The catalogue of metric instruments Écluse emits: the ecluse.* domain signals plus the OpenTelemetry HTTP server semantic convention. Each maps to its wire name through metricName; a typed enum so the catalogue is enumerable (and asserted whole in the tests) rather than a scatter of string literals.

Queue backlog and DLQ depth are deliberately absent -- those are cloud-native metrics (CloudWatch, Cloud Monitoring), not signals Écluse re-emits. Advisory-sync metrics are deferred until the advisory subsystem exists.

The wire name of a MetricName.

Every metric in the catalogue (the Generic-derived Universe enumeration).

The closed set of metric label keys. Every label Écluse attaches is one of these bounded-domain keys. High-cardinality identifiers (package, version, scope, a denial message) are deliberately absent -- see highCardinalityKeys -- so they can never become a metric label.

The wire name of a LabelKey.

Every label key in the closed set.

The high-cardinality identifiers that must never be metric labels: they live on spans and the structured log line instead. The label-domain guard asserts none of these is a LabelKey wire name; there is, by construction, no Label that produces one.

The serve decision (ecluse.serve.decision).

The bucketed class of a denial reason -- a bounded summary of Ecluse.Core.Server.Response.RejectReason, not the rule name or the message (those are high-cardinality and stay on the log line).

Which upstream a data-plane fetch targeted.

The HTTP status class of an upstream response (the bounded summary of the code).

Classify an HTTP status code into its bounded StatusClass, so a status never becomes a per-code label.

The outbound-credential provider a refresh/ttl signal concerns.

A bounded error class for a failure signal (never the exception text).

The rule-evaluation tier a duration is measured at.

A metadata-cache lookup result.

A processed mirror job's result. The idempotent "already present" outcome (a registry 409) is not a distinct value: the worker treats it as a success, so it is counted as Published -- a series that could never emit is not published.

A credential-refresh result.

Which circuit breaker a state gauge concerns.

The circuit-breaker state, recorded as the value of the ecluse.rule.breaker.state gauge (labelled by BreakerSource). It is a bounded measurement, not a label.

The gauge code for a breaker state: 0 closed, 1 half-open, 2 open -- a small ordinal so a dashboard can alarm on "not closed" without a high-cardinality label.

A single metric label: a bounded key paired with its bounded value. There is no constructor for a package, version, scope, or message, so a high-cardinality identifier cannot be turned into a label. LRule carries a rule's configured name -- the one operator-bounded label (a deployment defines a small, fixed rule set).

The LabelKey a Label is filed under.

Project a Label to its (key, value) wire pair.

Materialise a label list into the OpenTelemetry Attributes an instrument is recorded with. Every value is bounded, so the attribute set an instrument ever sees is drawn from a small fixed product of the label domains -- never the unbounded space of package identifiers.