Function identity_source_path 

pub fn identity_source_path(
    policy: &SnapshotPolicy,
    pin: Option<&SnapshotSourceRef>,
) -> Result<Option<String>, ValidationError>

THE kopia source path a SnapshotPolicy’s governing source records — the single derivation every identity site must use (#451).

Why this function exists

Six places resolve a policy’s kopia identity: the backup mover (snapshot::build::resolve_identity_for), the policy reconciler’s config_identity / config_identity_for_path / resolve_config_identity, the verification reconciler’s verify_identity, and the webhook’s identity_collision::resolve_policy_identity. Each of them used to re-derive the path inline from sources.first()’s pvc/nfs — a pattern that is correct only for the two source kinds that existed when it was written.

A stream source has neither a pvc nor an nfs, so five of the six resolved a PATHLESS (or /data) identity while the backup side recorded /stream/<fileName>. Every consequence was silent: a fromPolicy Restore looked for user@host:/data and reported SnapshotNotFound; quick verification verified a path with no manifests and exited 0; the collision webhook collapsed every stream policy onto one pathless identity, raising false collisions and missing real ones; and identities_match compares source paths field-by-field, so a discovered stream snapshot could never be adopted.

Routing every site through here — and removing the raw pvc/nfs pieces from crate::IdentityInputs, so no caller can re-derive a path — makes a seventh site structurally unable to drift.

Semantics

Exactly EffectiveSource::kopia_source_path under the governing source’s strategy_for, which is byte-identical to the old inline derivation for every pvc/nfs/selector/override shape and additionally correct for stream. Ok(None) is kopia’s identity-only username@hostname form: a selector source with no fan-out pin, or a zero-source legacy policy, which is deliberately tolerated rather than turned into a terminal error (admission forbids it; a hand-patched object may still carry it, and a working restore must not break on upgrade).