Durability and retention
Detailed sample pruning first computes retained daily aggregates. Incident transitions and daily summaries are not deleted by the 90-day policy. Unique event identities deduplicate imports. Database backups must use the SQLite backup API because copying only the main file while WAL writes continue can omit committed data. Restore verification decrypts and opens the snapshot without replacing production.
Additive rollback
Old portal releases ignore the new database and continue reading existing issue state. Keep the database when reverting presentation. Configuration and collector revisions are recorded separately from observed health. Restoring an older backup can lose recent preferences and samples, so preserve current files and verify both the integrity result and the intended recovery point before an explicitly authorized production restore.
Access and bounded operation
Public responses contain a whitelist of operational fields and never configuration expressions, datasource credentials, private incident notes, or arbitrary query execution. Collection uses caches, four concurrent expression reads, bounded history imports, and a one-minute guard against overlapping collection. SQLite contains private owner preferences and notes and is never served as a public file. Its encrypted backup is an owner artifact.
Production ingestion log coverage
The root-owned Observe cloud log collector queries the three active NutsNews Cloudflare ingestion shards every five minutes. All three must have authentic activity within one hour, and the collector observation must be newer than twenty minutes. Missing streams, authentication errors and stale results remain unverified. Only a scope and timestamps are published; log contents and credentials remain private. Coverage never implies successful ingestion. The backend metrics timer refreshes every minute to satisfy unchanged freshness thresholds. No paid services are enabled. Stop observe-cloud-logs.timer to disable this evidence source; existing application processes are unaffected.
Inactive worker recovery
Scheduler and translation recovery copy deployed files and configuration without starting or restarting live containers. Sequential disposable stacks restore the actual database and broker topology. Scheduler verification requires existing restored leases, new isolated leases and messages published from restored feed data. Translation verifies restored completed-message replay and a real isolated model inference. Only successful current-revision drills earn recovery evidence; live readiness and production throughput checks remain independent. Missing components or failed startup remain failures. The shared two-CPU/eight-GiB limit and network isolation apply.
The disposable dependency mapper supports both deployed backend URL settings (BACKEND_API_URL and BACKEND_API_BASE_URL), database, broker and model endpoints. It changes only the restored environment and preserves live configuration. A missing mapping cannot escape the private network; the drill fails instead. Selected recovery runs still refresh deployment identities for every registered application between drills, so testing one application does not leave the others unobserved. Observe also compares its own running release directly with the tested revision, invalidating older restore proof immediately after activation rather than waiting for the next poll. Translation replay uses its own stored message, entity and payload-reference identity contract; persistence retains its canonical payload fingerprint check. Successful model startup alone does not satisfy replay verification. A busy shared recovery lock is recorded as a skipped run using exit status 75, while real runner errors remain failures.