Module path 

The path rule every payload-supplied name is screened by.

Manifest and archive paths are joined onto a caller’s directory, so a name that escapes it writes wherever it likes. The check is purely lexical and consults no filesystem, which is what lets the builder and every consumer apply one rule rather than three approximations: a backslash is folded to a separator first so a Windows-shaped name cannot smuggle a segment past the segment checks, and then nothing absolute, nothing with a drive letter, no .., no empty segment and no NUL survives.

Functions

join_relative

Joins a validated payload-relative path onto a root using the host separator.

safe_relative_path

Normalises a payload-relative path and refuses anything that could escape its root.