Function apply_from_devtools 

pub fn apply_from_devtools(bytes_path: &Path, table: JumpTable) -> ApplyReport

The safe devtools entry: apply the patch library at bytes_path with table.

The one unsafe call of the devtools path lives here so the shell crates stay unsafe-free. bytes_path must be a file the app itself wrote from bytes received on the authenticated devtools connection, never a path taken from the wire: this function overwrites table.lib with it and trusts it. That, and an authenticated peer that is the patch builder for this very build, are the preconditions the devtools layer owes apply_patch’s safety contract.

Refuses, loading nothing and answering applied: false with the records, while any layout-mismatch record is unreported (see report_layout_mismatch): apply_patch itself refuses with PatchError::LayoutMismatchPending under its lock, and this entry maps that to the report. A release-profile build refuses the same way, with PatchError::ReleaseBuild.