Description
The last whole-dashboard live audit (TSO-0022) predates a long run of changes: the tab regroup (TSO-0092), new visualisation types (TSO-0150), HA coordination and ingress WAL panels, and many collector additions. TSO-0170 found the whole Node Metrics tab ignoring the tailnet and provider variables. Nothing caught it because the selector-scope test from TSO-0022 covered only the Policy and Config tabs, so similar gaps may exist on other tabs. This task audits every tab of the Tailnet and Exporter Health dashboards as rendered on the live stack. It produces a findings record and follow-up tasks. The fixes themselves belong in those follow-ups unless one is a single generated-query correction small enough to land here. Dashboards are delivered only through grafana-sync; never push them with gcx. Keep lab names, device names, addresses and raw telemetry values out of every tracked file, this task included.
Acceptance Criteria
- #1 Every panel on every tab of both generated dashboards is inventoried with a verdict (correct, misleading, broken, redundant or missing-signal) and a one-line reason, recorded in the task notes without lab identifiers
- #2 Every metric, log and trace query is executed against the live stack over a stated window; each one either returns data or has its absence explained (feature disabled, prerequisite absent, or genuinely zero), and no panel shows a query error
- #3 Each signal the exporter emits (per internal/catalog) reaches a panel or has a documented disposition, and each panel or row whose question no operator would act on is flagged for removal or merge
- #4 Every finding not fixed in this task is filed as its own Backlog task with observable acceptance criteria, and this task lists the IDs it filed
Definition of Done
- #1 just check passes (the full gate; it is what CI enforces)
- #2 just gen leaves no diff (only if a generated artifact’s inputs changed)
- #3 just –fmt –check passes and every new recipe has a # doc comment and a [group(…)]
Implementation Plan
Inventory every generated panel and catalog signal; extend selector-scope proof across all tabs with a failing mutation; use root-provided live query and render evidence to assign verdicts and identify follow-ups; return staged candidate for guarded review, serialized gate and landing.
loop27: retained patch verified and applied cleanly to fresh base; finish live absence/control/render evidence, then root review, landing and exact-SHA gates.
loop28: apply verified retained candidate to fresh main worktree, update only D64 tailnet-matcher expectations, reprove selector negative mutation, complete live prerequisite/control/non-Overview evidence, then guarded review and sharded CodeRabbit, staged candidate gate, root landing and composed/CI/sync checks.
loop33 attempt4of5: after connectivity and memory landing, freeze final published dashboard/source identities and >=3h explicit live window; inventory every panel/query/variable, execute all signal queries, causally classify absence from same-image evidence, verify all tabs/controls, file observable follow-ups and retain exact proof boundaries.
Implementation Notes
Sanitized exhaustive panel verdicts
Task: TSO-0172 (comprehensive audit of both Grafana dashboards against the live stack).
Active query window: 2026-10-10T16:24:57Z to 2026-10-10T22:24:57Z. Snapshot window: current now-6h (no recent exporter samples).
Verdicts are provisional where render or absence prerequisites remain outstanding. No non-Overview panel was declared visually correct from an Overview screenshot.
| Dashboard | Tab | Panel | Verdict | Reason |
|---|---|---|---|---|
| tailscale2otel-health | Overview | Exporter up | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Collectors OK | misleading | Current-window snapshot shows healthy-colored zero despite absent exporter samples; unanchored zero fallback conflates missing telemetry with healthy/empty population. |
| tailscale2otel-health | Overview | Goroutines (summary) | misleading | Current-window snapshot colors No data green; a health panel must distinguish missing telemetry from health. |
| tailscale2otel-health | Overview | GOMAXPROCS (summary) | misleading | Current-window snapshot colors No data green; a health panel must distinguish missing telemetry from health. |
| tailscale2otel-health | Overview | Build info | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Lease leadership | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Scrape success by collector (summary) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Last scrape age (summary) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | API requests/s by status (summary) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Export outcome rate (summary) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Export latency by signal (summary) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Config valid | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Config warnings | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Uptime | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Checkpoint disk | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Overview | Process CPU (summary) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Overview | Checkpoint persist age | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Overview | Scrape errors/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Overview | Checkpoint persist errors/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Overview | Component errors/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Overview | Admin auth rejected/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Overview | API 429 / retries (summary) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Overview | Leadership handovers (last 15m) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Node-metrics targets up | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Node-metrics targets total | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Node-metrics discovery OK | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Node-metrics discovered targets | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Node-metrics scrape health by target | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Node-metrics failed scrapes/s by reason | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Scrape duration p50/p95/p99 by collector | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Last scrape duration by collector | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Scrape success by collector | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Scrape duration distribution | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Last scrape age | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Scrape errors/s by collector / type | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Scrape staleness | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Scrape budget headroom | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | API requests/s by status & endpoint | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | API retries/s by endpoint | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | API latency p50/p95/p99 by endpoint | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | API 429 / retries | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Provider rate-limit utilization by tailnet | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Rate-limiter wait p50/p95/p99 by endpoint | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Time waiting vs time on the wire | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Requests delayed by the rate limiter | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | API operation last-probe age | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Capability state by collector | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | OAuth scope preflight by capability | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | API operation availability by state | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Capability availability history | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Pull-endpoint scrapes/s by outcome | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Pull-endpoint scrape duration p50/p95/p99 by outcome | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Pull-endpoint requests in flight | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Pull-endpoint gather errors/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Pull-endpoint auth rejections/s by reason | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Enrich cache age | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | Enrich cache size | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | rDNS cache fill | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Collection | rDNS lookup hit-rate | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | rDNS upstream queries/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | rDNS cache overflows vs lookups/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Collection | Per-tailnet API errors | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Object-store age (cursor & newest object) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Object-store gaps clear | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Object listing complete | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Backlog & oldest pending object age | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Unresolved gaps & oldest gap age | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Objects & records ingested/s, bytes read vs decompressed | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Object ingestion loss (skipped / retried / limit-stopped) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Undecodable objects (broken feed) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Object-store provider requests/s & latency | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Ingress permanently rejected units lost | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Ingress WAL on-disk bytes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Ingress WAL byte capacity fill | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Ingress WAL entry capacity fill | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Subrequest attempts & failures/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Subrequest coverage (last pass) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Stream records/s by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Stream rejections & decode errors/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Webhook events by type & rejections by reason | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Receiver in-flight & latency (stream) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Receiver rejected/s (stream + webhook) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Fail-closed receiver misconfiguration | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Stream records accepted vs skipped/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Webhook request duration p50/p95/p99 | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Webhook accepted vs duplicates & schema drift/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Ingest records/s & rejections/s & bytes/s by source | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Accepted event freshness & age p95, timestamp skew/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Dedup hits & evictions/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Dedup set fill | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Youngest dedup eviction age & overlap horizon | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Processor queue fill by signal | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Processor queue drops/s by signal & reason | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Log records & bytes truncated/s by field | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Audit poll collector | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Audit events accepted (this range) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Audit log lines in Loki (this range) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Audit ingestion failures/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Tailscale deferred delay (p50/p95/p99) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Ingestion | Local processing delay (p50/p95/p99) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Ingestion | Audit schema drift | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Annotations published/s by category | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Annotations dropped/s by reason | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Annotation delivery degraded | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Export latency p50/p95/p99 by signal | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Export outcome rate | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Export failures/s by type | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Delivery | Export spans/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Export diagnostics suppressed/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Delivery | PII filter status | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Configured destinations by log type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Streams configured | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Last delivery error | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Delivery throughput by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Entries delivered/s by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Delivery requests/s by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Delivery failure ratio by type | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Delivery | Failed requests/s by type | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Delivery | Backpressure: spoofed & max-body/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Delivery | Last activity age by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Delivery errors | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Delivery | Scrape → API trace waterfall | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Span class activity | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | API p95 by endpoint (traces) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | Scrape cadence by collector (traces) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Delivery | stream.receive batch size (traces) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Runtime | Goroutines | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | GOMAXPROCS | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Process uptime | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Process CPU (user/system) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Memory breakdown | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Goroutines & stack | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | GC cycles/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | GC pause/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | GC CPU fraction | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | GC next-target vs live heap | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Heap alloc churn | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Live heap objects | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Profile upload attempts/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Profile upload failures/s by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Profile upload duration p50/p95/p99 | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Profile upload consecutive failures | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Profile upload last-success age | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | CPU profile activity | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | In-use heap profile activity | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | CPU flame graph | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | In-use heap flame graph | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | TLS certificate expiry countdown | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Runtime | TLS certificate reload failures | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Runtime | TLS certificate age since issuance | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Runtime | TLS certificate reload freshness | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Runtime | Flow-store WAL journal size | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Flow-store checkpoint age | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Runtime | Config advisories | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Cost & Cardinality | Metrics over cardinality cap | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Busiest metric — % of cap | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Total active series | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Metric families tracked | misleading | Description/count semantics contain a distinct-family or fixed historical-size/cap assumption; make multi-instance aggregation and configured-limit wording explicit. |
| tailscale2otel-health | Cost & Cardinality | Overflowing families | redundant | Overlapping overflowing-family inventory questions; consolidate the flag and overflow-label evidence in one diagnostic row rather than several separate rows. |
| tailscale2otel-health | Cost & Cardinality | Series limit | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Overflowing now | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Per-metric utilization (top-N) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Active series by group | misleading | Description/count semantics contain a distinct-family or fixed historical-size/cap assumption; make multi-instance aggregation and configured-limit wording explicit. |
| tailscale2otel-health | Cost & Cardinality | Metrics overflowing now | redundant | Overlapping overflowing-family inventory questions; consolidate the flag and overflow-label evidence in one diagnostic row rather than several separate rows. |
| tailscale2otel-health | Cost & Cardinality | Active series by metric family | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Active series vs cap (top $topn) | redundant | Same current utilization expression as Per-metric utilization (top-N); merge the current gauge/table choice, retain the history view. |
| tailscale2otel-health | Cost & Cardinality | Active series over time (top $topn) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Ingest vs export cost (per minute) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Forwarded metric-name drops/s by reason | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-health | Cost & Cardinality | Metric names dropped over the window | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Flow series: raw vs bounded rollup | misleading | Description/count semantics contain a distinct-family or fixed historical-size/cap assumption; make multi-instance aggregation and configured-limit wording explicit. |
| tailscale2otel-health | Cost & Cardinality | other rollup share | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Flow log records dropped/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Dedup set size | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-health | Cost & Cardinality | Dedup evictions/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Devices online / total / offline | misleading | Current-window snapshot shows healthy-colored zero despite absent exporter samples; unanchored zero fallback conflates missing telemetry with healthy/empty population. |
| tailscale2otel-tailnet | Overview | Updates available | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Users | misleading | Current-window snapshot shows healthy-colored zero despite absent exporter samples; unanchored zero fallback conflates missing telemetry with healthy/empty population. |
| tailscale2otel-tailnet | Overview | Device keys ≤7d | misleading | Current-window snapshot shows healthy-colored zero despite absent exporter samples; unanchored zero fallback conflates missing telemetry with healthy/empty population. |
| tailscale2otel-tailnet | Overview | ACL change evidence age (summary) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Flow logging | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Exporter up (summary) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Collectors OK (summary) | misleading | Current-window snapshot shows healthy-colored zero despite absent exporter samples; unanchored zero fallback conflates missing telemetry with healthy/empty population. |
| tailscale2otel-tailnet | Overview | Scrape errors/s (summary) | misleading | Current-window snapshot shows healthy-colored zero despite absent exporter samples; unanchored zero fallback conflates missing telemetry with healthy/empty population. |
| tailscale2otel-tailnet | Overview | Export failures/s | misleading | Current-window snapshot shows healthy-colored zero despite absent exporter samples; unanchored zero fallback conflates missing telemetry with healthy/empty population. |
