caixa-core closed-set enum through one uniform trait dispatch.

Pairs with the sibling [TryFrom<&str> for PathShapeViolation] impl (e67e48a) to close the two-way Self ↔ &'static str round-trip on the trait-idiomatic axis pair, mirroring the pre-existing method-named PathShapeViolation::as_str + PathShapeViolation::from_wire pair on the substrate-primitive axis pair.

Return type is &'static str by construction — every PathShapeViolation::as_str arm resolves to an inline "empty" / "absolute" / "parent-escape" &'static str literal, so the trait’s return-type promise is upheld structurally without a String::leak cast or a per-arm inline literal outside the paired PathShapeViolation::as_str dispatch.

The paired PathShapeViolation::as_str accessor’s three-arm emit-set is the single source of truth — every future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items the sibling PathShapeViolation::ALL doc block already names) grows the trait-idiomatic forward axis by construction: one caixa-core edit on PathShapeViolation::as_str extends every one of the sibling forward-projection paths (std::fmt::Display, AsRef<str>, PathShapeViolation::as_str itself, and this [From<Self> for &'static str]) without a coordinated rewrite across every future Into<&'static str>-bound consumer’s arm-set.

Pinned load-bearing by [tests::path_shape_violation_from_into_static_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set, plus a const-context materialization witness for the &'static str lifetime promise routed through the paired PathShapeViolation::as_str pub const fn accessor, plus a paired .into() shape assertion covering the blanket-derived Into<&'static str> shape) and [tests::path_shape_violation_from_into_static_str_and_as_str_partition_the_emit_set] (partition pin asserting <&'static str as From<PathShapeViolation>>::from and PathShapeViolation::as_str agree on every arm, plus a two-way direct round-trip witness through the paired trait-idiomatic TryFrom<&str> axis that closes the two-way Self ↔ &'static str round-trip on the trait-idiomatic axis pair — the emit-side PathShapeViolation::as_str and the parse-side PathShapeViolation::from_wire dispatch on the same three inline canonical-kebab byte-strings by construction, so round-tripping composes the two trait impls directly).

fn from(violation: PathShapeViolation) -> &'static str

Converts to this type from the input type.

impl From<PathShapeViolation> for String

Trait-idiomatic owned-String forward projection on the render-side path-shape-diagnostic closed-set typed enum PathShapeViolation — the owned-heap-string companion to the paired [&'static str]-returning [From<PathShapeViolation> for &'static str] / [From<&PathShapeViolation> for &'static str] impls immediately above, extending the owned-input owned-String arm of the substrate-wide {Self, &Self} × {&'static str, String} 2×2 trait-idiomatic projection family onto the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor (via str::to_owned) so every consumer that binds a PathShapeViolation through the standard-library .into() / [From<Self> for String] (equivalently Into<String>) axis — a future serde_json::Value::String(violation.into()) structured-payload composer where the Value::String arm typing demands an owned String and the sibling [&'static str]-returning axes force an explicit .to_owned() / String::from restatement at every call site, a future HashMap::<String, PathShapeViolation>::from_iter( PathShapeViolation::ALL.iter().map(|v| (String::from(*v), *v))) per-violation lookup where the map’s key type is owned String rather than [&'static str], a future Cow::<'static, str>::Owned(violation.into()) composer on a future M4 mesh.pleme.io/v1alpha1/Caixa CR materializer’s admission-webhook rejection body’s owned-arm, the future caixa-build pipeline’s per-slot path-gate serde_json::json!({ "violation": violation }) structured-log emit where the JSON serializer’s [Serialize] impl on String owns the emit-path — reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-kebab emit-set the paired std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, and the two [&'static str]-returning forward-projection impls already return.

Ninth peer on the substrate-wide trait-idiomatic owned-String forward-projection family opened on crate::supervisor::RestartStrategy (7baa18a) and extended onto crate::supervisor::RestartPolicy (7851725), crate::CaixaKind (231a18c), crate::CaixaDialeto (88942cd), crate::dep::DepList (32b0ee8), crate::aplicacao::PlacementStrategy (1154c2f), crate::aplicacao::WitShape (79a8723), and crate::aplicacao::RateLimitUnit (c7d687d — the third and last M3 mesh-primitive slot enum on the manifest-surface arm). Rust’s standard library does not carry a blanket impl<T: AsRef<str>> From<T> for String (nor an impl<T: fmt::Display> From<T> for String), so every closed-set typed enum that carries the paired AsRef<str> / Display / From<Self> for &'static str / From<&Self> for &'static str quadruple but not the owned-String axis forces every owned-string call site through a .to_string() / .as_str().to_owned() / String::from(violation.as_str()) detour whose type bounds have no compile-time link to the substrate primitive. PathShapeViolation is the first outside-manifest-surface (render-side, path-shape-diagnostic) closed-set typed enum to converge onto the owned-String arm of the campaign — the M2 / M3 slot enums and the two-list dep-graph axis form the manifest-surface arm; this lift opens the render-side arm on the sandbox-escape three-arm accept-set on the same trajectory the paired borrowed- input &'static str axis lift (cdf4e95) already took.

