Function kube_metadata_map_field 

pub fn kube_metadata_map_field<'a>(
    value: &'a Value,
    field: &str,
) -> Option<&'a Mapping>

Read the sub-metadata.<field> YAML sub-mapping on a K8s custom resource YAML document as Option<&serde_yaml::Mapping> — the composed sub-mapping-arity per-sub-field-mapping accessor peer that stands on the composed scalar-arity kube_metadata_field (450f1ff) accessor, folding the trailing .and_then(|v| v.as_mapping()) shape-gate closure into the helper for callers that always want a mapping (the load-bearing per-CR identity sub-block mapping readbacks — metadata.labels on every K8s CR the label-based selector join reaches through, metadata.annotations on per-tenant scoping / Server-Side-Apply field-ownership CRs, and every other sub-metadata.<field> nested- object axis the ObjectMeta contract admits). Structural mirror of the sibling kube_spec_map_field (27fc2ee) on the sub- spec.<field> axis: both accessors fold a trailing .as_mapping() shape-gate closure onto their crate’s composed scalar-arity per-sub-field-Value accessor primitive (kube_metadata_field here, kube_spec_field on the sibling), both stay parametric on the per-<field> sub-field axis-key (metadata stays open-ended on the K8s ObjectMeta-sub-field surface, spec-body stays open-ended on the K8s CRD-schema surface). Together they bracket the two canonical composed per-sub-mapping- field sub-mapping readback surfaces every K8s CR document the emit- side kube_resource_skeleton renders admits: metadata.<field> for per-CR identity nested-object coordinates via this accessor, spec.<field> for per-CR body nested-object coordinates via the sibling.

Returns None on any of the four short-circuit arms folded through the underlying composition: the outer metadata: block is absent (the kube_metadata outer-arm short-circuit — a legally-omitted per-CR identity sub-block on List-shaped documents or on external YAML shapes that carry no ObjectMeta-flavoured header), the metadata: value is present but carries a non-Mapping YAML type (the kube_metadata shape-gate short-circuit — a schema-invalid identity shape per the K8s API-machinery contract tolerated here as None so the readback stays a total function), the requested sub-field <field> axis-key is absent from the metadata: sub-mapping (the kube_metadata_field trailing Mapping::get none-arm — a legally-omitted per-metadata-axis surface on a CR that carries other identity sub-fields but not this one), or the sub-field value is present but carries a non- mapping YAML type (the trailing .as_mapping() shape-gate short- circuit — a schema-invalid per-CR identity-sub-field type per the K8s apiserver’s OpenAPI schema but tolerated here as None so the readback stays a total function). The returned &Mapping borrows into the input Value — the caller decides whether to look up a nested key (.get(<KEY>)), enumerate for length (.len()), iterate (.iter()), or check emptiness (.is_empty()).

The immediate load-bearing recomposition target is the sibling pinned peer kube_metadata_labels (f3d9fcd) on the metadata.labels sub-mapping axis: pre-lift it carried the raw three-hop value.get(KUBE_KEY_METADATA).and_then(|m| m.get(KUBE_KEY_LABELS)).and_then(|l| l.as_mapping()) chain (the same shape this parametric helper closes on with the sub-field axis-key pinned to KUBE_KEY_LABELS); post-lift it composes as kube_metadata_map_field(value, KUBE_KEY_LABELS), folding onto the substrate primitive rather than re-inlining the three-hop walk. Structural mirror of the way sibling kube_name / kube_namespace compose on kube_metadata_str_field rather than re-walking the two-hop metadata.<field> navigation.

The field axis stays parametric (rather than pinned to a specific canonical sub-field like KUBE_KEY_LABELS as separate helpers) because the K8s API-machinery ObjectMeta contract admits an open-ended per-CR identity sub-mapping-field surface — one helper covers every readback axis today (KUBE_KEY_LABELS via the composed pinned kube_metadata_labels peer, and every future sub-mapping-shaped ObjectMeta sub-field like metadata.annotations for per-tenant scoping / Server-Side-Apply field-ownership annotations, per-CR admission-webhook config hints, per-tenant label-prefix routing hints under M4 fan-out) with the axis-key threaded through the call. Every future per-CR metadata.<field> sub-mapping readback (the future per-:politicas CiliumClusterwideEnvoyConfig emitter’s per- policy metadata.annotations navigation, MESH-COMPOSITION §III.2 #3; the app-operator’s per-Aplicacao mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s metadata.annotations readback for controller-owned admission- hint wiring, §III.2 #5; the future caixa-otel per-Servico OpenTelemetry-Collector CR’s metadata.annotations navigation for per-tenant scoping; every future test-side metadata.<field> sub- mapping probe the M3.x + M4 renderer set adds) reaches this same helper by construction — no per-consumer three-hop chain re- inline, no per-consumer KUBE_KEY_METADATA axis-key drift, no coordinated rewrite across every per-CR identity-sub-field sub- mapping readback on a future K8s API-machinery rebrand of the top-level metadata: axis.