| tailscale2otel-tailnet | Overview | Network throughput | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Audit & flow events/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Devices online over time | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Audit events/s by action | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Audit events/s by origin | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Tailnet features | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Tailnet settings | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Scrape errors/s by collector | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Overview | Last scrape age by collector | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Component errors/s (summary) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Overview | Tailnets observed | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Providers | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Tailnet scorecard | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Overview | Per-tailnet online devices over time | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Unrestricted ACL rules | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Auto-approved exit nodes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Unapproved subnet routes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Untagged devices | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Overview | Pending exit-node shares | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Overview | SSH wildcard enabled | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Online | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Total | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Offline | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Updates available | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Distinct users | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Organization tailnets | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Inventory & Hygiene | Devices by OS | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Authorized (internal) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Unauthorized (internal) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | External (shared-in) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Population split over time | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Device share invite log | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Device inventory changes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Online vs total | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Devices by OS over time | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Device online state by node | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Stale devices (>30d) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Untagged | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Ephemeral | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Outdated (≥N behind) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Exporter update available | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Latest stable | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Clients by version | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Fleet tags (rollup) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Device age (p50 / p90) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Devices by distribution | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Devices by distribution (per-device) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Devices by country | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Updates available | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Device key expiry (time until) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Last seen (time since) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Device security flags (per device) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Inventory & Hygiene | Most-behind devices (top-N) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Tailscale SSH enabled (fleet) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Key expiry disabled (fleet) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Tailscale SSH enabled (devices) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Key expiry disabled (devices) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Blocking incoming connections | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Posture & Security | Multiple simultaneous connections | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Posture & Security | Posture identity disabled | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Posture attribute keys dropped | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Keys already expired | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Median days-to-expiry | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Devices by days-to-expiry bucket | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Posture overview | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Clients by version | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Security | Compliance failures | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Connectivity & Routing | Direct-capable % | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Hard-NAT % | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Client capability support | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Direct-capable coverage (per-device) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | IPv6 support coverage | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | UDP blocked (DERP-forced) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Endpoint candidates per device | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Hard-NAT fraction | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Configured peer-relay endpoints | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Connectivity by device | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Needs relay (hard-NAT) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Exit nodes advertised | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Exit nodes enabled | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Unapproved subnet routes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Enabled subnet routes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Advertised subnet routes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Exit-node inventory | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Subnet routes — advertised vs enabled | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Subnet-route redundancy by CIDR | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | DERP latency by host / region | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Connectivity & Routing | Preferred DERP regions | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Throughput (now) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Packets/s (now) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Flows/s (now) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Flows/s by transport | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Flows/s by traffic type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Current flow share by transport | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Current flow share by traffic type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Reporter trust & consistency | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Observed field omissions | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Rejected flow records/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Dedup counter conflicts/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Flow-view store drops/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Exit-node throughput | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Exit-node packets/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Observed bytes (flow logs) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Throughput by direction | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Throughput by transport | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Throughput by traffic type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | other rollup share | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Throughput by path — ROLLUP | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Throughput by DERP region ID — ROLLUP | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | DERP-relayed share of rollup bytes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Top $topn source nodes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Top $topn destination nodes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Top destination services | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Traffic topology - ROLLUP | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Unique dst peers per src | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Unique dst ports per src | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Throughput by direction (raw) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Network & Flows | Packets by direction (raw) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Network & Flows | Throughput by transport (raw) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Network & Flows | Top $topn source nodes (raw) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Network & Flows | Top $topn destination nodes (raw) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Network & Flows | Top $topn destination services (raw) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Network & Flows | Traffic topology - RAW | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Network & Flows | Top node-pair talkers (flow logs) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Network & Flows | Flow log stream | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Targets up / total | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Discovery OK | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Inbound bytes/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Outbound bytes/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Inbound packets/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Outbound packets/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Outbound dropped packets/s by node | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | % traffic via DERP relay by node | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Throughput by path | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Fleet DERP share (now) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Path mix (DERP / IPv4 / IPv6) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Active health warnings by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Traffic mix by path (direct / DERP / peer-relay) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Packets/s by path (curated) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Path mix (now) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Home DERP region (curated) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Service throughput by node | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Node Metrics | Policy drops (ACL) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Node Metrics | Error & malformed drops by reason | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Drop share by reason | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Peer-relay throughput by node | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Node Metrics | Peer-relay throughput by transport | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Node Metrics | Peer-relay packets/s by transport | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Node Metrics | Peer-relay endpoints by state | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Peer-relay endpoint share by state | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Best latency per DERP region | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Devices per DERP region | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Preferred DERP region distribution | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Advertised routes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Approved routes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Health messages | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Home DERP region | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Node Metrics | Peer relay endpoints | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Security/lifecycle changes/s | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Device churn | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Changes by actor type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Audit actions over time | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Audit events (range) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Failed changes — WARN (range) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Audit Trail | Audit events by target type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Audit action breakdown (logs) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Top $topn actors over time | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Audit Trail | Top $topn targets over time | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Audit: metric vs log | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Recent configuration changes | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Log stream — $log_event | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Audit Trail | Log volume by event | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Risk & ACL | Wildcard rules | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Risk & ACL | Unrestricted rules (grants) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Risk & ACL | Unrestricted rules (acls) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Risk & ACL | SSH wildcard | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Risk & ACL | Auto-approvers by kind | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Risk & ACL | Posture-gated rules | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Risk & ACL | Unrestricted ACL/grant rules (log detail) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Risk & ACL | Tailnet-lock errors | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Risk & ACL | Nodes with tailnet-lock errors | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Posture & Compliance | Integrations configured | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Devices matched by integration | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Oldest sync age | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Posture match rate | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Integration sync detail | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Encryption posture population | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Compliance distribution | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Posture attribute values by device | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Posture attribute expiry — time remaining | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Posture & Compliance | Expiring posture attributes (log detail) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Posture & Compliance | Client posture population | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Devices needing update | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Release track split | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Client version distribution | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Posture & Compliance | Device posture snapshot | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Device keys ≤7d | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Device keys ≤30d | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | API/auth keys ≤7d | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | API/auth keys ≤30d | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Device shares: pending vs accepted | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Exit-node-granting shares | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Multi-use shares | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Expiring device keys (log detail) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Keys | Expiring auth keys & credentials (log detail) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Keys | Key & user-invite lifecycle timeline | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Keys | Key age (p50 / p90) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Keys by owner and type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Unrestricted OAuth clients | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | OAuth client tag restrictions | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Credential privilege class (blast radius) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | OAuth client tag restriction class | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | User account age (p50 / p90) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Keys | Pending user-invite age (p50 / p90) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Keys | Pending device-invite age (p50 / p90) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Keys | Contact needs verification | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Kubernetes Audit | Kubernetes API requests/s | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Requests by verb | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Requests by namespace | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Requests by resource (top $topn) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Requests by user agent (top $topn) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Kubernetes request paths | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Sensitive reads/s by resource | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Sensitive reads by namespace | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Sensitive reads by user agent (top $topn) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Users reading sensitive resources ($topn) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Exec sessions/s by command class | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Exec sessions by namespace | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Exec sessions by session type | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Users by exec/attach/portforward sessions ($topn) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Mutations/s by verb | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Mutations by resource (top $topn) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Mutations by namespace | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Users making mutating requests ($topn) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | RBAC probes/s by resource | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | RBAC probes by namespace | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Users making RBAC/permission probes ($topn) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Sessions started/s by type | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Sessions by namespace | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Sessions by command class | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Users starting terminal sessions ($topn) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Schema drift events/s by field | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Schema drift events (range) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Kubernetes Audit | Recent Kubernetes API requests | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Recent terminal sessions | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Secret & sensitive resource reads | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Permission enumeration probes | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Kubernetes Audit | Reads of the recorder’s own logs (anti-forensics) | misleading | Query selects any log-subresource read in a fixed namespace, not the recorder object identity; it can miss recorder installs elsewhere and falsely accuse unrelated pod log reads. |
| tailscale2otel-tailnet | Kubernetes Audit | Exec / attach / port-forward requests | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Access & ACL | ACL change evidence age | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Access & ACL | ACL size | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Access & ACL | ACL rules by section | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Access & ACL | Auto-approvers (inventory) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Access & ACL | Posture-gated rules (inventory) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Access & ACL | ACL policy validated | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Access & ACL | Validation issues (last check) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Access & ACL | Validation issues by kind (logs) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Access & ACL | Policy snapshots (chunked) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Access & ACL | Policy changes (unified diffs) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | DNS & Settings | MagicDNS | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Nameservers | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Search paths | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Split-DNS zones | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Override local DNS | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Exit-node resolvers | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Search domains | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Resolvers | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Tailnet settings | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Device key duration | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Tailnet features | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | External-tailnets role | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | Webhook endpoints | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | DNS & Settings | DNS configuration snapshots | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | DNS & Settings | Tailnet settings snapshots | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Credentials | Stale users (>30d) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Credentials | User invites | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Credentials | Users by role | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | Users by status | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | Users by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | Per-user detail | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | Keys by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | Credential scopes (top-N) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | Key scope inventory (logs) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | Key expiry (time until) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | Preauthorized auth keys | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | OAuth applications | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Identity & Credentials | OAuth apps by privilege class | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Credentials | OAuth app age (p50 / p90) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Credentials | OAuth app scope & attribute counts | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Identity & Credentials | OAuth application inventory (logs) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Integrations | Services (VIP) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | Backing hosts by service | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | Service tags (rollup) | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | Port rules per service | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | VIP service health | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | Backing host identity | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | VIP service topology | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | Desired-event coverage | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Integrations | Unrecognized desired events | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Integrations | Subscribers per event category | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | Per-endpoint subscriptions | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Integrations | Webhook endpoint age (p50 / p90) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Integrations | Desired-event mismatches (logs) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Integrations | GeoIP database age since build | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | GeoIP database downloads | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | GeoIP lookups by database and result | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | GeoIP database reloads | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | Posture integration last-sync errors | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | Integrations | Webhook configuration snapshots | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | Integrations | Posture-integration configuration snapshots | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Connectors | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Services by type | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Policies | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Identities by kind and role | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Connector health | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Connector builds | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Service health | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Service settings | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Policy settings | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Organization settings | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Plan | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Subscription limits | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
| tailscale2otel-tailnet | PAM | Authorized sessions | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | PAM | Active sessions | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | PAM | Killed sessions | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | PAM | Session duration (p50 / p90 / p99) | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | PAM | Session events | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | PAM | PAM authorized session records | missing-signal | One or more query populations are empty; see per-query prerequisite explanation. |
| tailscale2otel-tailnet | PAM | PAM configuration snapshots | correct | Every query executes successfully and returns data in the frozen active window; rendered semantics beyond Overview remain unverified. |
Filed follow-ups (not admitted into loop26):
- TSO-0178 (Anchor fleet summary zeros to observed source presence).
- TSO-0179 (Separate absent exporter telemetry from zero health counters in summary tiles).
- TSO-0180 (Make absent runtime summary data visually distinct from healthy process telemetry).
- TSO-0181 (Merge redundant current-utilization and overflowing-family dashboard inventory).
- TSO-0182 (Count distinct metric families rather than reporter series in the family-count tile).
- TSO-0183 (Remove fixed historical cap and live-population claims from cardinality panel descriptions).
- TSO-0184 (Emit tailnet ownership on runtime traces before offering tailnet-scoped trace panels).
- TSO-0185 (Bind the anti-forensics log-read investigation to recorder identity, not a fixed namespace).
