Module candidate_error 

The one failure type of the candidate layer and its closed list of causes. What: The one failure type of the candidate layer, with a closed list of causes. Why: Every candidate failure stops policy evaluation (a file that could not be read was not checked), and callers branch on the cause without parsing message text.

In TS you’d write (pseudocode):

class CandidateError extends Error { readonly failure: CandidateFailure }

Structs

CandidateError

What: One candidate failure: its cause and a complete explanation. String is a heap-allocated, growable UTF-8 buffer this struct owns. Sibling the reader might expect: &str, a borrowed view that owns nothing. Why: The error outlives the formatted text built at the failure site, so a borrowed &str would dangle. Messages never contain file content or pathnames: a pathname can itself be a forbidden string.

Enums

CandidateFailure

What: Why candidate listing or reading failed. #[derive(...)] generates copying, debug printing and ==. Why: The policy engine maps causes to engine-failure codes, and tests name the exact cause instead of matching diagnostic wording.