Constant GATEWAY_API_KEY_VALUE 

pub const GATEWAY_API_KEY_VALUE: &str = "value";

Canonical K8s Gateway API v1 HTTPPathMatch value scalar-axis key every gateway_routes-emitted HTTPRoute per-match path block mounts its request-path-selection scalar payload under (spec.rules[].matches[].path.value). Nests one level beneath the sibling GATEWAY_API_KEY_PATH per-HTTPRouteMatch path-matcher container-axis it hangs off of — the Gateway API v1 CRD schema pins per-HTTPPathMatch request-path selection through the {type, value} two-axis pair (a GATEWAY_API_PATH_MATCH_TYPE_PATH_PREFIX-typed type discriminator picks Exact | PathPrefix | RegularExpression; the value scalar carries the per-match request-path string the discriminator is applied against), so drift on the value scalar axis is exactly as load-bearing as drift on the peer type discriminator axis it nests alongside (the K8s apiserver-side Gateway API CRD schema validator drops any per-match block whose HTTPPathMatch scalar-payload axis carries an unrecognized key — a "path" / "prefix" / "pattern" typo silently emits an HTTPRoute whose per-match request-path predicate the Gateway API implementation’s per-rule L7 dispatch loop treats as bare (no value evaluated against the type discriminator), the match degrades to the wildcard predicate at the gateway-class- controller’s per-rule reconcile, the rule matches every request path unconditionally, and every external :entrada path filter the rule was authored to enforce drops with no field naming the HTTPPathMatch-scalar-payload-drift root cause).

The single source of truth the rendered Aplicacao Gateway-API-side ingress bundle’s per-HTTPPathMatch scalar-payload-axis-naming reaches for:

• the rendered HTTPRoute document’s per-match spec.rules[].matches[].path.value axis (caixa-mesh/src/lib.rs — the gateway_routes per-Aplicacao HTTPRoute’s per-match path_match.insert("value", …) call seeded from the Aplicacao’s :entrada :paths slot).

The per-HTTPPathMatch scalar-payload axis names the same Gateway-API-implementation-side per-match request-path-selection scalar as the sibling GATEWAY_API_KEY_PATH per-HTTPRouteMatch path-matcher container-axis it nests inside of, and must move together on any future Gateway API rebrand (an upstream SIG-Network Gateway API v2 rename of the HTTPPathMatch scalar- payload axis from value to path / pattern / expression, coordinated with the Gateway API deprecation cycle). Until this lift landed the axis carried an inline "value" literal at the one production-code occurrence in caixa-mesh/src/lib.rs (the gateway_routes per-match path_match.insert("value", …) call) — one occurrence of the same load-bearing Gateway-API-CRD- HTTPPathMatch-value-axis-key convention, drift-prone by construction. A drift on the production site to "path" / "prefix" / "pattern" would have surfaced as a Gateway API implementation-side schema validator drop at apply time (the affected per-match HTTPPathMatch scalar-payload axis the CRD schema validator recognizes as unknown), with the per-match path predicate degrading to the wildcard match at the gateway-class- controller’s per-rule reconcile with no field naming the HTTPPathMatch-scalar-payload-drift root cause.

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the GATEWAY_API_KEY_PATH (9f45aa4) / GATEWAY_API_KEY_MATCHES (b9ede1a) / GATEWAY_API_KEY_BACKEND_REFS (a6c5679) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_HOSTNAMES (b77f744) / GATEWAY_API_KEY_HOSTNAME (c96fa22) / GATEWAY_API_KEY_TIMEOUTS (db31108) / GATEWAY_API_KEY_RETRY (231bbf5) / GATEWAY_API_KEY_GATEWAY_CLASS_NAME (1bc727d) lifts established on the sibling canonical-Gateway-API-body-axis surfaces — nests the per-Gateway-API-HTTPRoute-per-match-body-axis canonical- string-pin set (path container-axis, type discriminator scalar-key, value scalar-payload key) two levels deeper onto the per-HTTPPathMatch body-axis surface, so both halves of the HTTPPathMatch.{type, value} typed contract now thread one lifted &'static str apiece at the substrate boundary alongside the parent-container-axis key. The render-side consumer now threads the same &'static str through its path_match.insert(…) call so a future Gateway API rebrand on the HTTPPathMatch scalar- payload axis (or an upstream SIG-Network Gateway API v2 rename to a per-HTTPPathMatch sibling name) lands in one place; every future renderer that reaches for the canonical per-HTTPPathMatch scalar-payload axis (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao HTTPRoute fan-out, a future per-edge GRPCRoute renderer whose per-match GRPCMethodMatch.method scalar-payload nests alongside this same axis, a future per-match header-match / query-match renderer whose per-predicate HTTPHeaderMatch.value / HTTPQueryParamMatch.value scalar-payload binds against sibling axes on the same value axis-key) inherits the same value by construction with no opportunity for per-renderer drift.