- TSO-0186 (Add retained browser evidence for every dashboard tab and selector state).
- TSO-0187 (Make automatic rule publication explicit in dashboard-only loop authority).
Root execution note: candidate-delta live queries and guarded independent review are pending. No dashboard publication or rule mutation occurred. The full task is not accepted, and provisional verdicts do not imply per-tab visual proof.
Additional filed follow-up: TSO-0188 (document and prove optional single-tailnet profile selector behavior), discovered in guarded review. The checkpoint isolation finding was repaired in implementation attempt 2 with independent rendered-panel failure/pass/mutation proof (exits 1/0/1); delta security review passed repaired code but reaffirmed publication is outside frozen authority. Exact reviewed patch SHA256 5190191b0a06461892a02a9bb71a607486b2dfba4346345354f85d2f9a4d5b07 is preserved. Baseline 815 query identities and changed-candidate 520 identities executed with no remaining backend query errors; absence/control/render evidence remains partial. CodeRabbit completed all eight candidate files, zero critical/major; follow-up-list minor corrected here. Absolute tracker references retained to respect owner path conventions.
loop26: attempts 2; review-repair rounds 1. Parked for publication authority: dashboard-only pushes trigger unconditional Grafana rule pruning/pushing, which the frozen goal forbids outside the root-only TSO-0176 (per-device posture status and its rule push) exception. Root and independent security review agree this is missing authority, not a tool limitation; no dashboard code was committed, pushed or delivered. Exact repaired patch SHA256 5190191b0a06461892a02a9bb71a607486b2dfba4346345354f85d2f9a4d5b07 retained in /Users/rob/repos/tailscale2otel/codex/loop26/dashboard-evidence/root-repaired-candidate.patch. Fresh staged verification tree f8e425a03444d2b83c1fb57631b56c556204ecae on base 2224ad2889feb252e9a114d2e4bdb90618954b53 passed exact full G exit 0 in 369.942s; repaired code passed guarded delta review and CodeRabbit reviewed all eight paths, zero major/critical. Eleven dashboard follow-ups filed individually with criteria; AC #5 checked only. AC #1-4 remain unchecked because provisional panel verdicts, absent-series prerequisites, non-All/ad-hoc/browser coverage and optional profile contract are not complete. Resume with explicit authority covering existing automation (recommended), then complete 136 absence prerequisites and 488 non-Overview panel renders/control checks, rebase retained patch onto accepted client migration, rerun changed proof at the new identity, land and verify exact ci-success/grafana-sync and far-side dashboard source.
loop27: 3 cumulative implementation attempts of owner-raised 5 (2 in loop26, 1 here). Retained candidate applies cleanly but unchanged tests test_cap_panels_use_the_exported_limit_not_a_10k_literal and test_active_series_treemap_is_bounded_and_keeps_plugin_identity require unscoped exact substrings; adding required tailnet filters produces two assertion failures among 251 tests. Per-tailnet emitter evidence rules out a global-only exemption. Explicit shared-test editing fence prevents correction. Resume when owner authorizes updating only those two expectations while preserving positive-limit and bounded-plugin contracts. Candidate remains staged/uncommitted; live absence, selected-control and render acceptance evidence remains incomplete. No source land or publication.
loop28 fresh non-Overview published-panel render: independent inspection found Devices by OS in-chart labels overlapping/clipped at 800x600, while the legend remained readable and no query/loading/no-data error was visible. Filed TSO-0189 (keep device OS pie-chart labels readable at snapshot dimensions); excluded from loop28 implementation. Representative published panel only, not candidate selector or whole-tab proof.
loop28 read-only availability check found both exporter replicas crash-looping on release5.2.0-rc.1 because startup rejects ingress_wal.max_permanent_rejections. Filed TSO-0190 (restore exporter image/config compatibility), outside the frozen envelope; no cluster mutation made. Historical active-window build-info also identifies5.2.0-rc.1, so absence explanations must use that deployed emission contract, not current source alone.
loop28: 1 implementation attempt in this run, 3 of the owner-raised 5 total; parked for missing historical effective-config/source/population evidence, not a code failure. Exact staged tree 1fd3279154612d88ce2e6abbf6b072029755107a on base06d158e1127668b2d534f76312cca48cd7e9a28b remains uncommitted. Full setup/check gate exit0, fresh negative selector mutation failed correctly,251Python tests passed, generated artifacts byte-idempotent, and independent guarded source review passed. Existing shared-test changes only add tailnet matcher at accuracy:53 and specialist:237. CodeRabbit ran once with No files to review/missing complete;5Python files unreviewed, not clean. All640panel and175variable query identities have HTTP200 historical-window receipts; candidate outcomes453data/187empty.188source-control requests allHTTP200. Root selected posture tailnet/provider/device/OS positive and4unmatched cases passed5/5;5representative non-Overview renders inspected, not whole-tab proof. Worker per-query report left149causal gaps; root full-range stale-user base proved every sample at/below actual30day threshold, reducing to148current gaps (131of original136historical,16downgraded explanations,1new trace-source gap). Desired-history11unchanged feature shapes and current no-override readbacks do not attest historical effective config. AC1/2semantic acceptance and remaining AC3livecontrol families are incomplete, so no landing/CI/composed gate/sync. Resume from retained staged candidate and same-window evidence; restore current exporter only with new explicit cluster authority. Follow-ups TSO-0189 (readable OS pie labels) and TSO-0190 (restore exporter image/config compatibility) not admitted.
loop29: 0 new implementation attempts, 3 cumulative of owner-raised 5. D70 minimum 3h fresh audit window is not yet available; earliest eligible lane start 2026-10-11T21:05:15Z. Parked for time, not authority or implementation failure. Retained candidate patch hash, base and staged tree verified unchanged; no source change, query, gate, review, landing or publication. AC #1-4 remain unchecked, AC #5 untouched. Resume attempt 4 on lane-worker-retry after that time using the original launch, D71 same-image effective configuration proof and freshly re-executed window queries. Goal needs=time is encoded as evidence-later because the event schema rejects time; this is not acceptance or Done.
2026-10-12 re-scope (Rob, after loop28 and loop29 both landed nothing): AC #3 (selector-scope test across all tabs) moved to TSO-0191 (land the dashboard selector-scope guard from the retained audit candidate), which carries the retained loop28 candidate. This task keeps the live evidence: panel verdicts, live query execution with absences explained, and catalog-signal dispositions. It runs after TSO-0191 and the two dashboard-fix chains land, so it audits the fixed dashboards rather than panels about to change. Attempt count carried: 3 of 5 used.
loop33 attempt4of5 admitted after required connectivity/memory landings. Browser signed in; current deployed exporter identifies5.2.1, distinct from newly shipped source. Final exhaustive inventory/query window will bind the final published dashboard artifacts; no audit acceptance yet.
loop33 retained live Inventory and Hygiene render inspected independently across all33panels. Structural findings filed: TSO-0211 (readable dense device and tag labels), TSO-0212 (visible device table measurements), TSO-0213 (readable absent security-flag states), TSO-0214 (legible organization-tailnet card), TSO-0215 (duration units restricted to measurement fields). These are newly observed follow-ups outside the owner-approved loop33 implementation set. Device-country map absence remains under causal investigation, not assumed defective from a blank basemap. No panel verdict is accepted merely because its backend query returned successfully.
Loop33 attempt 4 of 5 is complete. Independent guarded review3 accepts the evidence after repairing missing per-panel render bindings and one omitted follow-up mapping. This does not certify every dashboard view. Verdicts: 207 correct, 161 misleading, 36 broken, 118 missing-signal. All522 panels have exact query/source and actual reviewed-image or receipt-bound inactive-condition evidence. The50 inactive views are not populated render passes.
Both final dashboard specs and GitSync blobs match committed source371cd92dc2822ba5069e359f7b3e2fe2bcc9348a. The sole admitted implementation corrects the audit Loki range macro to $__auto. Its exact clean committed gate passed with zero changed paths; CI, both Grafana sync jobs, Release and downstream auto-rc succeeded. Independent fresh frontend proof shows metric and log series without the prior parse error. CodeRabbit left two Python paths unreviewed; independent guarded review covered those paths. No clean CodeRabbit claim is made.
Frozen window: 2026-11-01T18:30:00Z to2026-11-01T21:30:00Z. All752 identities (650panel,88variable,14annotation) have successful backend receipts and absence explanations:751 unchanged source/argument definitions retain same-window receipts; one changed Loki query was re-executed. Ten disabled annotation variants were audited separately from active behavior. Outcomes546data/206empty, zero remaining query errors. Requested step and actual datasource scrape setting60s; principal Prometheus responses returned91points at120s spacing, not an assumed181points.
The running exporter remains verified v5.2.1 during this window, distinct from newly landed source. Source-introduced descriptors account for nine empty query identities. Rollup mode, listener TLS configuration, optional feature settings, actual inventory predicates and snapshot heartbeat timing qualify absences. Parsed audit-field absence is distinct from original transport certainty; provider rows and accepted logs are different populations, not a delivery-loss calculation.
Actual frontend selector evidence covers retained values and real/unmatched OS, ad-hoc, collector, network and log effects. Profiles remain process/service scoped under All/real/unmatched tailnets. One populated tailnet/provider limits multi-population narrowing claims. Repeated host counts and exact backend probes agree; the initial discrepancy did not reproduce. Fleet rollups intentionally remain host-unfiltered.
The exhaustive table below retains frozen per-panel judgements; only its acceptance-status sentence is updated to record review3 PASS.
Published-source dashboard audit
Task: TSO-0172 (comprehensive live dashboard audit).
Window: 2026-11-01T18:30:00Z to 2026-11-01T21:30:00Z. Source identity is bound to /Users/rob/repos/tailscale2otel/codex/loop33/audit/window3.json and /Users/rob/repos/tailscale2otel/codex/loop33/audit/window3-summary-final.json. Root visual findings supersede provisional source-semantic verdicts. Native review/image partitions and actual false-gate receipts are explicitly bound per panel. Independent review3 accepts the completed evidence after both named repairs; recorded visual defects remain findings. A correct verdict below is a source-semantic judgement of the question, query aggregation and units plus numeric population, not a deduction from HTTP/exit success and not browser proof. Only the five required verdict categories are used. Unresolved evidence is marked missing-signal with acceptance_blocker=true and a reason that explicitly distinguishes missing acceptance evidence from a backend telemetry absence; it is not treated as resolved by renaming. Root-filed visual failures override source-only correctness.
Final receipt lineage binds 751 unchanged source/argv frozen-window2 executions and one changed Loki query re-executed against published source. All 752 receipts exit 0 with no backend error; disabled annotation variants were executed for audit only. 650 panel queries include 172 empty identities. Requested step=60s and actual OTLP interval config=60s; observed Prometheus range result spacing is 120s (91 points per 3h series), not an assumed 181 points. Returned spacing does not establish source emission cadence.
