Function apply_patch_params 

pub fn apply_patch_params(field_manager: &str) -> PatchParams

Server-side-apply PatchParams with field_manager bound to the caller-supplied slot and force = true — the ONE substrate primitive owning the PatchParams::apply(<mgr>).force() incantation every workspace SSA writer restated by hand pre-lift.

SSA-side sibling to merge_status on the (wire-posture × axis) pair: merge_status owns the merge-patch axis (Patch::Merge + PatchParams::default() over /status); this primitive owns the server-side-apply axis (Patch::Apply + PatchParams::apply(<mgr>).force() over the primary resource). Together they own the two wire-side write-posture primitives the workspace’s controllers stamp.

Pre-lift the 2-link chain was hand-authored at THREE consumer sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold, spanning THREE crates:

• tatara-pool-reconciler::controller_allocation (bind arm + release arm) — PatchParams::apply(&ctx.config.field_manager) .force() on the Process patch that stamps requestor / allocation binding annotations, and on the return-trigger annotation patch.
• tatara-export-worker::main::write_receipt — PatchParams::apply ("tatara-export-worker").force() on the receipt ConfigMap apply.

And a fourth site owns the reconciler-crate-local [FIELD_MANAGER]-bound wrapper (tatara_reconciler::ssapply::apply_patch_params), which post-lift delegates to THIS substrate primitive rather than re-stating the chain: the SSA-side wire posture now has ONE workspace-wide owner.

The field_manager slot is caller-supplied because the SSA writers this primitive serves span three different field-manager disciplines:

• tatara-reconciler — a pub const FIELD_MANAGER: &str = "tatara-reconciler" bound at the reconciler-crate wrapper.
• tatara-pool-reconciler — a per-instance ctx.config.field_manager String, so a per-shard or per-cluster deployment can distinguish its allocator’s SSA writes from a sibling deployment’s.
• tatara-export-worker — a "tatara-export-worker" literal, so the reconciler / operator distinguishes worker-emitted receipt ConfigMaps from reconciler-emitted resources at field-manager ownership queries.

The force = true semantics matches the SSA force directive every pre-lift chain applied — every consumer of this primitive is the authoritative owner of the field pathways it stamps (rendered-resource annotations, RELEASED_FROM marker, ProcessTable.status.claims, allocation-bind annotations, receipt ConfigMap data) and reclaims conflicting slots from prior field-manager owners on every apply.

A #[must_use] return keeps a caller from building a PatchParams via this primitive and then dropping it un-passed to Api::patch; the primitive exists to be consumed at a wire-side write, not to probe field-manager state.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .apply(<mgr>).force() chain recurred at 3 hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, spanning three workspace crates, and is lifted to ONE workspace-wide substrate owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pin block below binds the primitive at fail-before-pass-after granularity, so a regression that drops .force(), drifts the field-manager pass-through, or widens the posture surfaces at THESE pins rather than as silent SSA writer skew across the three consumer crates).