Function single_field_overlay 

pub fn single_field_overlay<T, F>(
    slot: Option<T>,
    inner_key: &'static str,
    f: F,
) -> Option<Value>
where
    F: FnOnce(T) -> Value,

Build a single-field serde_yaml::Value::Mapping from a typed Option<T> slot — None when the slot is unset, Some(Mapping { inner_key: f(t) }) otherwise.

The canonical shape every per-:politicas overlay across caixa-mesh uses to wire a typed MeshPolicy axis through to its single-key cluster artifact:

• :politicas :timeout → timeouts: { request: <duration> } (Gateway API HTTPRoute.spec.rules[].timeouts, wired in 5f477a6)
• :politicas :retries → retry: { attempts: <number> } (Gateway API HTTPRoute.spec.rules[].retry, wired in 23b7f00)
• :politicas :mtls-required → authentication: { mode: <enum> } (Cilium CiliumNetworkPolicy.spec.ingress[].authentication, wired in 878bf81)

Until this lift the three call sites each carried a verbatim copy of the same six-line block — let mut m = serde_yaml::Mapping::new(); m.insert(Value::String(<key>.into()), <value>); Value::Mapping(m) — wrapped in spec.politicas.<axis>.map(|v| { … }). Three-of-the-pattern across one emit-site (and now structurally one-of-the-pattern in each of the next two emit-sites the M3.x roadmap acknowledges: the :circuit-breaker and :rate-limit axes’ CiliumClusterwideEnvoyConfig emitter, MESH-COMPOSITION §III.2 #3) overflows the duplication budget; this helper is the lifted typed primitive.

The caller passes:

• the typed Option<T> slot,
• the inner YAML key the artifact’s per-axis schema names (request / attempts / mode for the three landed overlays; consecutiveErrors / requestsPerUnit for the two roadmap axes), and
• a closure converting the typed T into the inner field’s serde_yaml::Value (typically a String for canonical duration / enum scalars or a Number for typed integer attempt counts).

Returns Some(Mapping) when the slot is Some, None otherwise — the caller’s if let Some(overlay) = … { rule.insert(<outer_key>, overlay.clone()) } guard for the outer key (timeouts / retry / authentication — which the per-rule iteration applies to every emitted item) becomes the single emission gate, and the inner shape is built once by the closure.

Pairs with the MeshPolicy::is_empty predicate at the typed-axis emptiness layer: is_empty() short-circuits the whole :politicas block when every axis is None; this helper short-circuits the per-axis overlay when its single axis is None. Two layers, same “named-axis-with-None-means-skip-emit” contract THEORY.md §V.2.7 render determinism extends to.