PII polarity: category metric 1 / config true means emitted; 0 means redacted. All 18 empty query_result predicates are false conditions, including redaction, multi-tailnet and degraded-state predicates; they are not query errors.
| Dashboard | Tab | Panel | Verdict | Reason | Filed follow-ups |
|---|---|---|---|---|---|
| tailscale2otel-health | Overview | Exporter up | correct | Source question/metric/aggregation/unit are consistent: Whether the process itself is reporting alive (tailscale2otel.up).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Overview | Collectors OK | correct | Source question/metric/aggregation/unit are consistent: Count of enabled collectors whose last scrape succeeded; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Overview | Goroutines (summary) | correct | Source question/metric/aggregation/unit are consistent: Current goroutine count — a runaway climb usually means a stuck collector or a leaking retry loop.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Overview | GOMAXPROCS (summary) | correct | Source question/metric/aggregation/unit are consistent: Go scheduler’s configured max OS threads — mostly a deployment sanity check.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Overview | Build info | correct | Primary label/state/age fields visible; no missing numeric measure inferred for one-hot identity tables. | |
| tailscale2otel-health | Overview | Lease leadership | correct | Primary label/state/age fields visible; no missing numeric measure inferred for one-hot identity tables. | |
| tailscale2otel-health | Overview | Scrape success by collector (summary) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: 1/0 success flag per enabled collector’s most recent scrape attempt.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Overview | Last scrape age (summary) | broken | Root independent review confirms the named measurement is excluded, offscreen or rendered on an unusable scale despite source data. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-health | Overview | API requests/s by status (summary) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Tailscale API call volume by HTTP status — a rising non-2xx share is the exporter losing its ability to collect, before any collector shows it as down.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Overview | Export outcome rate (summary) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: OTLP export attempts completed per second, by outcome (success/failure); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Overview | Export latency by signal (summary) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: OTLP export latency quantiles, by signal (metrics/logs/traces); 3 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Overview | Config valid | correct | Source question/metric/aggregation/unit are consistent: Whether the running config passed validation at startup.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Overview | Config warnings | correct | Source question/metric/aggregation/unit are consistent: Active configuration advisories from startup (a count, despite the _ratio suffix).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Overview | Uptime | misleading | Capability availability history paints supported rows red. Uptime, Process uptime, ACL change evidence age, ACL size and Device key duration also receive warning-like red without a justified health verdict in their descriptions. This is distinct from missing-data colors. | TSO-0219 (Align health and inventory colors with documented semantics) |
| tailscale2otel-health | Overview | Checkpoint disk | misleading | Root confirms unreadable prerequisite text, inappropriate healthy/failure color, or unanchored zero while the actual source population is absent. Legitimate optional absence must remain readable and distinct from measured health. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-health | Overview | Process CPU (summary) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: CPU seconds/s by mode (~cores).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Overview | Checkpoint persist age | missing-signal | checkpoint.store=kubernetes; deployed app starts the disk/mtime reporter only for the file backend. | |
| tailscale2otel-health | Overview | Scrape errors/s | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Collector scrape attempts that failed, by collector.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Overview | Checkpoint persist errors/s | missing-signal | The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | |
| tailscale2otel-health | Overview | Component errors/s | missing-signal | The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | |
| tailscale2otel-health | Overview | Admin auth rejected/s | missing-signal | The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | |
| tailscale2otel-health | Overview | API 429 / retries (summary) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Rate-limit responses and the retries they trigger in the selected scope; 2 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Overview | Leadership handovers (last 15m) | correct | Source question/metric/aggregation/unit are consistent: Completed Kubernetes Lease handovers observed in the last 15 minutes; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Overview | Log catch-up skipped duration | missing-signal | tailscale2otel.log.catchup.skipped is absent from the verified deployed v5.2.1 catalog; current dashboard source does not imply runtime delivery. | |
| tailscale2otel-health | Overview | Log catch-up skipped seconds/s | misleading | The plotted quantity is accumulated seconds per second, a dimensionless rate, but the panel applies a duration unit. The actual question, numeric rate and unit disagree. | TSO-0233 (Render duration rates as dimensionless quantities); TSO-0226 (Keep rolling audit-log counts distinct from per-second rates) |
| tailscale2otel-health | Data pipeline / Collection | Node-metrics targets up | correct | Source question/metric/aggregation/unit are consistent: Node-metrics scrape targets currently reachable.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Collection | Node-metrics targets total | correct | Source question/metric/aggregation/unit are consistent: Node-metrics scrape targets configured/discovered, up or down.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Collection | Node-metrics discovery OK | correct | Source question/metric/aggregation/unit are consistent: Whether the last node-metrics target-discovery pass succeeded.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Collection | Node-metrics discovered targets | correct | Source question/metric/aggregation/unit are consistent: Scrape targets found by the last node-metrics discovery pass.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Collection | Node-metrics scrape health by target | broken | Root independent review confirms the named measurement is excluded, offscreen or rendered on an unusable scale despite source data. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-health | Data pipeline / Collection | Node-metrics failed scrapes/s by reason | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Failed node-metrics scrapes by a closed diagnostic class; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | Scrape duration p50/p95/p99 by collector | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Per-collector scrape wall-clock duration quantiles from the histogram series.; 3 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | Last scrape duration by collector | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Wall-clock duration of each collector’s most recent scrape (gauge, distinct from the p50/p95/p99 quantiles derived from the histogram series to its left).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | Scrape success by collector | correct | Source question/metric/aggregation/unit are consistent: 1 when a collector’s last scrape succeeded, 0 when it failed.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Collection | Scrape duration distribution | misleading | Heatmap bucket bounds are duration; intensity is observation frequency. Applying duration units to intensity duplicates the bucket-axis dimension and misstates the observation rate. | TSO-0234 (Label histogram heatmap intensity as observation frequency); TSO-0215 (Keep metadata free of numeric and duration formatting) |
| tailscale2otel-health | Data pipeline / Collection | Last scrape age | correct | Primary label/state/age fields visible; no missing numeric measure inferred for one-hot identity tables. | |
| tailscale2otel-health | Data pipeline / Collection | Scrape errors/s by collector / type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Collector scrape attempts that failed, by collector and error type.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | Scrape staleness | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Time since each collector’s last successful scrape.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | Scrape budget headroom | misleading | Title says headroom, but query is scrape_duration / interval (used fraction); description and high-is-bad thresholds confirm usage, not remaining headroom. Scrape budget headroom computes scrape duration divided by interval, which is the used fraction; the description and high-is-bad thresholds also describe usage. The title presents the opposite quantity. | TSO-0227 (Name used scrape budget consistently with the displayed fraction) |
| tailscale2otel-health | Data pipeline / Collection | API requests/s by status & endpoint | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Tailscale API requests issued per second, by HTTP status code and by endpoint (two independent group-bys over the same counter, on one axis).; 2 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | API retries/s by endpoint | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Tailscale API calls retried (429/5xx/timeout), by endpoint.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | API latency p50/p95/p99 by endpoint | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Per-endpoint Tailscale API latency quantiles.; 3 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | API 429 / retries | missing-signal | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. 1/2 queries have data; The same source-anchored summary reports zero 429 rate while API traffic exists and provider quota-pressure is zero. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | Provider rate-limit utilization by tailnet | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Provider quota-pressure samples by tailnet: 1 when a logical request observed an HTTP 429, including one that later retried successfully; 0 otherwise; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | Rate-limiter wait p50/p95/p99 by endpoint | missing-signal | Limiter-wait histogram has no observations; provider-pressure gauge is zero and API requests are present. No wait quantile can be calculated from an unobserved histogram. | |
| tailscale2otel-health | Data pipeline / Collection | Time waiting vs time on the wire | misleading | The plotted quantity is accumulated seconds per second, a dimensionless rate, but the panel applies a duration unit. The actual question, numeric rate and unit disagree. | TSO-0233 (Render duration rates as dimensionless quantities); TSO-0215 (Keep metadata free of numeric and duration formatting) |
| tailscale2otel-health | Data pipeline / Collection | Requests delayed by the rate limiter | misleading | Root confirms unreadable prerequisite text, inappropriate healthy/failure color, or unanchored zero while the actual source population is absent. Legitimate optional absence must remain readable and distinct from measured health. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-health | Data pipeline / Collection | API operation last-probe age | correct | Primary label/state/age fields visible; no missing numeric measure inferred for one-hot identity tables. | |
| tailscale2otel-health | Data pipeline / Collection | Capability state by collector | correct | Primary label/state/age fields visible; no missing numeric measure inferred for one-hot identity tables. | |
| tailscale2otel-health | Data pipeline / Collection | OAuth scope preflight by capability | broken | Root independent review confirms the named measurement is excluded, offscreen or rendered on an unusable scale despite source data. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-health | Data pipeline / Collection | API operation availability by state | correct | Primary label/state/age fields visible; no missing numeric measure inferred for one-hot identity tables. | |
| tailscale2otel-health | Data pipeline / Collection | Capability availability history | misleading | Supported states are rendered red from raw value 1; this inverts their intended health meaning. | TSO-0219 (Align health and inventory colors with documented semantics) |
| tailscale2otel-health | Data pipeline / Collection | Pull-endpoint scrapes/s by outcome | missing-signal | prometheus.enabled=true, but request/gather/inflight instruments are emitted from the pull handler; no pull request family is present. Enabled is not proof a scraper reached this endpoint. | |
| tailscale2otel-health | Data pipeline / Collection | Pull-endpoint scrape duration p50/p95/p99 by outcome | missing-signal | prometheus.enabled=true, but request/gather/inflight instruments are emitted from the pull handler; no pull request family is present. Enabled is not proof a scraper reached this endpoint. | |
| tailscale2otel-health | Data pipeline / Collection | Pull-endpoint requests in flight | missing-signal | prometheus.enabled=true, but request/gather/inflight instruments are emitted from the pull handler; no pull request family is present. Enabled is not proof a scraper reached this endpoint. | |
| tailscale2otel-health | Data pipeline / Collection | Pull-endpoint gather errors/s | misleading | Root confirms unreadable prerequisite text, inappropriate healthy/failure color, or unanchored zero while the actual source population is absent. Legitimate optional absence must remain readable and distinct from measured health. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-health | Data pipeline / Collection | Pull-endpoint auth rejections/s by reason | missing-signal | prometheus.enabled=true, but request/gather/inflight instruments are emitted from the pull handler; no pull request family is present. Enabled is not proof a scraper reached this endpoint. | |
| tailscale2otel-health | Data pipeline / Collection | Enrich cache age | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Age of the device-enrichment cache, which maps IPs and node IDs to device names for flow and audit records; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | Enrich cache size | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Devices held in the enrichment cache; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | rDNS cache fill | misleading | Two percentages are visible without population labels; their distinct meanings cannot be recovered from the actual view. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-health | Data pipeline / Collection | rDNS lookup hit-rate | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Share of rDNS lookups served from cache rather than an upstream query; 2 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | rDNS upstream queries/s | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Upstream PTR queries issued and cache evictions, per second; 3 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | rDNS cache overflows vs lookups/s | missing-signal | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. 1/2 queries have data; The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Collection | Per-tailnet API errors | correct | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Source question/metric/aggregation/unit are consistent: Tailscale API 4xx/5xx responses per second, split out per tailnet on a multi-tailnet deployment.; 1 query identity/identities return numeric data. | |
| tailscale2otel-health | Data pipeline / Ingestion | Object-store age (cursor & newest object) | misleading | Root confirms unreadable prerequisite text, inappropriate healthy/failure color, or unanchored zero while the actual source population is absent. Legitimate optional absence must remain readable and distinct from measured health. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-health | Data pipeline / Ingestion | Object-store gaps clear | misleading | Root confirms unreadable prerequisite text, inappropriate healthy/failure color, or unanchored zero while the actual source population is absent. Legitimate optional absence must remain readable and distinct from measured health. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-health | Data pipeline / Ingestion | Object listing complete | misleading | Root confirms unreadable prerequisite text, inappropriate healthy/failure color, or unanchored zero while the actual source population is absent. Legitimate optional absence must remain readable and distinct from measured health. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-health | Data pipeline / Ingestion | Backlog & oldest pending object age | missing-signal | Both audit and flow collectors use source=stream, so object-store reporter populations are not instantiated. | |
| tailscale2otel-health | Data pipeline / Ingestion | Unresolved gaps & oldest gap age | missing-signal | Both audit and flow collectors use source=stream, so object-store reporter populations are not instantiated. | |