Same three-path convergence discipline as the paired [&'static str]-returning impls (this owned-String axis, the paired [From<PathShapeViolation> for &'static str], the paired [From<&PathShapeViolation> for &'static str], and PathShapeViolation::as_str all route through the same three-arm inline canonical-kebab byte-strings), so a future variant addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items PathShapeViolation::ALL and PathShapeViolation::as_str doc blocks already name) reaches every one of the sibling forward- projection paths through exactly one caixa-core edit on the PathShapeViolation::as_str pub const fn accessor.

The PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction — so the owned-input owned-String forward axis and the reverse TryFrom<&str> axis compose directly (via the owned-String’s String::as_str borrow) without the intermediate wire-vocab hop the peer crate::CaixaKind axis pair requires. The round-trip witness pin below locks this direct composition on the render-side path-shape-diagnostic enum’s owned-String axis pair.

Pinned load-bearing by [tests::path_shape_violation_from_into_owned_string_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set via the owned-String surface) and [tests::path_shape_violation_from_into_owned_string_and_static_str_agree_on_every_arm] (cross-axis partition pin against the paired owned-input [&'static str]-returning [From<PathShapeViolation> for &'static str] impl and the sibling ToString::to_string surface routed through std::fmt::Display, plus a .iter().copied().map(String::from) pipe witness over PathShapeViolation::ALL, plus a direct round-trip witness through the paired trait-idiomatic reverse TryFrom<&str> axis on the owned-String’s String::as_str borrow that closes the two-way Self → String → Self round-trip on the render-side path-shape-diagnostic enum’s owned-String axis pair without the wire-vocab intermediate the peer crate::CaixaKind axis pair requires).

fn from(violation: PathShapeViolation) -> String

Converts to this type from the input type.

impl From<PathShapeViolation> for Cow<'static, str>

Trait-idiomatic owned-input, std::borrow::Cow<'static, str> output forward projection on the render-side sandbox-escape three-arm path-shape-diagnostic PathShapeViolation closed-set typed enum — routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor (via std::borrow::Cow::Borrowed) so every consumer that binds a PathShapeViolation through the standard-library .into() / [From<Self> for std::borrow::Cow<'static, str>] (equivalently Into<std::borrow::Cow<'static, str>>) axis — a future axum::response::IntoResponse body composer whose typing folds a per-arm rejection line into a std::borrow::Cow<'static, str> boundary, a future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook rejection body composer whose typing rules out the sibling AsRef<str> borrowed return and the sibling [From<Self> for &'static str] axis’s non-std::borrow::Cow- parameterized shape, a future substrate-wide per-arm diagnostic surface that folds either the zero-alloc std::borrow::Cow::Borrowed arm (for the closed-set arms whose byte-string is inline-lifted) or the std::borrow::Cow::Owned arm (for a caller that mutates the projection) through one uniform trait dispatch, a future generic <T: Into<std::borrow::Cow<'static, str>>>-bound emitter on a per-path-shape structured-log or admission-webhook rejection body — reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-kebab byte-strings the paired std::fmt::Display, AsRef<str>, PathShapeViolation::as_str, and the four {Self, &Self} × {&'static str, String} 2×2 trait- idiomatic forward-projection corners ([From<PathShapeViolation> for &'static str], [From<&PathShapeViolation> for &'static str], [From<PathShapeViolation> for String], [From<&PathShapeViolation> for String]) already return, rather than an open-coded per-call-site std::borrow::Cow::Borrowed(violation.as_str()) / std::borrow::Cow::Owned(violation.to_string()) / String::from(violation).into() composition whose type bounds have no compile-time link back to the substrate primitive.

Deliberately returns std::borrow::Cow::Borrowed rather than std::borrow::Cow::Owned — the substrate-primitive PathShapeViolation::as_str accessor’s return carries the &'static str lifetime by construction (each match arm resolves to an inline "empty" / "absolute" / "parent-escape" &'static str literal with static lifetime), so the zero-alloc borrowed arm is the type-correct projection with no runtime allocation. The paired std::borrow::Cow::Owned arm stays reachable at the call site through the existing [From<PathShapeViolation> for String] axis composed with std::borrow::Cow::from on the resulting owned String — a caller who chose to mutate the projection lands on the owned arm by their own composition, not by the substrate-primitive projection silently allocating on their behalf.

