Function require_positive_bounded 

pub fn require_positive_bounded<T, E>(
    value: T,
    cap: T,
    on_zero: impl FnOnce() -> E,
    on_cap_exceeded: impl FnOnce(T) -> E,
) -> Result<(), E>
where
    T: BoundedInteger,

Bracket a typed integer axis with the “zero-floor + upper-cap” gate pair every capped-integer :politicas / :supervisor / :limits axis carries. Returns on_zero() when value == T::ZERO, on_cap_exceeded(value) when value > cap, Ok(()) otherwise. Generic over the caller’s error enum so the same helper reaches every crate-level thiserror surface, and over the axis’s primitive-integer type T via the sealed BoundedInteger trait so the two typed-integer widths in the crate (u32 and u64) share one canonical dispatch — the seven per-axis error variants remain the source of truth for each axis’s remediation prose; the helper only sequences the two gate arms in canonical order and threads the value into the cap arm’s discriminator field.

The zero-floor arm strictly precedes the cap arm so a literal T::ZERO value surfaces the self-locating zero diagnostic (which every per-axis error variant already documents an “omit the axis to express no-bound” remediation for) rather than the misleading 0 > cap false-negative on the cap arm. Same ordering discipline every existing per-axis inline if value == 0 { … } if value > CAP { … } block already applied — this lift makes the ordering a property of the helper, not a per-call-site convention seven sites re-derive.

Seven identical-shape call sites collapse onto this helper — six on the T = u32 axis:

• crate::AplicacaoSpec::validate_politicas on MeshPolicy::retries (zero → crate::AplicacaoError::PolicyRetriesZero, cap → crate::AplicacaoError::PolicyRetriesExceedsCap, cap = crate::POLICY_RETRIES_MAX), CircuitBreaker::max_failures (zero → crate::AplicacaoError::PolicyBreakerZeroFailures, cap → crate::AplicacaoError::PolicyBreakerMaxFailuresExceedsCap, cap = crate::POLICY_BREAKER_MAX_FAILURES_MAX), and RateLimit::rate (zero → crate::AplicacaoError::PolicyRateLimitZero, cap → crate::AplicacaoError::PolicyRateLimitExceedsCap, cap = crate::POLICY_RATE_LIMIT_MAX);
• crate::SupervisorSpec::validate on max_restarts (zero → crate::SupervisorError::ZeroMaxRestarts, cap → crate::SupervisorError::MaxRestartsExceedsCap, cap = crate::SUPERVISOR_MAX_RESTARTS_MAX);
• crate::LimitsSpec::validate on cpu (zero → crate::LimitsError::CpuZero, cap → crate::LimitsError::CpuExceedsCap, cap = crate::LIMITS_CPU_MILLICORES_MAX);

and one on the T = u64 axis:

• crate::LimitsSpec::validate on fuel (zero → crate::LimitsError::FuelZero, cap → crate::LimitsError::FuelExceedsCap, cap = crate::LIMITS_FUEL_MAX).

The two named u32 / u64 sibling helpers (require_positive_bounded_u32, require_positive_bounded_u64) are one-line delegates onto this generic entry-point so the seven existing call sites route through one function body — a future tightening of the two-arm discipline (an audit-log hook, an instrumentation counter, the M4 CR materializer’s admission-webhook per-axis floor) reaches every consumer by one edit at this helper, not a coordinated rewrite across two type-specific bodies. Peer to the ternary require_positive_canonical_bounded_duration (typed-Duration axes) and the quaternary require_positive_quantum_multiple_bounded_u64 (byte-quantized :memory axis) on the same closure-based caller-error-variant discipline.

Errors

Returns on_zero() for value == T::ZERO; returns on_cap_exceeded(value) for value > cap; returns Ok(()) otherwise.