| tailscale2otel-health | Data pipeline / Ingestion | Objects & records ingested/s, bytes read vs decompressed | missing-signal | Both audit and flow collectors use source=stream, so object-store reporter populations are not instantiated. | |
| tailscale2otel-health | Data pipeline / Ingestion | Object ingestion loss (skipped / retried / limit-stopped) | missing-signal | Both audit and flow collectors use source=stream, so object-store reporter populations are not instantiated. | |
| tailscale2otel-health | Data pipeline / Ingestion | Undecodable objects (broken feed) | misleading | Unanchored or vector(0) turns absent object-store ingestion into healthy zero despite both ingestion sources selecting streams. This row is collapsed but has no source-presence visibility gate. The Kubernetes equivalent is protected by hidden tab/row gates and is not claimed as a visible defect. Device security flags (per device) renders a long fallback sentence clipped across flag columns. The operator cannot reliably distinguish the flag state or read the absence explanation. Observed in a retained live render during TSO-0172 (comprehensive live dashboard audit); outside the approved loop33 fix set. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-health | Data pipeline / Ingestion | Object-store provider requests/s & latency | missing-signal | Both audit and flow collectors use source=stream, so object-store reporter populations are not instantiated. | |
| tailscale2otel-health | Data pipeline / Ingestion | Ingress permanently rejected units lost | missing-signal | The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred.; tailscale2otel.ingress_wal.expired.entries is absent from the verified deployed v5.2.1 catalog; current dashboard source does not imply runtime delivery. | |
| tailscale2otel-health | Data pipeline / Ingestion | Ingress WAL on-disk bytes | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Encoded bytes on the WAL filesystem; 2 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Ingress WAL byte capacity fill | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Pending durable bytes as a fraction of ingress_wal.max_bytes; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Ingress WAL entry capacity fill | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Pending durable entries as a fraction of ingress_wal.max_entries (left axis), with raw pending entries, retained staging files and completion markers on the right axis; 4 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Subrequest attempts & failures/s | misleading | Root inspection reports clipped time labels and/or dominant annotation regions. Named measures remain backend-populated; the presentation problem is recorded separately. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Subrequest coverage (last pass) | misleading | Actual bars are orange despite the intended supported/healthy green semantics; retain the observed coverage quantity and correct the color contract. | TSO-0219 (Align health and inventory colors with documented semantics) |
| tailscale2otel-health | Data pipeline / Ingestion | Stream records/s by type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Records accepted from the configured stream (HEC) receiver, by record type.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Stream rejections & decode errors/s | missing-signal | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. 1/2 queries have data; The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Webhook events by type & rejections by reason | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Root inspection reports a neutral empty webhook view; the queried sentinels and event families have no observations. Enabled receiver is not evidence of incoming events; no populated visual correctness is claimed. | |
| tailscale2otel-health | Data pipeline / Ingestion | Receiver in-flight & latency (stream) | missing-signal | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. 4/5 queries have data; The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Receiver rejected/s (stream + webhook) | missing-signal | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. 1/2 queries have data; The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Fail-closed receiver misconfiguration | correct | Source question/metric/aggregation/unit are consistent: 1 means an enabled streaming or webhook receiver is network-reachable but has no credential, so it deliberately refuses every request with HTTP 403; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Ingestion | Stream records accepted vs skipped/s | misleading | Root inspection reports clipped time labels and/or dominant annotation regions. Named measures remain backend-populated; the presentation problem is recorded separately. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Webhook request duration p50/p95/p99 | missing-signal | Root inspection reports a neutral empty webhook view; the queried sentinels and event families have no observations. Enabled receiver is not evidence of incoming events; no populated visual correctness is claimed. | |
| tailscale2otel-health | Data pipeline / Ingestion | Webhook accepted vs duplicates & schema drift/s | missing-signal | Root inspection reports a neutral empty webhook view; the queried sentinels and event families have no observations. Enabled receiver is not evidence of incoming events; no populated visual correctness is claimed. | |
| tailscale2otel-health | Data pipeline / Ingestion | Ingest records/s & rejections/s & bytes/s by source | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Records accepted across every ingestion path, by source and signal, beside rejections and skips from every path on the same axis (left, cps); 3 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Accepted event freshness & age p95, timestamp skew/s | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Seconds since the greatest event timestamp accepted from each source/signal (exposes stale-but-still-running ingestion, unlike receiver liveness alone); the p95 age at acceptance (backfills and retries raise this without moving the last-event timestamp backwards); and p95 upstream capture/observation delay where the wire format supplies a capture timestamp separately from event time; 4 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Dedup hits & evictions/s | misleading | Root inspection reports clipped time labels and/or dominant annotation regions. Named measures remain backend-populated; the presentation problem is recorded separately. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Dedup set fill | misleading | Root inspection reports clipped time labels and/or dominant annotation regions. Named measures remain backend-populated; the presentation problem is recorded separately. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Youngest dedup eviction age & overlap horizon | missing-signal | Eviction age is observed; no separately visible overlap horizon is present. Stream-only mode explains inapplicable polling overlap, and root inspection did not establish a visual defect. | |
| tailscale2otel-health | Data pipeline / Ingestion | Processor queue fill by signal | correct | Source question/metric/aggregation/unit are consistent: This app’s own log/trace batch-processor queue (buffered between acceptance and OTLP export), current size as a fraction of its configured capacity, by signal; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Ingestion | Processor queue drops/s by signal & reason | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Records/spans dropped because the queue above was full when offered, by signal and reason; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Log records & bytes truncated/s by field | correct | Root inspected readable measures with proper independent rate/byte-rate axes; source query dimensions and returned populations match the question. | |
| tailscale2otel-health | Data pipeline / Ingestion | Audit poll collector | misleading | Root confirms unreadable prerequisite text, inappropriate healthy/failure color, or unanchored zero while the actual source population is absent. Legitimate optional absence must remain readable and distinct from measured health. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-health | Data pipeline / Ingestion | Audit events accepted (this range) | misleading | Ordinary positive activity is colored red without a supported loss/comparison interpretation; counts alone do not establish an unhealthy state. | TSO-0219 (Align health and inventory colors with documented semantics) |
| tailscale2otel-health | Data pipeline / Ingestion | Audit log lines in Loki (this range) | misleading | Ordinary positive activity is colored red without a supported loss/comparison interpretation; counts alone do not establish an unhealthy state. | TSO-0219 (Align health and inventory colors with documented semantics) |
| tailscale2otel-health | Data pipeline / Ingestion | Audit ingestion failures/s | missing-signal | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. 1/3 queries have data; Audit source=stream; a dedicated audit polling scheduler series is not expected.; The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Tailscale deferred delay (p50/p95/p99) | missing-signal | Root inspected a neutral empty distribution. Direct accepted/source correlation establishes no eligible parsed deferred timestamp input; raw transport certainty remains unproven for the 25 accepted records without group IDs. | |
| tailscale2otel-health | Data pipeline / Ingestion | Local processing delay (p50/p95/p99) | misleading | Root inspection reports clipped time labels and/or dominant annotation regions. Named measures remain backend-populated; the presentation problem is recorded separately. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Ingestion | Audit schema drift | misleading | Root inspection reports clipped time labels and/or dominant annotation regions. Named measures remain backend-populated; the presentation problem is recorded separately. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Annotations published/s by category | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Grafana annotations accepted by the annotations API since process start, by category; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Annotations dropped/s by reason | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Annotations that did not reach Grafana, by bounded reason; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Annotation delivery degraded | correct | Source question/metric/aggregation/unit are consistent: Whether the most recent Grafana annotation write failed and has not yet been recovered by a later success; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Delivery | Export latency p50/p95/p99 by signal | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: OTLP export latency quantiles, by signal (metrics/logs/traces).; 3 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Export outcome rate | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: OTLP export attempts completed per second, by outcome (success/failure).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Export failures/s by type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: OTLP export attempts that failed, by error type.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Export spans/s | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Spans handed to the OTLP trace exporter — the trace cost proxy; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Export diagnostics suppressed/s | missing-signal | The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | |
| tailscale2otel-health | Data pipeline / Delivery | PII filter status | broken | Root independent review confirms the named measurement is excluded, offscreen or rendered on an unusable scale despite source data. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-health | Data pipeline / Delivery | Configured destinations by log type | correct | Destination, Log type and Configured columns all visible. | |
| tailscale2otel-health | Data pipeline / Delivery | Streams configured | correct | Source question/metric/aggregation/unit are consistent: Configuration/network log streams delivering to a SIEM sink.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Delivery | Last delivery error | correct | Source question/metric/aggregation/unit are consistent: 1 if any stream’s last delivery reported an error (see the Delivery errors log).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-health | Data pipeline / Delivery | Delivery throughput by type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Bytes sent to the configured SIEM sink, by log type.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Entries delivered/s by type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Log entries successfully delivered to the SIEM sink, by log type.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Delivery requests/s by type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Delivery requests attempted to the sink, per log type; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Delivery failure ratio by type | broken | Fractional data is rendered against an axis reaching ten thousand percent, compressing the meaningful 0..100% range. | TSO-0223 (Use the correct ratio scale for delivery failure charts) |
| tailscale2otel-health | Data pipeline / Delivery | Failed requests/s by type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Failed delivery requests to the sink — alert on a sustained rate.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Backpressure: spoofed & max-body/s | missing-signal | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. 1/2 queries have data; The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Data pipeline / Delivery | Last activity age by type | broken | Root independent review confirms the named measurement is excluded, offscreen or rendered on an unusable scale despite source data. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-health | Data pipeline / Delivery | Delivery errors | missing-signal | Delivery error flag and request failure rate are observed as zero while delivered entries are positive. Error-detail logs require an error observation. | |
| tailscale2otel-health | Data pipeline / Delivery | Scrape → API trace waterfall | broken | Independent fresh 1600x900 native solo shows No data found in response with no red indicator, while the exact backend search returns 20 traces. This is a real broken render/result interpretation, not missing telemetry. Exact renderer cause is unresolved within the filed repair task. | TSO-0235 (Render actionable trace results when the dashboard search returns data) |
| tailscale2otel-health | Data pipeline / Delivery | Span class activity | misleading | Root exhaustive Delivery partition finds populated trace rates but no clear rate-axis unit; retain the measured rate while making its quantity explicit. Source question/metric/aggregation/unit are consistent: Bounded discovery rate for every span class emitted by the exporter: scheduler scrapes, Tailscale and Headscale API calls, node-metrics HTTP scrapes, stream and webhook receivers, and release checks; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0215 (Keep metadata free of numeric and duration formatting) |
| tailscale2otel-health | Data pipeline / Delivery | API p95 by endpoint (traces) | misleading | Root exhaustive Delivery partition finds a raw object-like, excessively wide legend; readable endpoint identity is not conveyed. Source question/metric/aggregation/unit are consistent: Trace panels are empty if tracing.enabled=false; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-health | Data pipeline / Delivery | Scrape cadence by collector (traces) | misleading | Root exhaustive Delivery partition finds populated trace rates but no clear rate-axis unit; retain the measured rate while making its quantity explicit. Source question/metric/aggregation/unit are consistent: Trace panels are empty if tracing.enabled=false; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0215 (Keep metadata free of numeric and duration formatting) |
| tailscale2otel-health | Data pipeline / Delivery | stream.receive batch size (traces) | missing-signal | Deployed durableAppend success path returns before SetAttributes(tailscale.stream.flows/http.request.body.size); ingress_wal is enabled, so trace batch-size panel lacks both queried numeric attributes. The deployed successful durable-append branch returns before the stream receive span adds flow-count and decompressed-body-size attributes. With ingress WAL enabled, receive spans exist but both queried batch-size attributes are absent, so the shipped trace panel has no observations. | TSO-0228 (Expose truthful receiver batch trace observations on the durable WAL path) |
| tailscale2otel-health | Runtime & capacity / Runtime | Goroutines | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | GOMAXPROCS | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Process uptime | misleading | Root final review confirms legibility, while the previously filed unjustified red health interpretation remains a semantic color issue. | TSO-0219 (Align health and inventory colors with documented semantics) |
