Function structured_boundary_error 

pub fn structured_boundary_error(sink: &str, value: &Value) -> Option<String>

Decision D: reject a bare collection value crossing a process-boundary sink — an external command’s argv element, or a redirect target. String interpolation ("$c") already reduces to a Value::String (rendering compact JSON) before reaching either sink, so only a live, un-interpolated Value::Json(Array|Object) — a bare $c — trips this. sink names the boundary in the message (e.g. “a command argument”, “a redirect target”). None for scalars. Callers: kernel.rs (build_args_flat, try_execute_external), dispatch.rs (try_external, test-only twin), scheduler/pipeline.rs (eval_redirect_target).