Evidence boundaries
A database restore-drill gauge proves only the named drill; it is not full-host recovery. RabbitMQ stage gauges report the existing recovery verification, without running a destructive drill. No source is synthesized for idle shadow-worker performance, unregistered application restore tests, or absent device backups. These requirements stay explicit and continue reducing health.
Failure retention
Current critical failures and unresolved inspection findings remain authoritative. Missing samples never clear a previous failure. Deductions sort failures, then warnings, then evidence gaps by lost points. A stale collector overrides reason metadata to No data. Long-window availability stays Collecting history until the existing coverage requirement is met; missing minutes never become successes.
Verification and rollback
Regression tests cover real probe registration, Loki label scopes, credential boundaries, source isolation and zero credit for missing evidence. Deployment uses the existing immutable release and rollback workflow. Verify public health, owner authentication boundaries, fresh samples and unchanged application process identities after activation. The API reason field is additive, preserving clients that interpret unknown conservatively.