| tailscale2otel-health | Runtime & capacity / Runtime | Process CPU (user/system) | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Heap vs Go memory limit | missing-signal | Heap curve is legible; limit source descriptor is absent from verified deployed v5.2.1. A readable heap curve does not establish the missing limit value. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Memory breakdown | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Goroutines & stack | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | GC cycles/s | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | GC pause/s | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | GC CPU fraction | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | GC next-target vs live heap | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Heap alloc churn | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Live heap objects | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Profile upload attempts/s | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Profile upload failures/s by type | correct | Root sees a legitimate zero with a generic Value legend. With no failure-label population, that legend alone is not evidence of a lost failure-type label; no label defect is asserted. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Profile upload duration p50/p95/p99 | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Profile upload consecutive failures | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Profile upload last-success age | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Runtime | CPU profile activity | correct | Root final independent review confirms a populated profile activity curve; numeric trace/profile summary binds the actual profile-type activity values. | |
| tailscale2otel-health | Runtime & capacity / Runtime | In-use heap profile activity | correct | Root final independent review confirms a populated profile activity curve; numeric trace/profile summary binds the actual profile-type activity values. | |
| tailscale2otel-health | Runtime & capacity / Runtime | CPU flame graph | correct | Colored sampled stackframes plus symboltables visible. All/real/unmatched processscope deepcontrols allpopulated. | |
| tailscale2otel-health | Runtime & capacity / Runtime | In-use heap flame graph | correct | Colored sampled stackframes plus symboltables visible. All/real/unmatched processscope deepcontrols allpopulated. | |
| tailscale2otel-health | Runtime & capacity / Runtime | TLS certificate expiry countdown | missing-signal | Root final review confirms a neutral explained empty TLS view; direct configuration has no applicable in-process certificate/key population. | |
| tailscale2otel-health | Runtime & capacity / Runtime | TLS certificate reload failures | missing-signal | Root final review confirms a neutral explained empty TLS view; direct configuration has no applicable in-process certificate/key population. | |
| tailscale2otel-health | Runtime & capacity / Runtime | TLS certificate age since issuance | missing-signal | Root final review confirms a neutral explained empty TLS view; direct configuration has no applicable in-process certificate/key population. | |
| tailscale2otel-health | Runtime & capacity / Runtime | TLS certificate reload freshness | missing-signal | Root final review confirms a neutral explained empty TLS view; direct configuration has no applicable in-process certificate/key population. | |
| tailscale2otel-health | Runtime & capacity / Runtime | Flow-store WAL journal size | misleading | Root collapsed and final review confirms readable measurement, with clipped time labels still recorded. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Runtime & capacity / Runtime | Flow-store checkpoint age | misleading | Root collapsed and final review confirms readable measurement, with clipped time labels still recorded. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Runtime & capacity / Runtime | Config advisories | missing-signal | Root confirms a plain No data view; advisory eligibility is absence of current/startup/change warnings in this later window, already source-qualified. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Metrics over cardinality cap | misleading | Root confirms unreadable prerequisite text, inappropriate healthy/failure color, or unanchored zero while the actual source population is absent. Legitimate optional absence must remain readable and distinct from measured health. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Busiest metric — % of cap | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Total active series | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Metric families tracked | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Series limit | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Overflowing now | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Per-metric utilization (top-N) | misleading | Raw decimalfractions lackunitheader while neighborpercent requiresconversion; fold0215. | TSO-0215 (Keep metadata free of numeric and duration formatting) |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Overflowing families | missing-signal | Root confirms neutral explicit uncertainty; observed positive overflow-family population is empty, not a fabricated zero. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Metrics overflowing now | missing-signal | Root confirms neutral explicit uncertainty; positive overflow predicate has no matching observed values. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Active series by group | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Active series by metric family | broken | Root final Cost review confirms the known treemap client error despite populated backend data. | TSO-0222 (Restore Active series by metric family rendering on Grafana 13) |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Active series over time (top $topn) | misleading | Root confirms percentages under a count-like title; retain cap-utilization title/quantity discrepancy. | TSO-0229 (Name active-series cap utilization as a ratio rather than a count) |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Ingest vs export cost (per minute) | misleading | Root confirms mixed per-minute versus per-second measures/legends on one comparison. | TSO-0224 (Make ingestion and export cost comparisons dimensionally consistent) |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Forwarded metric-name drops/s by reason | misleading | Active-name count companion is intentional and correctly named; its required separate count axis is absent from the shared rate axis. | TSO-0224 (Make ingestion and export cost comparisons dimensionally consistent) |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Metric names dropped over the window | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Flow series: raw vs bounded rollup | missing-signal | Rollup data is visible and raw series are absent as expected from directly verified rollup mode; this is legitimate partial source applicability, not a defect. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | other rollup share | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Flow log records dropped/s | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Dedup set size | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-health | Runtime & capacity / Cost & Cardinality | Dedup evictions/s | correct | Root final independent review accounts for this exact Runtime/Cost title and confirms readable units, legends and populated/stat semantics. Numeric source population also supports the question. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Overview | Devices online / total / offline | correct | Source question/metric/aggregation/unit are consistent: Devices currently reporting online, the total the exporter can see, and the remainder offline (normal for laptops and phones).; 3 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Updates available | correct | Source question/metric/aggregation/unit are consistent: Devices with a Tailscale client update waiting.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Users | correct | Source question/metric/aggregation/unit are consistent: Users known to the tailnet, across every role, status and type.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Device keys ≤7d | correct | Source question/metric/aggregation/unit are consistent: Device node keys expiring within 7 days; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | ACL change evidence age (summary) | misleading | The shipped summary card truncates the title defining its duration measure; its readable numeric value does not preserve the full quantity meaning. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Overview | Flow logging | correct | Source question/metric/aggregation/unit are consistent: Tailnet network-flow-logging feature state.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Exporter up (summary) | correct | Source question/metric/aggregation/unit are consistent: Whether the exporter process feeding this dashboard is reporting alive; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Collectors OK (summary) | correct | Source question/metric/aggregation/unit are consistent: Collectors whose last scrape succeeded; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Scrape errors/s (summary) | correct | Source question/metric/aggregation/unit are consistent: Collector scrape attempts failing per second, fleet-wide; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Export failures/s | correct | Source question/metric/aggregation/unit are consistent: OTLP exports failing per second; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Network throughput | misleading | Root verified default annotation regions/time-label clipping obscure the actual time-series trace. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Overview | Audit & flow events/s | misleading | Root verified default annotation regions/time-label clipping obscure the actual time-series trace. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Overview | Devices online over time | misleading | Root verified default annotation regions/time-label clipping obscure the actual time-series trace. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Overview | Audit events/s by action | misleading | Root verified default annotation regions/time-label clipping obscure the actual time-series trace. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Overview | Audit events/s by origin | misleading | Root verified default annotation regions/time-label clipping obscure the actual time-series trace. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Overview | Tailnet features | misleading | Root reports dominant annotations on the Overview time series. This does not apply to the identically titled Policy inventory table. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Overview | Tailnet settings | broken | The actual table leaves the named Tag scope/Expires in/Alive/Enabled measurement offscreen or clipped behind metadata. Tailnet settings is the table, not its similarly named Overview time series. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Overview | Scrape errors/s by collector | correct | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Source question/metric/aggregation/unit are consistent: Which collector is failing, and how hard; 1 query identity/identities return numeric data. | |
| tailscale2otel-tailnet | Overview | Last scrape age by collector | correct | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. The source is_degraded conditional is false in frozen query receipts, so this view is ineligible and absent as designed. Its positive direct backend query does not override source visibility eligibility; no populated pixel pass is claimed. | |
| tailscale2otel-tailnet | Overview | Component errors/s (summary) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. The named event-driven counter/histogram has no observed series. Corresponding base subsystem is enabled/active where applicable; absence is not fabricated as zero and does not by itself prove no event ever occurred. | |
| tailscale2otel-tailnet | Overview | Tailnets observed | correct | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Source question/metric/aggregation/unit are consistent: Number of distinct tailnets observed by this exporter instance (excluding the placeholder ‘-’).; 1 query identity/identities return numeric data. | |
| tailscale2otel-tailnet | Overview | Providers | correct | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. The source has_multitailnet conditional is false in frozen query receipts, so this view is ineligible and absent as designed. Its positive direct backend query does not override source visibility eligibility; no populated pixel pass is claimed. | |
| tailscale2otel-tailnet | Overview | Tailnet scorecard | correct | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. The source has_multitailnet conditional is false in frozen query receipts, so this view is ineligible and absent as designed. Its positive direct backend query does not override source visibility eligibility; no populated pixel pass is claimed. | |
| tailscale2otel-tailnet | Overview | Per-tailnet online devices over time | correct | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Source question/metric/aggregation/unit are consistent: Count of online devices per tailnet over time.; 1 query identity/identities return numeric data. | |
| tailscale2otel-tailnet | Overview | Unrestricted ACL rules | correct | Source question/metric/aggregation/unit are consistent: Total ACL rules that grant unrestricted access (wildcard src/dst); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Auto-approved exit nodes | correct | Source question/metric/aggregation/unit are consistent: ACL auto-approver entries for exit-node routes; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Unapproved subnet routes | correct | Source question/metric/aggregation/unit are consistent: Subnet routes advertised but not yet approved by an admin.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Untagged devices | correct | Source question/metric/aggregation/unit are consistent: Devices not associated with any ACL tag — harder to audit and apply granular policies to.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Overview | Pending exit-node shares | misleading | Root inspected green No data/absence states. Known no-match predicates, empty desired configuration and missing telemetry must not share an unsupported healthy color. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-tailnet | Overview | SSH wildcard enabled | correct | Source question/metric/aggregation/unit are consistent: Whether the tailnet ACL contains a wildcard SSH rule.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Online | correct | Source question/metric/aggregation/unit are consistent: Devices currently reporting as online, within the tab’s OS/host/user/tag filters.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Total | correct | Source question/metric/aggregation/unit are consistent: Devices the control plane knows about, online or not, within the tab’s filters.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Offline | correct | Source question/metric/aggregation/unit are consistent: Devices registered but not currently connected; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Updates available | correct | Source question/metric/aggregation/unit are consistent: Devices whose control plane reports a newer Tailscale client available.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Distinct users | correct | Source question/metric/aggregation/unit are consistent: Users with at least one connected device, counted from the per-user connected gauge rather than inferred from device ownership.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Organization tailnets | broken | Root independent visual review reports Device security flags fallback clipped and Organization tailnets fallback tiny. Absence text is part of the panel contract and must be legible. The Organization tailnets stat card truncates its title and shrinks a long explanatory value to an unreadable size at the shipped card width. The observed issue is presentation, not proof that organization discovery should be enabled. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels); TSO-0214 (Keep the organization-tailnet card legible when data is absent) |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Devices by OS | correct | Source question/metric/aggregation/unit are consistent: Device count per OS, kept split by authorization and shared-in state — an OS total that sums those away hides the devices an admin still has to act on; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Authorized (internal) | correct | Source question/metric/aggregation/unit are consistent: Devices belonging to this tailnet that an admin has authorized.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Unauthorized (internal) | correct | Source question/metric/aggregation/unit are consistent: Devices registered to this tailnet and waiting on an admin authorization decision; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | External (shared-in) | correct | Source question/metric/aggregation/unit are consistent: Devices shared in from another tailnet; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Population split over time | correct | Source question/metric/aggregation/unit are consistent: The three populations over time; 3 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Device share invite log | correct | Root exact independent review confirms populated timestamped log rows; no numeric Value column is required to interpret these records. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Device inventory changes | correct | Root exact independent review confirms populated timestamped log rows; no numeric Value column is required to interpret these records. