# SSA conflict — cub server-side apply vs Helm's silent overwrite on a manual edit

**UNOFFICIAL/EXPERIMENTAL.** Live receipt generated by `scripts/run-ssa-conflict-gap.mjs`; do not hand-edit. Regenerate with `npm run ssa-conflict:proof`.

**Claim.** cub's managed delivery uses server-side apply. When a user has manually edited a field (kubectl scale), a server-side re-apply FAILS with a field-manager conflict (a wall of Kubernetes SSA text); Helm's client-side apply silently OVERWRITES and 'just works'. cub's behavior is arguably safer (no silent clobber) but is different and confusing for a Helm user — and under 'people avoid different/confusing' it must be MANAGED with a plain-words message and a clear reconcile/force path, not surfaced raw.

Under the adoption lens (worse-than / more-confusing-than Helm, and managed?): cub's managed delivery uses **server-side apply**. Proven live on a throwaway kind cluster — a deployment is delivered, a user manually `kubectl scale`s it, then it is re-delivered:

| Re-delivery | Outcome on the manually-edited field (`.spec.replicas`) |
| --- | --- |
| **cub** (server-side apply) | yes → **CONFLICT (confusing for a Helm user)** |
| **Helm** (client-side apply) | overwrote silently, replicas->1 (Helm's behavior) |

Overall: **watch**. Confirmed: cub's server-side-apply delivery conflicts on a manually-edited field where Helm silently overwrites. Defensible (safer) but different + confusing. Manage it: detect the conflict, explain in plain words ('spec.replicas was changed outside cub — reconcile, or re-apply with --force-conflicts'), and offer the choice — don't surface raw k8s SSA text.

- **Not a bug — a trade-off.** cub's conflict is arguably *safer*: it refuses to silently clobber a human's manual change. Helm's silent overwrite is convenient but can erase a hotfix.
- **But it is different + confusing.** A Helm user who manually tweaks one field and re-delivers gets a wall of SSA conflict text where Helm just worked — exactly the kind of surprise people bounce off of.
- **Manage it:** detect the conflict and say, in plain words, "`.spec.replicas` was changed outside cub — reconcile it, or re-apply with `--force-conflicts`", and offer the choice. Don't surface raw Kubernetes server-side-apply output.
- Receipt: `runs/ssa-conflict-gap/receipt.yaml`.