Ninth peer on the substrate-wide trait-idiomatic std::borrow::Cow<'static, str> forward-projection family opened on the top-level crate::CaixaKind by 99c1735 (closed on the {Self, &Self} input-shape corner by d45c409), extended onto the M2 OTP-shape tier by 7dd28b3 / 9b3e4b3 (opens/closes on crate::supervisor::RestartStrategy) and 0612398 / ee577fd (opens/closes on crate::supervisor::RestartPolicy, closing the M2 OTP-shape tier), extended onto the M3 mesh-shape tier by 8634dec / 25690ef (opens/closes on crate::aplicacao::WitShape), eee504d / afdf0f4 (opens/closes on crate::aplicacao::PlacementStrategy), and 1d59925 / 53346fb (opens/closes on crate::aplicacao::RateLimitUnit, closing the M3 mesh-shape tier), extended onto the outside-M3 caixa-core tier by 6858bac / 702cdf4 (opens/closes on crate::dep::DepList) and 8322511 / ebeb9e0 (opens/closes on crate::CaixaDialeto) — extends the axis onto the render-side sandbox-escape three-arm path-shape-diagnostic PathShapeViolation closed-set fieldless typed enum (the third outside-M3 caixa-core peer, and the first outside-manifest-surface / render-side peer on this axis — the M2 / M3 slot enums, the two-list dep-graph axis, the top-level :kind axis, and the dialect-classification axis form the manifest-surface arm; this lift opens the render-side arm, on the same trajectory the paired [&'static str]-returning owned-input axis (070a6de) and the paired owned-input owned-String axis (6e0479a) already took onto the same enum). Rust’s standard library does not carry a blanket impl<T: AsRef<str>> From<T> for std::borrow::Cow<'static, str> (nor an impl<T: fmt::Display> From<T> for std::borrow::Cow<'static, str>), so every closed-set fieldless typed enum peer on the substrate that carries the paired AsRef<str> / std::fmt::Display / [From<Self> for &'static str] / [From<&Self> for &'static str] / [From<Self> for String] / [From<&Self> for String] sextet but not the std::borrow::Cow<'static, str> axis forces every std::borrow::Cow<'static, str>-parameterized call site through a std::borrow::Cow::Borrowed(violation.as_str()) / std::borrow::Cow::Owned(violation.to_string()) / String::from(violation).into() detour whose type bounds have no compile-time link to the substrate primitive.

The remaining outside-caixa-core closed-set fieldless typed enum peers on the substrate surface (InvariantKind, ArchVerdict, Severity, FixSafety, Semantic, FerriteRuntime) are the future targets of this campaign — each carries the same paired sextet that this axis extends onto.

Unlike the peer crate::CaixaKind pair (whose forward emit lands on the lowercase Portuguese diagnostic vocabulary while the reverse parse lands on the PascalCase wire vocabulary, forcing the round-trip through an intermediate crate::CaixaKind::wire_name hop), PathShapeViolation is a render-side diagnostic axis with no wire/diagnostic vocabulary split — the PathShapeViolation::as_str emit and PathShapeViolation::from_wire parse share the same three inline canonical-kebab byte-strings by construction, so the std::borrow::Cow<'static, str> projection this impl exposes composes directly with the paired trait-idiomatic reverse TryFrom<&str> axis on the projection’s std::borrow::Cow::as_ref borrow — no intermediate wire-vocab hop required.

Pinned load-bearing by [tests::path_shape_violation_from_into_static_cow_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set through the std::borrow::Cow<'static, str> surface, plus a std::borrow::Cow::Borrowed discriminator witness that the projection lands on the zero-alloc arm rather than silently allocating through std::borrow::Cow::Owned, plus a blanket- derived Into<std::borrow::Cow<'static, str>> shape witness that also lands on std::borrow::Cow::Borrowed) and [tests::path_shape_violation_from_into_static_cow_str_agrees_with_paired_axes_on_every_arm] (cross-axis partition pin against the paired owned-input [From<PathShapeViolation> for &'static str] and [From<PathShapeViolation> for String] forward-projection corners plus the sibling ToString::to_string-through-std::fmt::Display surface, plus a .iter().copied().map(std::borrow::Cow::from) pipe witness over PathShapeViolation::ALL whose zero-alloc std::borrow::Cow::Borrowed outcome is load-bearing on every arm, plus a direct round-trip witness through TryFrom<&str> on the projection’s std::borrow::Cow::as_ref borrow that closes the two-way Self → Cow<'static, str> → Self round-trip on the trait- idiomatic std::borrow::Cow<'static, str> forward + reverse axis pair without the wire-vocab intermediate hop the peer crate::CaixaKind axis pair requires).

fn from(violation: PathShapeViolation) -> Cow<'static, str>

Converts to this type from the input type.

impl From<PathShapeViolation> for Box<str>

Trait-idiomatic owned-input, Box<str> output forward projection on the render-side sandbox-escape three-arm path-shape-diagnostic PathShapeViolation closed-set typed enum. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor via Box::<str>::from on the returned &'static str, so every consumer that binds a let key: Box<str> = violation.into();-shaped call site — a per-path-shape-violation census-key materializer that stashes the path-shape-diagnostic discriminator in a Box<str>-typed heap- owned scalar for cheap clone off an owned handle, a future M4 [mesh.pleme.io/v1alpha1/Caixa] CR materializer’s per-path admission- webhook rejection body whose per-arm Box<str> field composes from an owned PathShapeViolation handle naming the accepted-violation-tag list, a future feira lint --explain-path-shape=<axis> per-arm listing that stashes each arm as an owned Box<str> label — reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical- lowercase kebab byte-strings the sibling {Self, &Self} × {&'static str, String, Cow<'static, str>} forward-projection corner already returns.

Rust’s standard library carries impl From<&str> for Box<str> and impl From<String> for Box<str> but no blanket impl<T: AsRef<str>> From<T> for Box<str>, so this axis is a distinct trait-idiomatic surface that a downstream PathShapeViolation → Box<str> .into() reaches through this impl and no other — without a Box::from(violation.as_str()) open-code whose type bounds have no compile-time link back to the substrate primitive.

