Constant GATEWAY_API_HOSTNAME_MAX_LEN 

pub const GATEWAY_API_HOSTNAME_MAX_LEN: usize = 253;

K8s Gateway API v1 Listener.hostname and HTTPRoute.spec.hostnames[] max length, in bytes — the apiserver-side OpenAPI schema’s maxLength: 253 cap, ultimately the RFC 1035 / RFC 1123 DNS name limit (255 wire bytes minus the trailing-dot + one length prefix). Lifted to a typed const so a future axis reaching for the same bound (the M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-:entrada :host validator, the future per-Certificate SAN emitter keying off :entrada :host for cert-manager, the future multi-:entrada host-collision gate when M4 lands :entrada as a Vec) reads the limit from one place. The sole landed call site — the :entrada :host axis’s total-length gate at crate::AplicacaoSpec::validate via validate_entrada_host — reads this constant verbatim; drift between the landing site and the K8s CRD schema surfaces at this one const rather than a per-renderer “this passed validate but failed admission” surprise.

Peer of GATEWAY_API_HTTP_PATH_MAX_LEN on the sibling per-route path-value cap axis — both are apiserver-side maxLength: bounds on Gateway API v1 landing sites the pleme-io substrate emits, both lift to caixa-core::render so the M4 CR materializer’s per-axis validators (per-host, per-path) read from one place. Same “typed const so the bound has exactly one source of truth” discipline every peer upper bound in this crate carries (DNS_1123_LABEL_MAX_LEN, NATS_SUBJECT_MAX_LEN, WASI_KV_SLOT_MAX_LEN, WIT_IDENT_MAX_LEN, crate::LIMITS_MEMORY_WASM32_MAX_BYTES, crate::POLICY_TIMEOUT_MAX, crate::POLICY_RETRIES_MAX).

The per-label max within the hostname is DNS_1123_LABEL_MAX_LEN (63): every .-separated label in a Gateway API v1 Hostname is a DNS-1123 label under the apiserver’s OpenAPI regex [a-z0-9]([-a-z0-9]*[a-z0-9])?, so drift between the total-length cap here and the per-label cap on the peer constant is impossible by construction.