Monitoring & self-healing Observe-only by default

The monitoring overlay is wired all the way through to the ticket system. An alert becomes a ticket, the ticket gets root-cause analysis, and the analysis reaches an explicit disposition. The loop closes somewhere you can audit.

A triage stage does storm consolidation, bundles related alerts behind an ordered root-candidate policy, and applies claim, budget, flap and already-resolved gates. That is the difference between a self-healing system and one bad night turning into two hundred tickets nobody reads.

• Automatic analysis is on for container-health rules. The swarm investigates without being asked.
• Bounded auto-apply of whitelisted container restarts is built and ships off. When you do enable it: a per-incident lock, an hourly cap, and verify-after-apply.
• Core infrastructure is never ticket-healed. The database, cache and API tier stay owned by the watchdog whatever that switch says. A system that can restart its own database is a system that can lose your data at 3am.