Opens the caixa-core-internal tier of the substrate-wide trait-idiomatic Box<str> forward-projection campaign on the first render-side path-shape-diagnostic closed-set fieldless typed enum peer, following the M2 OTP-shape crate::supervisor::RestartStrategy / crate::supervisor::RestartPolicy pair (59ae5dc + cb1d068), the M3 mesh-shape crate::aplicacao::PlacementStrategy / crate::aplicacao::WitShape / crate::aplicacao::RateLimitUnit triple (6d73e84 → 8f7eb1a) that closed the M3 mesh-shape tier, and the outside-caixa-core tier (InvariantKind 10613a7 + 5901887, ArchVerdict 3e08f5a + c4319a8, Severity 5116c95, FixSafety cf0174b, Semantic 0cd7dc3, FerriteRuntime 14886a8) closed one axis prior. Same discipline as those peers: forward emit (this impl, the sibling {&'static str, String, Cow<'static, str>} forward-projection corner, std::fmt::Display, AsRef<str>, PathShapeViolation::as_str) and reverse parse (PathShapeViolation::from_wire, TryFrom<&str>) route through the same three inline canonical-kebab byte-strings PathShapeViolation::as_str returns by construction, so the round- trip composes directly without the wire-vocab intermediate hop the peer crate::CaixaKind axis pair requires.

A future variant addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) reaches the paired Box<str> output axis through one match-arm edit on the PathShapeViolation::as_str pub const fn accessor, not a coordinated rewrite of every downstream Box::from(violation.as_str()) open-code.

Pinned load-bearing by [tests::path_shape_violation_from_into_box_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm PathShapeViolation::ALL emit-set on the owned-input surface, plus a blanket-derived Into shape witness).

fn from(violation: PathShapeViolation) -> Box<str>

Converts to this type from the input type.

impl From<PathShapeViolation> for Arc<str>

Trait-idiomatic owned-input, std::sync::Arc<str> output forward projection on the render-side sandbox-escape three-arm path-shape- diagnostic PathShapeViolation closed-set typed enum. Routes byte- for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor via std::sync::Arc::<str>::from on the returned &'static str, so every consumer that binds a let key: std::sync::Arc<str> = violation.into();-shaped call site reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-lowercase-kebab byte-strings the sibling {Self, &Self} × {&'static str, String, Cow<'static, str>, Box<str>} forward-projection corner already returns.

Rust’s standard library carries impl From<&str> for std::sync::Arc<str> and impl From<String> for std::sync::Arc<str> but no blanket impl<T: AsRef<str>> From<T> for std::sync::Arc<str> (nor an impl<T: fmt::Display> From<T> for std::sync::Arc<str>), so this axis is a distinct trait-idiomatic surface that a let key: std::sync::Arc<str> = violation.into();-shaped call site reaches through this impl and no other — a paired std::sync::Arc::<str>::from(violation.as_str()) open-code has no compile-time link back to the substrate primitive, and a two-step std::sync::Arc::<str>::from(String::from(violation)) composition through the owned-String axis allocates twice (once into the intermediate String, once into the std::sync::Arc<str> on the From<String> conversion) where the single-step trait impl allocates once. The shared-ownership + Sync + Send contract std::sync::Arc<str> provides is the distinct value the sibling Box<str> axis’s owned-move return-shape cannot provide — a per- path-shape-violation diagnostic tag reachable from multiple concurrent per-Caixa layout-check tasks through the same three lowercase-kebab byte-strings, without a .clone()-per-task materialization the owned- move Box<str> axis would force.

Closes the caixa-core-internal tier of the substrate-wide trait- idiomatic std::sync::Arc<str> forward-projection campaign on the last remaining caixa-core-internal closed-set fieldless typed enum peer — after crate::CaixaKind (c17be64 opened + closed both corners), crate::dep::DepList (d8a4652), and crate::dialeto::CaixaDialeto (ac65d87), this impl paired with the sibling borrowed-input [From<&PathShapeViolation> for std::sync::Arc<str>] impl one commit below completes the caixa-core-internal Arc tier uniformly across all four caixa-core-internal peers on both {Self, &Self} input-shape corners.

A future variant addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) reaches the paired std::sync::Arc<str> output axis through one match-arm edit on the PathShapeViolation::as_str pub const fn accessor, not a coordinated rewrite of every downstream std::sync::Arc::<str>::from(violation.as_str()) open-code.

Pinned load-bearing by [tests::path_shape_violation_from_into_arc_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm PathShapeViolation::ALL emit-set on the owned-input surface, plus a blanket-derived Into shape witness and cross-axis byte-parity pins against the sibling owned-input {&'static str, String, Cow<'static, str>, Box<str>} return-shape axes).

fn from(violation: PathShapeViolation) -> Arc<str>

Converts to this type from the input type.

impl From<PathShapeViolation> for Rc<str>

Trait-idiomatic owned-input, std::rc::Rc<str> output forward projection on the render-side sandbox-escape three-arm path-shape- diagnostic PathShapeViolation closed-set typed enum — the single- threaded reference-counted peer of the paired owned-input [From<PathShapeViolation> for std::sync::Arc<str>] impl immediately above on the sibling atomically-reference-counted std::sync::Arc<str> axis. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor via std::rc::Rc::<str>::from on the returned &'static str, so every consumer that binds a let key: std::rc::Rc<str> = violation.into();-shaped call site reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-lowercase-kebab byte-strings the sibling {Self, &Self} × {&'static str, String, Cow<'static, str>, Box<str>, std::sync::Arc<str>} forward-projection corner already returns.

