Constant GATEWAY_API_KEY_ATTEMPTS 

pub const GATEWAY_API_KEY_ATTEMPTS: &str = "attempts";

Canonical K8s Gateway API HTTPRoute per-rule retry-policy attempts leaf scalar-key every gateway_routes-emitted HTTPRoute document mounts its per-rule :politicas :retries typed u32 attempt count under (spec.rules[].retry.attempts). Leaf peer to the container-axis parent GATEWAY_API_KEY_RETRY (231bbf5) — the sibling per-rule retry-policy body-axis lifted in the immediately-preceding commit; this closes the parent-leaf axis pair (retry container + attempts leaf) the Gateway API v1 HTTPRouteRetry sub-shape pins under HTTPRoute.spec.rules[].retry.attempts.

The Gateway API v1 CRD schema pins the per-rule retry attempt budget through the HTTPRouteRetry.attempts scalar (peer to future HTTPRouteRetry.codes retryable-status-code list and HTTPRouteRetry.backoff inter-attempt backoff-window scalars) the Gateway-API-implementation-side per-rule request-dispatch loop compares each failed backend attempt count against before giving up on the in-flight backend call. Drift on this leaf key is exactly as load-bearing as drift on the parent per-rule retry-policy container axis (retry): the K8s apiserver-side Gateway API CRD schema validator drops any per-rule retry: entry whose leaf attempt-count key carries an unrecognized name — a "attempt" (singular) / "count" / "tries" / "maxAttempts" typo silently emits an HTTPRoute whose per-rule retry-budget the Gateway-API- implementation-side per-rule request-dispatch loop no-ops entirely (the sub-shape is parsed as an empty HTTPRouteRetry with the typed u32 attempt count silently discarded, the route accepts every inbound request with no per-rule retry budget — the “no infinite retrying without bound” guarantee MESH-COMPOSITION.md §V mandates for every rendered per-:politicas mesh-composition edge silently regresses to the pre-overlay unbounded-retry semantic, and every external :entrada flow the route was authored to cap by the typed :politicas :retries slot runs to whatever retry policy the resolved backend’s downstream infrastructure — Envoy default retry policy, client SDK autoretry, node-local conntrack retries — picks with no field naming the per-rule-retry-attempts- leaf-key drift root cause).

The single source of truth the rendered Aplicacao Gateway-API-side ingress bundle’s per-HTTPRoute per-rule retry-attempts-leaf-key- naming reaches for:

• the rendered HTTPRoute document’s per-rule retry.attempts: leaf (caixa-mesh/src/lib.rs — the gateway_routes per-Aplicacao HTTPRoute’s per-rule single_field_overlay(spec.politicas.retries, …) call seeded from the Aplicacao’s :politicas :retries overlay when the slot is set, emitting the typed u32 attempt count under this leaf key inside the sibling GATEWAY_API_KEY_RETRY container axis).

The per-rule retry-attempts leaf key names the same Gateway-API- implementation-side per-rule request-dispatch retry-budget scalar as the sibling parent GATEWAY_API_KEY_RETRY container axis it sits nested inside under spec.rules[].retry.attempts, and must move together with the parent on any future Gateway API rebrand (an upstream SIG-Network Gateway API v2 rename of the per-rule retry-attempts leaf key from attempts to attempt / count / tries / maxAttempts, coordinated with the Gateway API deprecation cycle). Until this lift landed the leaf key carried an inline attempts literal at six physical code sites in caixa-mesh/src/lib.rs (one production emitter at the gateway_routes per-rule single_field_overlay(spec.politicas.retries, "attempts", …) call plus five test-side navigators pinning the overlay’s leaf- count value, round-trip of the typed u32 attempt count, YAML integer scalar-kind, per-rule fan-out under multi-:entrada :paths, and independent-axis coexistence with the sibling timeouts per-rule request-timeout-policy axis).

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the GATEWAY_API_KEY_RETRY (231bbf5) / GATEWAY_API_KEY_TIMEOUTS (db31108) / GATEWAY_API_KEY_HOSTNAMES (b77f744) / GATEWAY_API_KEY_HOSTNAME (c96fa22) / GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_BACKEND_REFS (a6c5679) lifts established on the sibling canonical-Gateway-API-CRD-body-axis surface — closes the parent-leaf axis pair (retry container + attempts leaf) the K8s Gateway API v1 HTTPRouteRetry sub-shape pins under HTTPRoute.spec.rules[].retry.attempts, both MESH-COMPOSITION.md §V “no infinite retrying” guarantees rest on. The render-side consumer now threads the same &'static str through its single_field_overlay call and every test-side navigator’s .get(…) retrieval so a future Gateway API rebrand on the per-rule retry-attempts leaf lands in one place; every future renderer that reaches for the canonical per-rule retry- attempts leaf (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao per-rule retry-attempts fan-out) inherits the same value by construction with no opportunity for per-renderer drift.

Same “the typed constant lives in one place” discipline the GATEWAY_API_KEY_RETRY (231bbf5) / GATEWAY_API_KEY_TIMEOUTS (db31108) lifts apply on the peer canonical-Gateway-API-HTTPRoute-per-rule-body-axis surface, now extended one nesting level deeper onto the retry-container-leaf scalar.