Constant GATEWAY_API_KEY_RETRY 

pub const GATEWAY_API_KEY_RETRY: &str = "retry";

Canonical K8s Gateway API HTTPRoute per-rule retry-policy body-axis key every gateway_routes-emitted HTTPRoute document mounts its per-rule :politicas :retries overlay under (spec.rules[].retry). Sibling per-rule-body-axis peer to GATEWAY_API_KEY_TIMEOUTS (db31108) — same Gateway-API-CRD-body-axis discipline nested onto the per-rule retry-budget slot the Gateway API v1 CRD schema pins under HTTPRoute.spec.rules[] beside the sibling per-rule request-timeout- policy container.

The Gateway API v1 CRD schema pins the per-rule retry policy through the HTTPRouteRetry sub-shape mounted at spec.rules[].retry, whose attempts scalar (peer to future codes retryable-status-code list and backoff inter-attempt backoff-window scalars) carries the per- rule retry-budget the Gateway-API-implementation-side per-rule request-dispatch loop compares each failed attempt count against before giving up on the in-flight backend call. Drift on the per-rule retry-policy body-axis is exactly as load-bearing as drift on the sibling per-rule request-timeout-policy axis (timeouts): the K8s apiserver-side Gateway API CRD schema validator drops any per-rule entry whose per-rule retry-policy axis carries an unrecognized key — a "retries" (plural) / "retryPolicy" / "budget" typo silently emits an HTTPRoute whose per-rule retry-budget the Gateway API implementation’s per-rule request-dispatch loop no-ops entirely: the route accepts every inbound request with no per-rule retry budget (the “no infinite retrying without bound” guarantee MESH-COMPOSITION.md §V mandates for every rendered per-:politicas mesh-composition edge silently regresses to the pre-overlay unbounded-retry semantic, and every external :entrada flow the route was authored to cap by the typed :politicas :retries slot runs to whatever retry policy the resolved ComputeUnit / Service / ExternalName backend’s downstream infrastructure — Envoy default retry policy, client SDK autoretry, node-local conntrack retries — with no field naming the per-rule-retry-policy- axis-drift root cause).

The single source of truth the rendered Aplicacao Gateway-API-side ingress bundle’s per-HTTPRoute per-rule retry-policy-axis-naming reaches for:

• the rendered HTTPRoute document’s per-rule retry: axis (caixa-mesh/src/lib.rs — the gateway_routes per-Aplicacao HTTPRoute’s per-rule rule.insert("retry", …) call seeded from the Aplicacao’s :politicas :retries overlay when the slot is set, elided from the emit sequence when the slot is unset).

The per-rule retry-policy axis names the same Gateway-API- implementation-side per-rule request-dispatch retry-budget container as the sibling GATEWAY_API_KEY_TIMEOUTS per-rule request-timeout- policy container axis it sits beside under spec.rules[].*, and must move together on any future Gateway API rebrand (an upstream SIG-Network Gateway API v2 rename of the per-rule retry-policy axis from retry to retries / retryPolicy / budget, coordinated with the Gateway API deprecation cycle). Until this lift landed the axis carried an inline retry literal at nine physical sites in caixa-mesh/src/lib.rs (one production emitter at the gateway_routes per-rule rule.insert(…) call plus eight test-side navigators pinning the overlay’s rule-level top-key-set, presence, absence, per-rule fan-out under multi-:entrada :paths, round-trip of the typed u32 attempt count, YAML integer scalar-kind, and independent- axis coexistence with the sibling timeouts per-rule request- timeout-policy axis in both directions), the highest per-axis occurrence count of any un-lifted Gateway-API-CRD-body-axis in the crate — same nine-site count the peer sibling GATEWAY_API_KEY_TIMEOUTS lift closed on the coexisting per-rule request-timeout-policy axis.

The PRIME DIRECTIVE duplication-budget rule (THEORY.md §I.3.5, “every recurring shape becomes a generator before it becomes a pattern; every pattern becomes a library before it becomes duplicated code. The duplication budget is zero.”) promotes the constant to a typed substrate-side &'static str on the same trajectory the GATEWAY_API_KEY_TIMEOUTS (db31108) / GATEWAY_API_KEY_HOSTNAMES (b77f744) / GATEWAY_API_KEY_HOSTNAME (c96fa22) / GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_BACKEND_REFS (a6c5679) / CILIUM_KEY_PORTS (1087693) / CILIUM_KEY_FROM_ENDPOINTS (ecfa557) / CILIUM_KEY_INGRESS (0400a9b) / CILIUM_KEY_ENDPOINT_SELECTOR (7088789) / CILIUM_KEY_TO_PORTS (c8d9cbf) / KUBE_KEY_RULES (a205eb3) lifts established on the sibling canonical-Gateway-API-CRD-body-axis / canonical-Cilium-CNP-body-axis surfaces — closes the pair of per- Gateway-API-HTTPRoute-per-rule :politicas overlay axes (timeouts for :politicas :timeout, retry for :politicas :retries) both MESH-COMPOSITION.md §V “no infinite blocking / no infinite retrying” guarantees rest on. The render-side consumer now threads the same &'static str through its per-rule rule.insert(…) call and every test-side navigator’s .get(…) retrieval so a future Gateway API rebrand on the per-rule retry- policy axis lands in one place; every future renderer that reaches for the canonical per-rule retry-policy axis (the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer’s per-Aplicacao per-rule retry-policy fan-out, a future per-edge codes retryable-status-code emitter honoring an M4-roadmap :politicas :retry-codes slot, a future per-edge backoff inter-attempt backoff-window emitter honoring an M4-roadmap :politicas :retry-backoff slot) inherits the same value by construction with no opportunity for per-renderer drift.

Same “the typed constant lives in one place” discipline the GATEWAY_API_KEY_TIMEOUTS (db31108) / GATEWAY_API_KEY_HOSTNAMES (b77f744) / GATEWAY_API_KEY_HOSTNAME (c96fa22) / GATEWAY_API_KEY_LISTENERS (29f2415) / GATEWAY_API_KEY_PARENT_REFS (f44e823) / GATEWAY_API_KEY_BACKEND_REFS (a6c5679) / CILIUM_KEY_PORTS (1087693) / CILIUM_KEY_FROM_ENDPOINTS (ecfa557) / CILIUM_KEY_INGRESS (0400a9b) / CILIUM_KEY_ENDPOINT_SELECTOR (7088789) / CILIUM_KEY_TO_PORTS (c8d9cbf) / KUBE_KEY_RULES (a205eb3) lifts apply on the peer canonical- Gateway-API-HTTPRoute-per-rule-body-axis surface.