Function covers 

pub fn covers(prefix: &str, path: &str) -> bool

Whether the rule prefix covers path: it is the path, or a parent of it by whole segments (/p/acme covers /p/acme/x, never /p/acme-infra). Both are canonical.

The one segment rule, shared with the host’s browse fence (hennery_proto::paths::is_within, plan 6c’s A9), so the fence and the hat rules cannot disagree.