Rust’s standard library carries impl From<&str> for std::rc::Rc<str> and impl From<String> for std::rc::Rc<str> but no blanket impl<T: AsRef<str>> From<T> for std::rc::Rc<str> (nor a From<&T> blanket), and — the std::sync::Arc<str> and std::rc::Rc<str> trait tables are disjoint — so this axis is a distinct trait- idiomatic surface a let key: std::rc::Rc<str> = violation.into();- shaped call site reaches through this impl and no other. A single- threaded caixa-core layout-check pass whose per-fixture path-shape diagnostic tag is cloned across intra-check tree nodes via std::rc::Rc::clone (its cheaper non-atomic refcount bump the std::sync::Arc<str> axis’s atomically-reference-counted return- shape cannot provide within a single-threaded caixa-core pass), a future single-threaded feira build-side per-violation histogram- column emitter keyed on a shared-ownership per-arm bucket key, a future caixa-lsp-side path-shape-diagnostic quick-fix panel composer holding a shared per-arm canonical kebab tag across intra- file layout tree nodes without atomic contention — reaches the substrate-primitive PathShapeViolation::as_str accessor through this impl and no other. A paired std::rc::Rc::<str>::from(violation.as_str()) open-code has no compile-time link back to the substrate primitive, and a two-step std::rc::Rc::<str>::from(String::from(violation)) composition through the owned-String axis allocates twice (once into the intermediate String, once into the std::rc::Rc<str> on the From<String> conversion) where the single-step trait impl allocates once.

Extends the caixa-core-internal tier of the substrate-wide trait- idiomatic std::rc::Rc<str> forward-projection campaign onto the render-side path-shape-diagnostic peer, following the structurally most fundamental crate::CaixaKind pair (e04aff0 {Self, &Self} corner) that opened the caixa-core-internal tier and the second-peer crate::dialeto::CaixaDialeto pair (c5595e5 {Self, &Self} corner) — matching the trajectory the sibling atomically-reference- counted std::sync::Arc<str> axis walked before it onto this same enum (the paired impl From<PathShapeViolation> for std::sync::Arc<str> / impl From<&PathShapeViolation> for std::sync::Arc<str> pair immediately above).

A future variant addition (a Symlink arm the future symlink- escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) reaches the paired std::rc::Rc<str> output axis through one match-arm edit on the PathShapeViolation::as_str pub const fn accessor, not a coordinated rewrite of every downstream std::rc::Rc::<str>::from(violation.as_str()) open-code.

Pinned load-bearing by [tests::path_shape_violation_from_into_rc_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm PathShapeViolation::ALL emit-set on the owned-input surface, plus a blanket-derived Into shape witness and cross- axis byte-parity pins against the sibling owned-input {&'static str, String, Cow<'static, str>, Box<str>, std::sync::Arc<str>} return-shape axes).

fn from(violation: PathShapeViolation) -> Rc<str>

Converts to this type from the input type.

impl From<PathShapeViolation> for Vec<u8>

Trait-idiomatic owned-input, owned-Vec<u8> output byte-owned reverse projection on the first render-side path-shape-diagnostic closed-set fieldless typed enum on the caixa surface (PathShapeViolation) — the byte-mirror of the [From<PathShapeViolation> for String] str-owned reverse-projection axis and the owned-Vec<u8> reverse-projection sibling of the [AsRef<[u8]>] borrowed byte-view axis (2c58220) lifted on this same enum. Routes byte-for-byte through the substrate-primitive PathShapeViolation::as_str pub const fn accessor via str::as_bytes + slice::to_vec so every consumer that binds a PathShapeViolation through the standard-library impl From<PathShapeViolation> for Vec<u8> axis (equivalently <T: Into<Vec<u8>>>) — a future std::io::Write::write_all- shape per-path-gate audit-log byte-sink whose input parameter is an owned Vec<u8> payload, a future bytes::Bytes::from(Vec::<u8>::from(violation)) composer folding the per-arm byte-tag into the [bytes::Bytes] framing surface, a future hasher.update(&Vec::<u8>::from(violation))-shape BLAKE3 per-caixa path-gate diagnostic-histogram content-address closure that needs the owned byte-tail buffered before folding into the [crate::Lacre] closure body, a future per-violation protobuf/CBOR/msgpack spec.violation payload composer whose framer takes an owned Vec<u8> rather than a borrowed byte- slice — reaches the same three-arm canonical-lowercase kebab byte-string emit-set the paired [AsRef<[u8]>] borrowed byte- view axis, the four {Self, &Self} × {&'static str, String} 2×2 str-view forward- projection corners, and the std::borrow::Cow<'static, str> / Box<str> / std::sync::Arc<str> / std::rc::Rc<str> str-owned reverse-projection quartet already return, rather than an open-coded per-call-site violation.as_str().as_bytes().to_vec() / <PathShapeViolation as AsRef<[u8]>>::as_ref(&violation).to_vec() / String::from(violation).into_bytes() composition whose type bounds have no compile-time link back to the substrate primitive.

