Constant GATEWAY_API_KEY_PATH 

pub const GATEWAY_API_KEY_PATH: &'static str;

Canonical K8s Gateway API HTTPRoute per-HTTPRouteMatch path-matcher container-axis key every gateway_routes-emitted HTTPRoute per-rule matches[] entry mounts its per-match {type, value} path-selection predicate under (spec.rules[].matches[].path). Re-export of the canonical caixa_core::GATEWAY_API_KEY_PATH so the Gateway-API- implementation-side per-HTTPRouteMatch path-matcher-container-axis- key string lives in exactly one place across every caixa renderer — caixa-mesh’s gateway_routes per-Aplicacao HTTPRoute emitter (the per-match match_entry.insert("path", …) call the prior inline "path" literal sat at, seeded from the Aplicacao’s :entrada :paths slot) and every future per-Gateway-API-side renderer the M3.x absorption roadmap acknowledges now consult the same &'static str, so a future Gateway API rebrand on the per-HTTPRouteMatch path- matcher axis (an upstream Gateway API v2 rename to pathMatch / prefix / url, coordinated with the upstream SIG-Network Gateway API deprecation cycle) is a one-line edit on the canonical caixa_core::GATEWAY_API_KEY_PATH declaration, not a coordinated rewrite across this crate’s gateway_routes renderer + every future per-target renderer the substrate adds. The prior inline literal at the one production emitter site would have let a Gateway-API-CRD per-HTTPRouteMatch path-matcher-axis rebrand or a per-emitter typo ("pathMatch" / "prefix" / "url") silently emit an HTTPRoute whose per-match path-selection axis the Gateway API CRD schema validator drops as unknown — the per-match path predicate degrades to the wildcard match at the gateway-class-controller’s per-rule reconcile, the rule matches every request path unconditionally, and every external :entrada path filter the rule was authored to enforce drops with no field naming the path-matcher-drift root cause. Peer to the GATEWAY_API_KEY_MATCHES / GATEWAY_API_KEY_BACKEND_REFS / GATEWAY_API_KEY_PARENT_REFS re-exports on the sibling canonical-Gateway-API-HTTPRoute-body- axis surface — nests the per-Gateway-API-HTTPRoute-per-rule-body- axis canonical-string re-export set (matches, backendRefs, timeouts, retry) one level deeper onto the per-HTTPRouteMatch body-axis surface this crate’s gateway_routes renderer’s external :entrada ingress contract rests on across the Gateway API HTTPRoute-side per-match body-shape. Canonical K8s Gateway API HTTPRoute per-HTTPRouteMatch path-matcher container-axis key every gateway_routes-emitted HTTPRoute per-rule matches[] entry mounts its per-match {type, value} path-selection predicate under (spec.rules[].matches[].path). Nests one level beneath the sibling GATEWAY_API_KEY_MATCHES (b9ede1a) per-rule route-match container-axis it hangs off of — the Gateway API v1 CRD schema pins per-HTTPRouteMatch request-path selection through the spec.rules[].matches[].path container axis (each match entry names one path-selection predicate the request line’s :path pseudo-header must satisfy under a type discriminator of Exact | PathPrefix | RegularExpression) alongside the sibling per- HTTPRouteMatch headers[] / queryParams[] / method axes it nests under, so drift on the per-match path-matcher container axis is exactly as load-bearing as drift on the per-rule route-match axis it nests inside of (the K8s apiserver-side Gateway API CRD schema validator drops any per-match block whose path-matcher container axis carries an unrecognized key — a "pathMatch" / "prefix" / "url" typo silently emits an HTTPRoute whose per- match path-selection axis the Gateway API implementation’s per-rule L7 dispatch loop no-ops entirely: no path predicate is evaluated, the match degrades to the wildcard predicate at the gateway-class- controller’s per-rule reconcile, the rule matches every request path unconditionally, and every external :entrada path filter the rule was authored to enforce drops with no field naming the path- matcher-axis-drift root cause).

The single source of truth the rendered Aplicacao Gateway-API-side ingress bundle’s per-HTTPRouteMatch path-matcher-container-axis- naming reaches for:

• the rendered HTTPRoute document’s per-match spec.rules[].matches[].path axis (caixa-mesh/src/lib.rs — the gateway_routes per-Aplicacao HTTPRoute’s per-match match_entry.insert("path", …) call seeded from the Aplicacao’s :entrada :paths slot).

The per-HTTPRouteMatch path-matcher container axis names the same Gateway-API-implementation-side per-match request-path-selection predicate container as the sibling GATEWAY_API_KEY_MATCHES per-rule route-match container axis it nests inside of, and must move together on any future Gateway API rebrand (an upstream SIG-Network Gateway API v2 rename of the path- matcher axis from path to pathMatch / prefix / url, coordinated with the Gateway API deprecation cycle). Until this lift landed the axis carried an inline path literal at the one production-code occurrence in caixa-mesh/src/lib.rs (the gateway_routes per-match match_entry.insert("path", …) call) — one occurrence of the same load-bearing Gateway-API-CRD- path-axis-key convention, drift-prone by construction. A drift on the production site to "pathMatch" / "prefix" / "url" would have surfaced as a Gateway API implementation-side schema validator drop at apply time (the affected per-match path-matcher axis the CRD schema validator recognizes as unknown), with the per-match path predicate degrading to the wildcard match at the gateway- class-controller’s per-rule reconcile with no field naming the path-matcher-drift root cause.

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the GATEWAY_API_KEY_MATCHES (b9ede1a) / GATEWAY_API_KEY_BACKEND_REFS (a6c5679) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_HOSTNAMES (b77f744) / GATEWAY_API_KEY_HOSTNAME (c96fa22) / GATEWAY_API_KEY_TIMEOUTS (db31108) / GATEWAY_API_KEY_RETRY (231bbf5) / GATEWAY_API_KEY_GATEWAY_CLASS_NAME (1bc727d) lifts established on the sibling canonical-Gateway-API-HTTPRoute-body-axis / per-Gateway- body-axis surfaces — nests the per-Gateway-API-HTTPRoute-per-rule- body-axis canonical-string-pin set (matches, backendRefs, timeouts, retry) one level deeper onto the per-HTTPRouteMatch body-axis surface, so the container-axis key beneath the sibling matches[] axis now threads a lifted &'static str alongside its parent-container-axis key. The render-side consumer now threads the same &'static str through its match_entry.insert(…) call so a future Gateway API rebrand on the per-HTTPRouteMatch path-matcher axis (or an upstream SIG-Network Gateway API v2 rename to a per- HTTPRouteMatch sibling name) lands in one place; every future renderer that reaches for the canonical per-HTTPRouteMatch path- matcher axis (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao HTTPRoute fan-out, a future per-edge GRPCRoute renderer whose per-match request-method / service / method predicate nests alongside the path predicate, a future per-match header-match / query-match renderer whose per-predicate list binds against sibling axes of this one under the same match entry) inherits the same value by construction with no opportunity for per-renderer drift.

Same “the typed constant lives in one place” discipline the GATEWAY_API_KEY_MATCHES (b9ede1a) / GATEWAY_API_KEY_BACKEND_REFS (a6c5679) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_HOSTNAMES (b77f744) / GATEWAY_API_KEY_HOSTNAME (c96fa22) / GATEWAY_API_KEY_TIMEOUTS (db31108) / GATEWAY_API_KEY_RETRY (231bbf5) / GATEWAY_API_KEY_GATEWAY_CLASS_NAME (1bc727d) lifts apply on the peer canonical-Gateway-API-HTTPRoute-per-HTTPRouteMatch-body-axis surface.