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Online vs total | correct | Source question/metric/aggregation/unit are consistent: Online device count against the registered total over time; a widening gap is devices dropping off rather than leaving the tailnet.; 2 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Devices by OS over time | correct | Source question/metric/aggregation/unit are consistent: Stacked OS mix over time with authorization and shared-in state preserved, so a growing band of unauthorized or external devices is visible rather than absorbed.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Device online state by node | broken | Root independent visual review reports overlapping labels in Device online state and Fleet tags; this supersedes earlier source-only correctness. A retained live Inventory and Hygiene render shows heavy label overlap in Device online state by node and Fleet tags (rollup), preventing individual rows or categories from being identified. Query success does not establish readable presentation. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Stale devices (>30d) | correct | Source question/metric/aggregation/unit are consistent: Devices not seen in over 30 days (last-seen staleness) — candidates for decommissioning; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Untagged | correct | Source question/metric/aggregation/unit are consistent: Devices not associated with any ACL tag.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Ephemeral | correct | Source question/metric/aggregation/unit are consistent: Ephemeral devices currently registered.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Outdated (≥N behind) | correct | Source question/metric/aggregation/unit are consistent: Devices running a client version that is at least one minor release behind the fleet latest.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Exporter update available | correct | Source question/metric/aggregation/unit are consistent: Whether a newer version of the tailscale2otel exporter is available.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Latest stable | correct | Root exact independent review confirms Version is readable; hidden one-hot Value is intentional, not missing evidence. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Clients by version | correct | Source question/metric/aggregation/unit are consistent: Fleet distribution by Tailscale client version.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Fleet tags (rollup) | broken | Root independent visual review reports overlapping labels in Device online state and Fleet tags; this supersedes earlier source-only correctness. A retained live Inventory and Hygiene render shows heavy label overlap in Device online state by node and Fleet tags (rollup), preventing individual rows or categories from being identified. Query success does not establish readable presentation. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Device age (p50 / p90) | correct | Source question/metric/aggregation/unit are consistent: Time since devices joined the tailnet; 2 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Devices by distribution | correct | Source question/metric/aggregation/unit are consistent: OS distribution mix; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Devices by distribution (per-device) | correct | Source question/metric/aggregation/unit are consistent: Device count per distribution derived from the PER-DEVICE distro gauge, so it honours the tab’s host filter — the roll-up beside it does not and is emitted unconditionally; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Devices by country | broken | A retained live Devices by country geomap shows a bare basemap while two bounded same-window source probes prove a positive country population and valid ISO2-coded groups. This is not explained by absent location telemetry. The layer location/options and transformed field mapping need validation against the supported installed Geomap schema; the exact cause is not yet asserted. | TSO-0225 (Render device-country markers for a populated valid-code frame) |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Updates available | correct | Root named repair1 withdraws the table defect: membership query update_available==1 identifies updates; Host, OS and OS version are visible. Hidden numeric one-hot Value is intentional and not a missing version measurement. | |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Device key expiry (time until) | misleading | Root reports an OS-version cell rendered with a seconds unit. Both source duration tables set defaults.unit=s for every field with no overrides; exact affected screenshot/table identity was not supplied, so these are source-affected candidates requiring root identity confirmation. Root also reports duration measurement columns offscreen. At the shipped Inventory and Hygiene table widths, Device key expiry (time until) and Last seen (time since) show metadata columns while their question-answering duration measurements are outside the visible table area. | TSO-0212 (Keep table measurements visible ahead of metadata); TSO-0215 (Keep metadata free of numeric and duration formatting) |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Last seen (time since) | misleading | Root reports an OS-version cell rendered with a seconds unit. Both source duration tables set defaults.unit=s for every field with no overrides; exact affected screenshot/table identity was not supplied, so these are source-affected candidates requiring root identity confirmation. Root also reports duration measurement columns offscreen. At the shipped Inventory and Hygiene table widths, Device key expiry (time until) and Last seen (time since) show metadata columns while their question-answering duration measurements are outside the visible table area. Last seen (time since) visibly formats an OS-version metadata cell with a seconds suffix in the retained live Inventory and Hygiene render. A panel-wide duration unit must not alter metadata presentation. | TSO-0212 (Keep table measurements visible ahead of metadata); TSO-0215 (Keep metadata free of numeric and duration formatting) |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Device security flags (per device) | broken | Root independent visual review reports Device security flags fallback clipped and Organization tailnets fallback tiny. Absence text is part of the panel contract and must be legible. Device security flags (per device) renders a long fallback sentence clipped across flag columns. The operator cannot reliably distinguish the flag state or read the absence explanation. Observed in a retained live render during TSO-0172 (comprehensive live dashboard audit); outside the approved loop33 fix set. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels); TSO-0214 (Keep the organization-tailnet card legible when data is absent) |
| tailscale2otel-tailnet | Fleet operations / Inventory & Hygiene | Most-behind devices (top-N) | correct | Root exact independent review confirms Host and Minors behind both visible. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Posture assertion changes | missing-signal | tailscale.device.posture.failing_assertions is absent from the verified deployed v5.2.1 catalog; current dashboard source does not imply runtime delivery. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Devices failing impacting postures | missing-signal | tailscale.devices.posture.failed is absent from the verified deployed v5.2.1 catalog; current dashboard source does not imply runtime delivery. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Posture names dropped | misleading | Root visual review reports healthy colors on No data/unavailable states for these tiles. Query success and an explained optional absence cannot establish a healthy measured zero. Device security flags (per device) renders a long fallback sentence clipped across flag columns. The operator cannot reliably distinguish the flag state or read the absence explanation. Observed in a retained live render during TSO-0172 (comprehensive live dashboard audit); outside the approved loop33 fix set. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Server posture passing by device | missing-signal | tailscale.device.posture.passing is absent from the verified deployed v5.2.1 catalog; current dashboard source does not imply runtime delivery. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Server posture impacting by device | missing-signal | tailscale.device.posture.impacting is absent from the verified deployed v5.2.1 catalog; current dashboard source does not imply runtime delivery. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Tailscale SSH enabled (fleet) | correct | Source question/metric/aggregation/unit are consistent: Devices accepting Tailscale SSH sessions, from the fleet roll-up (emitted regardless of cardinality.per_entity.device).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Key expiry disabled (fleet) | correct | Source question/metric/aggregation/unit are consistent: Devices whose node key never expires; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Tailscale SSH enabled (devices) | correct | Source question/metric/aggregation/unit are consistent: Same count derived from the per-device gauge, so it honours the tab’s OS/host/user/tag filters; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Key expiry disabled (devices) | correct | Source question/metric/aggregation/unit are consistent: Per-device view of never-expiring node keys, filterable to a host or tag.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Blocking incoming connections | misleading | count(base == 1) becomes empty when all present base values are zero; noValue incorrectly says per-device data is unavailable. Base table has 59 zero-valued devices at frozen end. Root visual review reports healthy colors on No data/unavailable states for these tiles. Query success and an explained optional absence cannot establish a healthy measured zero. Device security flags (per device) renders a long fallback sentence clipped across flag columns. The operator cannot reliably distinguish the flag state or read the absence explanation. Observed in a retained live render during TSO-0172 (comprehensive live dashboard audit); outside the approved loop33 fix set. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Multiple simultaneous connections | misleading | count(base == 1) becomes empty when all present base values are zero; noValue incorrectly says per-device data is unavailable. Base table has 59 zero-valued devices at frozen end. Root visual review reports healthy colors on No data/unavailable states for these tiles. Query success and an explained optional absence cannot establish a healthy measured zero. Device security flags (per device) renders a long fallback sentence clipped across flag columns. The operator cannot reliably distinguish the flag state or read the absence explanation. Observed in a retained live render during TSO-0172 (comprehensive live dashboard audit); outside the approved loop33 fix set. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Posture identity disabled | correct | Source question/metric/aggregation/unit are consistent: Devices exempted from posture-identity collection, so posture-gated ACL rules cannot evaluate them.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Posture attribute keys dropped | correct | Source question/metric/aggregation/unit are consistent: Distinct posture attribute keys suppressed by attribute_key_limit on the latest collection tick; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Keys already expired | correct | Source question/metric/aggregation/unit are consistent: Devices whose node key has already expired (per-device expiry gauge; clears after re-auth).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Median days-to-expiry | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Median days until device key expiry across the fleet.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Devices by days-to-expiry bucket | correct | Source question/metric/aggregation/unit are consistent: Current device count per days-to-key-expiry band, from the per-device expiry gauge (point-in-time, non-cumulative; clears after re-auth).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Posture overview | misleading | Auto-update/encryption/host/OS visible, technicalheadersclipped and version/track notvisible; no numericValue expected, fold0212 only meaningfulmissingattributes. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Clients by version | correct | Source question/metric/aggregation/unit are consistent: Device count by reported Tailscale client version, from posture data.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Posture & Security | Compliance failures | missing-signal | collect_posture is enabled but posture_compliance_checks has length zero, so the emitter has no configured assertions to evaluate. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Direct-capable % | correct | Source question/metric/aggregation/unit are consistent: Fleet-wide fraction of devices capable of direct (non-relay) connections; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Hard-NAT % | correct | Source question/metric/aggregation/unit are consistent: Fleet-wide fraction of devices behind hard NAT (require relay for inbound connections); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Client capability support | correct | Source question/metric/aggregation/unit are consistent: Number of devices supporting each connectivity capability.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Direct-capable coverage (per-device) | correct | Source question/metric/aggregation/unit are consistent: Share of reporting devices that look able to hold a direct connection (UDP usable and not behind a hard NAT); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | IPv6 support coverage | correct | Source question/metric/aggregation/unit are consistent: Share of reporting devices whose OS supports IPv6; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | UDP blocked (DERP-forced) | correct | Source question/metric/aggregation/unit are consistent: Devices whose current network blocks UDP; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Endpoint candidates per device | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Magicsock UDP endpoint candidates advertised per device; 2 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Hard-NAT fraction | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Fleet-wide fraction of devices behind hard NAT; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Configured peer-relay endpoints | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Configured peer-relay endpoint count reported by node metrics; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Connectivity by device | misleading | UDP nullable cell contains a malformed/clipped whole-panel absence paragraph; a blank sibling cell is not evidence the query population is absent. | TSO-0230 (Keep whole-panel absence explanations out of nullable table cells) |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Needs relay (hard-NAT) | broken | Root inspection finds clipped first-column/source headers or truncated source labels, preventing recovery of the named entity/pair. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Exit nodes advertised | correct | Source question/metric/aggregation/unit are consistent: Exit nodes currently in the ‘advertised’ state.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Exit nodes enabled | correct | Source question/metric/aggregation/unit are consistent: Exit nodes currently in the ‘enabled’ state.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Unapproved subnet routes | correct | Source question/metric/aggregation/unit are consistent: Subnet routes advertised but not yet approved by an admin.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Enabled subnet routes | correct | Source question/metric/aggregation/unit are consistent: Distinct subnet CIDRs approved on at least one device (exit-node default routes excluded); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Advertised subnet routes | correct | Source question/metric/aggregation/unit are consistent: Distinct subnet CIDRs advertised by at least one device (exit-node default routes excluded); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Exit-node inventory | broken | Root inspection finds clipped first-column/source headers or truncated source labels, preventing recovery of the named entity/pair. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Subnet routes — advertised vs enabled | misleading | Actual Enabled cells are blank even though both query populations have data; the displayed entity row is not a coherent joined view. Filed as a visible per-entity join problem, without assuming every advertised route has an enabled counterpart or claiming a missing feed. | TSO-0218 (Join related measurements into coherent per-entity table rows) |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Subnet-route redundancy by CIDR | correct | Root independently inspected the collapsed view and reports the named labels and measure readable; source query and population also support the question. | |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | DERP latency by host / region | broken | The inspected table lacks a visible latency measurement, so its entity metadata does not answer the latency question. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Fleet operations / Connectivity & Routing | Preferred DERP regions | correct | Root independently inspected the collapsed view and reports the named labels and measure readable; source query and population also support the question. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Throughput (now) | correct | Source question/metric/aggregation/unit are consistent: Rollup-first: the bounded rollup family is read when present and the raw family only when it is not, so a tailnet running cardinality.flow.metrics_mode: both reports each byte once.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. |
