Function all 

pub fn all<K>(client: Client) -> Api<K>
where
    K: Resource<DynamicType = ()>,

Bind a cluster-scoped typed Api<K> handle from an owned Client for any K that satisfies the standard kube::Resource projection with a zero-sized DynamicType (every derive-generated CRD + every K8s built-in Rust binding meets this bound).

Owns the 1-link chain Api::all(<client>) at ONE substrate site across every workspace consumer that reads or writes a cluster-scoped typed collection through a typed handle. Sibling to crate::process_api::namespaced + crate::configmap::namespaced on the (scope × K) axis pair — those own the namespaced-scope shape at a fixed K; this owns the cluster-scope shape at any K.

The K type parameter is inferred from the callsite’s return- type annotation (or its enclosing -> Api<K> signature), so a caller writes tatara_process::api::all(self.kube.clone()) and gets the same typed handle every hand-authored Api::all(client) site produced.

A future normalization of the cluster-scoped Api posture (a default-injected tracing span for handle construction, a client-side QPS budget, a fixture-backed client for CI/smoke- tests, a wired-in watch pre-warmer) lands at THIS ONE function and every downstream consumer inherits the upgrade mechanically — no per-site edit at any of the four listed callers or at future consumers.

Theory anchor: THEORY.md §VI.1 (generation over composition — the 1-link Api::all::<K>(<client>) chain recurred at 4 hand- authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger and is lifted onto the ONE workspace-wide substrate owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pin block below binds the primitive at fail-before- pass-after granularity, so a regression that drifted the scope slot from Api::all to Api::namespaced — silently narrowing a cluster-wide watch to a single namespace — surfaces at api::tests::* rather than as silent operator-facing skew across the four consumer sites).