## Context

The Data Plane already collects process-wide atomic counters and gauges. Only active connections and egress Kbps cross the authenticated heartbeat boundary.

## Goals / Non-Goals

**Goals:**

- Carry the existing low-cardinality observations with explicit units.
- Bound every numeric field and enumerate provider state.
- Keep registration capacity distinct from measured traffic.

**Non-Goals:**

- Add session, route, endpoint, credential, label, or payload fields.
- Define a new telemetry transport.
- Publish a Protocol version.

## Decisions

- Nest the values in required `GatewayTelemetry` so heartbeat telemetry is one strict atomic contract.
- Use cumulative counters and microsecond delay totals plus one processing sample per complete provider media unit; consumers can derive rates/averages without losing raw observations.
- Define queue delay as residence in the bounded provider queue, processing as active recovery/framing/QUIC work excluding queue and scheduler waits, and pacing as scheduler wait only.
- Derive measured egress from transmitted-byte deltas over monotonic elapsed time; configured capacity remains registration data.
- Keep loss as parts per million and provider state as a bounded enum.

## Risks / Trade-offs

- [Cumulative counters approach signed integer limits] → Bound at signed 64-bit and saturate consumer conversions.
- [New required object breaks RC6] → Test locally and publish only under separate immutable-version authorization.

## Migration Plan

Regenerate all bindings locally, update both consumers through the temporary workspace, and stop at the immutable publication boundary.

## Open Questions

None.