Extends the substrate-wide trait-idiomatic byte-owned reverse- projection axis onto the first render-side path-shape-diagnostic closed-set fieldless typed enum on the caixa surface — matching the trajectory the caixa-core-internal crate::CaixaKind first-mover impl (b245fd6), crate::CaixaDialeto (4cceaf5), crate::dep::DepList (e974ca2), the M2-OTP-shape crate::supervisor::RestartStrategy (63e5dd0) and crate::supervisor::RestartPolicy (96a522a), the M3-mesh-primitive-defining crate::aplicacao::PlacementStrategy (008a35b), crate::aplicacao::RateLimitUnit (602ae0b), crate::aplicacao::WitShape (7b4b278), the first-mover outside-caixa-core [caixa_arch::invariants::InvariantKind] (ed29f5a), the second-mover outside-caixa-core [caixa_arch::report::ArchVerdict] (5268ed1), the third-mover outside-caixa-core caixa_lint::Severity (3aa6644), and the fourth-mover outside-caixa-core caixa_lint::FixSafety (38060a4) walked before it. Leaves the remaining outside- caixa-core closed-set fieldless typed-enum peers ([caixa_theme::Semantic], [caixa_provedor::FerriteRuntime]) as the campaign’s next mechanical one-lift extensions against the substrate-primitive as_str accessor they already carry — tracking the paired byte-view axis’s outside-caixa-core sweep (b5baf7d → 0e0057a → 1e65136 → 1da1afc → 2c58220 → 83f1e82 → c0111a6) verbatim.

Pinned load-bearing by [tests::path_shape_violation_from_into_owned_vec_bytes_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm PathShapeViolation::ALL emit-set binding the byte-owned reverse-projection axis against the paired [AsRef<[u8]>] borrowed byte-view axis and the str-owned reverse-projection family’s .into_bytes() / .as_bytes().to_vec() byte-tails, plus a <T: Into<Vec<u8>>>-bound generic-consumer witness, a std::io::Write::write_all-shape owned-byte-sink surface witness on both owned and borrowed input shapes, and a std::fmt::Debug-derive-output rejection witness against a silent detour back onto the format!("{:?}", violation) PascalCase byte-string any future per-path-gate render site would otherwise reach without the substrate-primitive PathShapeViolation::as_str accessor).

fn from(violation: PathShapeViolation) -> Vec<u8>

Converts to this type from the input type.

impl FromStr for PathShapeViolation

Trait-idiomatic std::str::FromStr parse axis on the PathShapeViolation closed-set render-side path-shape-diagnostic axis — routes byte-for-byte through the paired [TryFrom<&str> for PathShapeViolation] impl (which in turn routes through the substrate-primitive PathShapeViolation::from_wire Option<Self> accessor), so "...".parse::<PathShapeViolation>() / <PathShapeViolation as FromStr>::from_str(…) reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical- kebab wire accept-set the sibling method-named PathShapeViolation::from_wire resolver and the paired TryFrom<&str> impl already resolve against.

Extends the substrate-wide trait-idiomatic str::parse-axis campaign — opened on crate::dep::DepList via 6167092 as first-mover on the two-list dep-graph closed-set typed enum, extended onto crate::CaixaKind via 9867432, crate::aplicacao::PlacementStrategy via 62ef49a, crate::CaixaDialeto via ff01b2f, [caixa_arch::invariants::InvariantKind] via fb16072, [caixa_arch::report::ArchVerdict] via 40e9dfd, [caixa_lint::diagnostic::Severity] via 6b0a08c, and [caixa_lint::diagnostic::FixSafety] via eb6942b — onto the first render-side path-shape-diagnostic closed-set enum on the caixa-core surface. Coherent by construction on this enum specifically: PathShapeViolation carries exactly one canonical-kebab wire axis ("empty" / "absolute" / "parent-escape") with no paired secondary parse surface — unlike the peer crate::supervisor::RestartStrategy / crate::supervisor::RestartPolicy (whose paired gen_platform::FromStrKind-derived kebab-case FromStr on the dispatcher-catalog axis rules a second FromStr impl out by coherence) and unlike the peer crate::aplicacao::WitShape / crate::aplicacao::RateLimitUnit (whose two-axis splits motivate deliberate deferral of the FromStr axis so a plain s.parse::<T>() cannot obscure which axis the caller reaches) — lifting [FromStr] onto PathShapeViolation cannot collide with a second parse axis it does not carry.

[FromStr] is the canonical Rust-idiomatic parse-set entry point every stdlib-shaped consumer reaches for — str::parse::<T>() is a T: FromStr-bounded generic, not a T: for<'a> TryFrom<&'a str>-bounded one — so lifting [FromStr] onto the closed-set enum unlocks the .parse::<PathShapeViolation>() short-form on every consumer (a future feira lint --explain-path-shape=<empty|absolute|parent-escape> clap-style arg-parse composes arg.parse::<PathShapeViolation>(); a serde string-tagged deserializer routes through the same [FromStr] bound via serde_with::DisplayFromStr; a future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook rejection-body reloader that walks a Vec<String> of prior PathShapeViolation::as_str outputs reaches the typed enum through line.parse::<PathShapeViolation>() without a per-consumer TryFrom<&str> restatement; a tracing::field::Value::Str-arm structured-log re-loader binding a prior emission’s PathShapeViolation::as_str output back to the typed enum for cross-run path-gate-histogram diff reaches the same axis through the stdlib .parse() short-form).

