Function walk_json_leaves 

pub fn walk_json_leaves(value: &Value, stream: MetricStream) -> Vec<Metric>

Walk numeric leaves of a JSON value, emitting Metrics keyed by dotted paths.

Objects contribute "key.subkey" paths; arrays contribute "key.0", "key.1". Numeric leaves where as_f64() yields a finite value are emitted; String, Bool, and Null leaves are skipped. NaN/infinite f64s are rejected by serde_json at parse time, so natural inputs never reach this walker with non-finite numbers; the defensive is_finite() guard catches hand-built Value constructions.

Each Metric is emitted with Polarity::Unknown and empty unit; the caller resolves these against the payload’s declared MetricHints to upgrade polarity.

Stability contract (pre-1.0)

This function, MAX_WALK_DEPTH, WALK_TRUNCATION_SENTINEL_NAME, and is_truncation_sentinel_name together form the public numeric-JSON-extraction surface ktstr offers to in-tree sibling binaries (ktstr-jemalloc-probe is the one current external consumer — see src/bin/jemalloc_probe.rs). Their visibility is aligned at pub so an external consumer that wants to distinguish “no deep metrics present” from “deep metrics dropped by the depth cap” can reach every piece of the contract from outside the crate.

ktstr is pre-1.0: the four items above are free to change in signature or behaviour without a compat shim. A caller depending on them must vendor the ktstr version at a known commit, not track main. Concretely:

• Path format (key.subkey / key.0): may grow a shape option to prefer arrays-by-key over positional index.
• Depth cap (MAX_WALK_DEPTH): may raise or lower as pathological inputs are observed; consumers must not hard-code the literal value.
• Sentinel shape: may migrate to a typed return (WalkResult { metrics, truncated: Option<u64> }) per the note on WALK_TRUNCATION_SENTINEL_NAME. Consumers that need zero-collision certainty should gate on is_truncation_sentinel_name (the predicate, not the literal string) so a sentinel-name rewording lands in one place.