Function check_engine_launch 

pub fn check_engine_launch(
    v: &EngineLaunch<'_>,
) -> Result<(), UserDataViolation>

Judge one engine launch. A launch is refused, before anything starts, when:

1. an argument equals (or is flag=... of) a flag in forbidden_args;
2. the data directory, or an absolute environment value naming data, home, profile or config, breaks check_engine_dirs’s rules;
3. it names no isolated data directory: neither the data_dir_env variable nor the data_dir_arg flag carries a non-empty value that Guard::check_dir accepts. A data_dir the target cannot deliver (no data_dir_env) does not count, because the engine would never see it and would resolve its real per-user folder by its own default.

With refusal_probe the third rule is replaced by a second barrier, available only on Unix: the child environment must redirect HOME into a directory that passes the guard, and XDG_DATA_HOME / XDG_CONFIG_HOME (set by the launcher or inherited from this process) must do the same where set. On Windows the probe is refused outright: the engine finds its folder through the Known Folder API, which ignores the environment, so no environment redirect is a barrier there.