The impl trivially delegates to the paired TryFrom<&str> — same type Err = () deliberate-deferral shape the sibling reverse-projection trait carries — so both trait-idiomatic parse-axis paths (TryFrom<&str> and FromStr::from_str) resolve to the same three-arm accept-set by construction. A future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items the sibling PathShapeViolation::ALL doc block already names) reaches every parse path through one caixa-core edit on the substrate-primitive PathShapeViolation::from_wire accessor, not a coordinated rewrite across the two reverse-projection trait impls.

Pinned load-bearing by [tests::path_shape_violation_from_str_routes_through_try_from_str_impl] (byte-parity pin across the three-arm accept-set + delegated- .parse()-projection witness) and [tests::path_shape_violation_from_str_rejects_unknown_byte_strings] (rejection witness against silent accept-set widening).

type Err = ()

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl Hash for PathShapeViolation

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for PathShapeViolation

fn eq(&self, other: &PathShapeViolation) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for PathShapeViolation

impl TryFrom<&[u8]> for PathShapeViolation

Trait-idiomatic borrowed byte-slice reverse projection on the PathShapeViolation closed three-arm render-side path-shape- diagnostic typed enum — routes byte-for-byte through std::str::from_utf8 composed with the substrate-primitive PathShapeViolation::from_wire Option<Self> accessor, so <PathShapeViolation as TryFrom<&[u8]>>::try_from(bytes) reaches the same three-arm canonical-lowercase-kebab wire accept-set ("empty" / "absolute" / "parent-escape") the sibling method-named PathShapeViolation::from_wire resolver and the paired TryFrom<&str> impl already resolve against. Both rejection paths (invalid UTF-8 and valid-UTF-8-but-unknown-wire) collapse onto the single unit-error Err(()) return, matching the trait-idiomatic-()-error shape the substrate-wide sibling TryFrom<&[u8]> impls carry.

Extends the substrate-wide trait-idiomatic byte-view reverse- projection axis — walked across the caixa-core-internal crate::CaixaKind (18d1940), crate::CaixaDialeto (d102cb8), crate::dep::DepList (b8f25d5), the M2-OTP-shape crate::supervisor::RestartStrategy (c699a83) / crate::supervisor::RestartPolicy (d9ef5f0), the M3-mesh- primitive-defining crate::aplicacao::PlacementStrategy (de03220) / crate::aplicacao::RateLimitUnit (294c77d) / crate::aplicacao::WitShape (de9875c), and the outside-caixa-core [caixa_arch::invariants::InvariantKind] (40b7417), [caixa_arch::report::ArchVerdict] (4dbca85), caixa_lint::diagnostic::Severity (f11dc96), caixa_lint::diagnostic::FixSafety (46a3e3e), caixa_theme::style::Semantic (b8c795d), and caixa_provedor::FerriteRuntime (a9aabe3) peers — onto the first render-side path-shape-diagnostic closed-set fieldless typed enum on the caixa-core surface. Mirrors the paired byte- owned reverse-projection axis’s landing on this enum (c98fb87) and closes the trait-idiomatic byte-projection surface on PathShapeViolation: the forward triple ([AsRef<[u8]>] (2c58220) plus the [From<Self> for Vec<u8>] / [From<&Self> for Vec<u8>] pair (c98fb87)) is now matched by the reverse trait ([TryFrom<&[u8]>]) on the same substrate- primitive PathShapeViolation::from_wire accessor.

Rust’s standard library carries no blanket impl<T: for<'a> TryFrom<&'a str>> TryFrom<&[u8]> for T, so a two-hop composition through std::str::from_utf8 + the paired TryFrom<&str> axis is reachable through the pre-existing str- view reverse-projection axis alone. But that two-hop shape has no compile-time link back to the byte-view reverse-projection axis, forces every downstream <T: for<'a> TryFrom<&'a [u8]>>- bound consumer (a future feira lint --explain-path-shape re-loader whose stdin ingest binds the wire byte-tag as Vec<u8>, a future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook re-loader intercepting raw per-arm path-shape- violation-tag response bytes before the serde derive dispatches, a bytes::Bytes::as_ref()-shape byte-tail composer walking a prior audit’s Vec<u8> payload back to the typed enum, a std::io::Read::read_to_end-shape audit-log ingest byte-source re-hydrating per-slot path-gate emissions) to open-code the composition at every call site.

A future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items the sibling PathShapeViolation::ALL doc block already names) reaches every parse path — PathShapeViolation::from_wire, TryFrom<&str>::try_from, std::str::FromStr::from_str, and now [TryFrom<&[u8]>::try_from] — through one match-arm edit on the substrate-primitive accessor, not a coordinated rewrite across every trait impl.

