Function apply 

pub async fn apply<K, B>(
    api: &Api<K>,
    name: &str,
    field_manager: &str,
    body: &B,
) -> Result<K, Error>
where
    K: Resource + DeserializeOwned + Clone + Debug,
    B: Serialize + Debug + ?Sized,

Server-side-apply the caller-composed body against the PRIMARY resource endpoint of any kube Resource under field_manager with force = true.

SSA-side sibling to merge on the (wire-endpoint × wrap-posture) pair: merge owns the primary-resource Patch::Merge + PatchParams::default() axis; this primitive owns the primary-resource Patch::Apply + PatchParams::apply(<mgr>).force() axis and composes the two-link apply_patch_params + api.patch(&Patch::Apply(...)) chain every workspace SSA writer hand-authored pre-lift at each ownership-taking apply site.

Pre-lift the 3-link chain let pp = apply_patch_params(<mgr>); api.patch(name, &pp, &Patch::Apply(&body)).await was hand-authored at THREE workspace-wide consumer sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold, spanning TWO active crates:

• tatara-reconciler::ssapply::apply_owned — the DynamicObject SSA writer for every rendered flux/aplicacao resource; the manager is [tatara_reconciler::ssapply::FIELD_MANAGER].
• tatara-reconciler::phase_machine::transition_to_releasing — the RELEASED_FROM annotation stamp on Attested/Failed → Releasing; same manager as above.
• tatara-export-worker::main::write_receipt — the receipt ConfigMap SSA apply; the manager is the "tatara-export-worker" literal.

All three sites walked the SAME two-link chain — build a PatchParams via apply_patch_params, then dispatch through api.patch(name, &pp, &Patch::Apply(&body)). Post-lift each callsite reads tatara_process::patch::apply(&api, name, <mgr>, &body).await and the params-build + Patch::Apply wire dispatch lives at ONE substrate owner.

The field_manager slot is caller-supplied because the three SSA writers this primitive serves span two field-manager disciplines: tatara-reconciler feeds its FIELD_MANAGER const (via the crate-local ssapply::apply_patch_params() wrapper’s callers, which after this lift call THIS primitive with the const directly), tatara-export-worker feeds the "tatara-export-worker" literal.

A future normalization of the SSA-side wire posture (an injectable dry_run mode, a field_validation default, a per-fleet retry policy, a resourceVersion precondition slot, a tracing-annotated span carrying the apply’s manager + body-summary for post-hoc audit) lands at THIS ONE substrate primitive (or at apply_patch_params on the params sub-axis) and every downstream SSA writer inherits the upgrade mechanically. No per-site edit at any of the three listed callers or at future consumers (a new SSA writer for a non-DynamicObject typed resource, a fourth crate stamping receipts, a per-Kind apply sink).

Return-form axis: Result<K, kube::Error> matches Api::patch verbatim. Consumers today either drop the returned K (.await.map_err(...)? at ssapply + phase_machine) or discard it through .await.map(|_| ()).with_context(...)? at export-worker; keeping the return in the signature lets a future writer that needs the reconciled resourceVersion / generation from the same wire round-trip read it without a re-fetch.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 2-link apply_patch_params + api.patch(&Patch::Apply(...)) chain recurred at 3 hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, spanning two workspace crates, and is lifted onto ONE substrate owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pin block below binds the Patch::Apply posture + the apply_patch_params pass-through + the byte-identical parity with the pre-lift chain, so a regression that drifts any surface surfaces here rather than as silent SSA writer skew across the three primary-resource apply sites).