Function validate_binding 

pub fn validate_binding(binding: &Binding) -> Result<(), Vec<CapabilityError>>

Validate a binding against the medium-capability matrix and the in-record source rules, returning every refusal (empty Err never returned — Ok means clean). The v2 record needs no external resolution: everything validated lives inside the one record.

Refuses:

• an empty or duplicate source name (CapabilityError::EmptySourceName / CapabilityError::DuplicateSourceName) — names key per-source state;
• a declared sync / verify operation over a web source (CapabilityError::OperationOutOfScope);
• a glob deny_paths list over a non-path-namespace medium (CapabilityError::GlobDenyIllegal);
• any declared source preparation (CapabilityError::PreparationUnsupported);
• a declared coverage_semantics: exhaustive over a non-enumerable medium (CapabilityError::CoverageExhaustiveUnsupported);
• a prune block requesting never-clobber over a non-base-retrievable medium (CapabilityError::PruneGuaranteeUnsupported, F1).