Pinned load-bearing by [tests::path_shape_violation_try_from_bytes_routes_through_from_wire_accessor] (byte-parity pin against PathShapeViolation::from_wire across the three-arm PathShapeViolation::ALL accept-set on the borrowed byte-slice surface, plus a cross-axis witness that the byte-view reverse projection agrees with the paired TryFrom<&str> str-view reverse axis on every accepted arm, and a forward/reverse byte-view cross-axis witness that feeding the paired [AsRef<[u8]>] byte-tail and the paired [From<PathShapeViolation> for Vec<u8>] and [From<&PathShapeViolation> for Vec<u8>] owned byte-tails back through the new impl round-trips to the originating arm) and [tests::path_shape_violation_try_from_bytes_rejects_unknown_and_non_utf8_bytes] (rejection witness against silent accept-set widening on both the non-UTF-8 byte-sequence rejection path and the unknown-wire- vocabulary rejection path — the latter mirrors the corpus the paired TryFrom<&str> rejection witness already pins, including the trajectory-item candidates the sibling PathShapeViolation doc block already names, the derived PascalCase std::fmt::Debug-shapes the substrate-canonical kebab-case accessor’s docstring explicitly names as drift footguns, and sibling closed-set canonical tags on other axes so a byte-level cross-axis leak trips at caixa-core test time rather than at a downstream consumer’s silent misclassification).

type Error = ()

The type returned in the event of a conversion error.

fn try_from(bytes: &[u8]) -> Result<Self, <Self as TryFrom<&[u8]>>::Error>

Performs the conversion.

impl TryFrom<&str> for PathShapeViolation

Trait-idiomatic reverse projection on the PathShapeViolation closed-set render-side path-shape-diagnostic axis — routes byte-for-byte through the paired substrate-primitive PathShapeViolation::from_wire Option<Self> accessor so every future consumer that binds a canonical path-shape-violation tag through the standard-library .try_into() / TryFrom axis (a future feira lint --explain-path-shape=<empty|absolute|parent-escape> CLI arg-parse that composes into let axis: PathShapeViolation = s.try_into()?, a future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook rejection-body parser that folds a prior audit’s spec.pathShape: String through PathShapeViolation::try_from(&s)?, a generic <T: TryFrom<&str>>-bound loader over any of the substrate’s closed-set typed enums) reaches the same three-arm accept-set the sibling PathShapeViolation::from_wire resolver parses through and the sibling PathShapeViolation::as_str emits, rather than an open-coded per-arm match s { "empty" => …, "absolute" => …, "parent-escape" => …, _ => … } cascade whose arm-set has no compile-time link back to the substrate primitive.

Complements the pre-existing forward-projection triple (std::fmt::Display, AsRef<str>, PathShapeViolation::as_str) with the paired trait-idiomatic reverse-projection axis: Rust-side newtype/typed-enum convention pairs AsRef<str> with either std::str::FromStr or TryFrom<&str> on the same primitive so a caller who can project out to a &str can also project in from one. The TryFrom<&str> axis is deliberately chosen over std::str::FromStr to sidestep the clippy::should_implement_trait lint the sibling method-named PathShapeViolation::from_wire would trigger under a FromStr impl (the same design tradeoff the peer crate::CaixaKind (3c83606), crate::CaixaDialeto (bf33136), crate::aplicacao::PlacementStrategy (6fd00cd), crate::supervisor::RestartStrategy (5b828ed), crate::supervisor::RestartPolicy (6fdd0d9), crate::aplicacao::WitShape (5472902), and crate::aplicacao::RateLimitUnit (bf78400) blocks note) — this impl closes the trait-idiomatic reverse axis without disturbing the method-named from_wire shape every peer closed-set typed enum already carries.

type Error = () matches the sibling PathShapeViolation::from_wire’s Option<Self> return-shape’s deliberate deferral of error typing: the caller picks the diagnostic form appropriate for its use site (a future feira lint --explain-path-shape CLI arg-parse composes its own per-verb “unknown path-shape axis: — accepted: {…}” message enumerating PathShapeViolation::ALL, a future M4 admission-webhook rejection body wraps the Err(()) outcome with the accepted-set enumeration for operator diagnostics, a Result::map_err at the call site lifts the axis-error to a per-verb error type). Same shape the peer sibling reverse-projection axes carry.

The paired TryFrom<&str> impl reaches the same three-arm accept-set the PathShapeViolation::from_wire resolver dispatches through, so any future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items the sibling PathShapeViolation::ALL doc block already names) grows the trait-idiomatic axis by construction: one caixa-core edit on PathShapeViolation::from_wire extends both the method-named reverse projection every existing consumer keys off and the trait-idiomatic reverse projection this impl exposes, without a coordinated rewrite across every future TryFrom<&str>-bound consumer’s arm-set.

Extends the substrate-wide closed-set-enum trait-idiomatic reverse-projection family (crate::CaixaKind via 3c83606, crate::CaixaDialeto via bf33136, crate::aplicacao::PlacementStrategy via 6fd00cd, crate::supervisor::RestartStrategy via 5b828ed, crate::supervisor::RestartPolicy via 6fdd0d9, crate::aplicacao::WitShape via 5472902, and crate::aplicacao::RateLimitUnit via bf78400) onto the first render-side path-shape-diagnostic closed-set enum on the caixa surface — the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant.

Pinned load-bearing by [tests::path_shape_violation_try_from_str_routes_through_from_wire_accessor] (byte-parity pin against PathShapeViolation::from_wire across the three-arm accept-set) and [tests::path_shape_violation_try_from_str_rejects_unknown_byte_strings] (rejection witness against silent accept-set widening).

type Error = ()

The type returned in the event of a conversion error.

fn try_from(s: &str) -> Result<Self, Self::Error>

Performs the conversion.