Evidence and ownership
Discovery is observational. A repository name, historical Pages deployment or green CI run cannot establish current production ownership. Shadow worker health must remain visible without routing live ingestion to that worker. Production contract metrics and configuration take precedence over container naming. The two unhealthy shadow stages need a separate qualified release; simply restarting them would neither align their old images with source nor prove safe ownership.
Migration boundary
Observe becomes the central presentation surface; Grafana Cloud remains the telemetry backend. Cloud originals and private diagnostics remain intact. Public dashboards use a fixed query registry and anonymous series labels. Only inventory metadata and approved numeric aggregates become public; logs, credentials, environment files and arbitrary query access stay behind owner authentication.
Cardinality and load
Per-service systemd metrics use a fixed unit list. Application health is polled only on loopback with three-second deadlines; synthetic HTTPS checks have eight-second budgets. Eight worker stages are explicitly selected, with no feed URLs, article identifiers, user data or prompts used as new labels. Native dashboards fetch selected series on demand. Existing bounded public query concurrency remains in force.
Recovery and verification limits
Pi enrollment preserves the OS, network settings and receiver processes. Previous Alloy configuration is backed up before replacement. Remove or disable only the new telemetry timer and Alloy service to reverse a first-time enrollment; never stop receiver services as a telemetry rollback. The local portal uses immutable releases and its existing activation rollback. Missing samples, old deployment snapshots, incomplete backup evidence and mobile runtime visibility remain explicit limitations. No synthetic test is a substitute for an isolated application restore test.
Live verification detected Alloy replacing the static journal job label with its component name. The inspection selector uses stable instance/project identity so collector upgrades do not silently lose log coverage. Owner dashboard links are verified native destinations, with log scope tied to the application host.