The request-lifecycle tracing layer over the OpenTelemetry substrate (Ecluse.Runtime.Telemetry): the WAI server span, the data plane's http-client child spans, and the hand-added domain spans. Every entry point takes the Telemetry handle and is inert when telemetry is off, so the middleware is id, manager settings come back untouched, and a domain-span bracket runs its body against no span. The data-plane http-client instrumentation records no request or response header and the WAI instrumentation never records Authorization, so a forwarded client token never reaches a span, while the high-cardinality package, version, and denial message deliberately do.