Function effective_source_in 

pub fn effective_source_in(
    sources: &[Source],
    policy_namespace: &str,
    policy_name: &str,
    pin: Option<&SnapshotSourceRef>,
) -> Result<EffectiveSource, ValidationError>

effective_source over a bare sources[] + namespace + name.

The webhook validates a SnapshotPolicySpec it has no full object for, so the derivation has to be reachable without one. effective_source is a thin wrapper over this, which keeps the two on ONE code path — a spec-level derivation that drifted from the object-level one is exactly the class of bug identity_source_path_in exists to make impossible.