Function expand_sources 

pub fn expand_sources(
    policy: &SnapshotPolicy,
    base_name: &str,
    matched: &BTreeMap<usize, Vec<PvcTargetRef>>,
) -> Result<Option<Vec<ExpandedMember>>, ValidationError>

Pure. Expand one policy’s sources against an already-matched PVC set.

matched is (namespace, name) per source index — the caller does the cluster IO ([match_pvcs]), this decides the names and pins.

Returns Ok(None) when the policy has no selector source at all, meaning “mint exactly one child with no spec.source”, i.e. today’s behavior. That distinction matters: an empty Vec would mean “a selector matched nothing”, which is a different and much louder situation.

The collision guard

sourcePathStrategy defaults to PvcName → /pvc/<name>. A selector with a cross-namespace namespaceSelector matching a PVC called data in two namespaces therefore yields two kopia sources at the identical user@host:/pvc/data, silently merging two volumes’ histories into one stream — under a single KOPIA_KEEP_MAX retention pin, so they also prune each other. detect_identity_collision cannot catch this: it compares across policies and skips self. So it is caught here, before anything is created.