Function check_installed_rows 

pub fn check_installed_rows(
    namespace: &[ContainerMount],
    installations: &[Installation],
    is_plans_first_row: impl Fn(&ContainerMount) -> bool,
) -> Result<(), String>

Refuse a walk (assign_installed_rows) whose result does not show the plan as installed: every installation that creates a row (one with a mountpoint) must have been given a row at its own recorded target, and the row given to the first installation must be the container’s own /proc (is_plans_first_row; a copy of the host’s /proc, at the same path but earlier, would mean the walk ran past the plan into the host’s rows). The reason names the first installation that fails.