|
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Packets/s (now) | correct | Source question/metric/aggregation/unit are consistent: Rollup-first, same fallback as Throughput (now): rollup when present, raw otherwise, never the sum of the two.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Flows/s (now) | correct | Source question/metric/aggregation/unit are consistent: Distinct flow records observed per second, fleet-wide.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Flows/s by transport | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Flow rate split by transport protocol (tcp/udp/other).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Flows/s by traffic type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Flow rate split by traffic type (virtual/subnet/exit/physical).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Current flow share by transport | misleading | Root visual review reports generic Value names in compliance and current-flow-share pies; populated aggregate data does not prove category identity is conveyed. Retained live renders label Compliance distribution and Current flow share by transport/traffic type with the generic Value category. Auto-approvers by kind and Auto-approvers (inventory) also lose a category, and Devices matched by integration omits its integration label. The chart cannot communicate its named dimension. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Current flow share by traffic type | misleading | Root visual review reports generic Value names in compliance and current-flow-share pies; populated aggregate data does not prove category identity is conveyed. Retained live renders label Compliance distribution and Current flow share by transport/traffic type with the generic Value category. Auto-approvers by kind and Auto-approvers (inventory) also lose a category, and Devices matched by integration omits its integration label. The chart cannot communicate its named dimension. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Reporter trust & consistency | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: One bounded observation per flow record; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Observed field omissions | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Observed missing-field fraction, not inferred Destination Logging state; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Rejected flow records/s | misleading | Root exhaustive network partition records placeholder legends; the reason/type interpretation needs qualification and is not inferred from an absent exception-label population. Source question/metric/aggregation/unit are consistent: Semantically invalid flow records rejected before any processor side effect, by ingestion source and validation reason; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Dedup counter conflicts/s | misleading | Root exhaustive network partition records placeholder legends; the reason/type interpretation needs qualification and is not inferred from an absent exception-label population. Source question/metric/aggregation/unit are consistent: Duplicate flow connections whose byte/packet counters disagree with the first observation of the same connection; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Flow-view store drops/s | misleading | Root exhaustive network partition records placeholder legends; the reason/type interpretation needs qualification and is not inferred from an absent exception-label population. Source question/metric/aggregation/unit are consistent: Flow observations rejected from the local in-memory flow view because their timestamps fall outside its retention or future-skew bounds (flow_view.*); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. |
TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Exit-node throughput | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Bytes relayed through each exit node; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Exit-node packets/s | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Packets relayed through each exit node, same attribution and gating as Exit-node throughput.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Observed bytes (flow logs) | misleading | Root visual review reports misleading observed-byte labels and independent scaling despite valid byte totals; do not infer comparable bar lengths from separately scaled frames. Observed bytes (flow logs) shows generic query-reference labels and radically different bar lengths for comparable displayed byte totals. Independent per-field scaling can make cross-measure comparisons misleading. | TSO-0217 (Use a comparable scale and explicit measures for observed flow bytes) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Throughput by direction | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Bounded top-N rollup series, emitted when cardinality.flow.metrics_mode is rollup (the default) or both.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. |
TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Throughput by transport | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Bounded top-N rollup series, emitted when cardinality.flow.metrics_mode is rollup (the default) or both.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. |
TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Throughput by traffic type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Bounded top-N rollup series, emitted when cardinality.flow.metrics_mode is rollup (the default) or both.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. |
TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | other rollup share | correct | Source question/metric/aggregation/unit are consistent: Fraction of rollup bytes folded into the bounded other bucket; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Throughput by path — ROLLUP | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Rollup bytes split by how the tailnet carried them: direct or derp; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. |
TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Throughput by DERP region ID — ROLLUP | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Relayed rollup bytes by the numeric DERP region ID the flow record supplied; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | DERP-relayed share of rollup bytes | correct | Source question/metric/aggregation/unit are consistent: Share of physical rollup bytes that took a DERP relay rather than a direct path; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Top $topn source nodes | correct | Source question/metric/aggregation/unit are consistent: Busiest source nodes by rollup byte rate; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Top $topn destination nodes | correct | Source question/metric/aggregation/unit are consistent: Busiest destination nodes by rollup byte rate; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Top destination services | correct | Source question/metric/aggregation/unit are consistent: Busiest destination services by rollup byte rate; unclassified (empty-service) traffic is excluded so every bar is named; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Traffic topology - ROLLUP | misleading | Traffic topology - ROLLUP uses very thin dark connections, while VIP service topology is entirely blank without a visible explanation. The blank capture alone does not establish whether the source is empty or the plugin is failing. | TSO-0221 (Make topology panels interpretable in populated and empty states) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Unique dst peers per src | broken | Root inspection finds clipped first-column/source headers or truncated source labels, preventing recovery of the named entity/pair. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Unique dst ports per src | broken | Root inspection finds clipped first-column/source headers or truncated source labels, preventing recovery of the named entity/pair. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Throughput by direction (raw) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Direct effective configuration selects rollup, so raw per-flow families and their sentinel are intentionally absent. Bounded rollup traffic is observed. Root reports seven RAW solo captures were blank under this dormant condition; that is not a visually correct populated raw chart. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Packets by direction (raw) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Direct effective configuration selects rollup, so raw per-flow families and their sentinel are intentionally absent. Bounded rollup traffic is observed. Root reports seven RAW solo captures were blank under this dormant condition; that is not a visually correct populated raw chart. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Throughput by transport (raw) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Direct effective configuration selects rollup, so raw per-flow families and their sentinel are intentionally absent. Bounded rollup traffic is observed. Root reports seven RAW solo captures were blank under this dormant condition; that is not a visually correct populated raw chart. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Top $topn source nodes (raw) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Direct effective configuration selects rollup, so raw per-flow families and their sentinel are intentionally absent. Bounded rollup traffic is observed. Root reports seven RAW solo captures were blank under this dormant condition; that is not a visually correct populated raw chart. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Top $topn destination nodes (raw) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Direct effective configuration selects rollup, so raw per-flow families and their sentinel are intentionally absent. Bounded rollup traffic is observed. Root reports seven RAW solo captures were blank under this dormant condition; that is not a visually correct populated raw chart. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Top $topn destination services (raw) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Direct effective configuration selects rollup, so raw per-flow families and their sentinel are intentionally absent. Bounded rollup traffic is observed. Root reports seven RAW solo captures were blank under this dormant condition; that is not a visually correct populated raw chart. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Traffic topology - RAW | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Direct effective configuration selects rollup, so raw per-flow families and their sentinel are intentionally absent. Bounded rollup traffic is observed. Root reports seven RAW solo captures were blank under this dormant condition; that is not a visually correct populated raw chart. | |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Top node-pair talkers (flow logs) | misleading | Repeated byte samples appear without visible time or node-pair ranking identity; the inspected view does not answer the advertised ranking question. | TSO-0231 (Show top node-pair talkers as an identifiable ranking) |
| tailscale2otel-tailnet | Network & service telemetry / Network & Flows | Flow log stream | misleading | Inline metadata wraps across many lines per entry and reduces default scanning/event coverage. | TSO-0232 (Keep default log rows scannable while retaining metadata details) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Targets up / total | correct | Source question/metric/aggregation/unit are consistent: Fraction of node-metrics scrape targets currently reachable; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Discovery OK | correct | Source question/metric/aggregation/unit are consistent: Whether the last node-metrics target-discovery pass succeeded; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Inbound bytes/s | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Raw tailscaled inbound byte rate, per node.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Outbound bytes/s | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Raw tailscaled outbound byte rate, per node.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Inbound packets/s | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Raw tailscaled inbound packet rate, per node.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Outbound packets/s | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Raw tailscaled outbound packet rate, per node.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Outbound dropped packets/s by node | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Outbound packets dropped by tailscaled per node, with the raw upstream reason label; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. |
TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | % traffic via DERP relay by node | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Fraction of each node’s traffic relayed via DERP rather than sent direct; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Throughput by path | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Total tailnet throughput split by path: DERP relay vs direct IPv4 vs direct IPv6.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Fleet DERP share (now) | correct | Source question/metric/aggregation/unit are consistent: Fleet-wide fraction of bytes relayed via DERP.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Path mix (DERP / IPv4 / IPv6) | correct | Source question/metric/aggregation/unit are consistent: Current total throughput split by raw tailscaled path (DERP/IPv4/IPv6).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Active health warnings by type | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Active tailscaled client health-warning messages across the fleet, by health type (curated tailscale.node.health_messages; alert ts2o-node-health-warnings).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Traffic mix by path (direct / DERP / peer-relay) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Tailnet data-plane throughput split by curated path bucket: direct, DERP relay, or peer relay (curated tailscale.node.io — includes the peer_relay bucket the raw tailscaled path label does not separate).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Packets/s by path (curated) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Data-plane PACKET rate by curated path bucket — the packet counterpart of Traffic mix by path; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Path mix (now) | correct | Source question/metric/aggregation/unit are consistent: Current data-plane byte rate by curated path bucket (direct / DERP / peer-relay).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Home DERP region (curated) | misleading | Node and Home region ID readable; technicalheaderscrowd, fold0212. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Service throughput by node | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Root full-window raw Serve-counter increase probe is empty. Curated Serve rate requires exposed raw counter samples/deltas; that rate-capable source population is absent. This does not establish whether Serve is unsupported, unconfigured or idle. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Policy drops (ACL) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Packets the tailscaled packet filter dropped because the tailnet policy does not permit them; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Error & malformed drops by reason | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Every documented drop reason EXCEPT acl; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. |
TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Drop share by reason | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Each reason’s share of all offered packets (delivered + dropped), so a drop rate can be read against traffic volume instead of in isolation; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Peer-relay throughput by node | missing-signal | Root full-window raw peer-relay counter increase probe is empty and endpoint gauges are zero. Curated relay traffic has no rate-capable source population; no claim is made that the software lacks the capability or that absence is numeric zero. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Peer-relay throughput by transport | missing-signal | Root full-window raw peer-relay counter increase probe is empty and endpoint gauges are zero. Curated relay traffic has no rate-capable source population; no claim is made that the software lacks the capability or that absence is numeric zero. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Peer-relay packets/s by transport | missing-signal | Root full-window raw peer-relay counter increase probe is empty and endpoint gauges are zero. Curated relay traffic has no rate-capable source population; no claim is made that the software lacks the capability or that absence is numeric zero. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Peer-relay endpoints by state | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Peer-relay endpoints split by connection state; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Peer-relay endpoint share by state | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: The same endpoint states as a share of all peer-relay endpoints, so a fleet that grows does not look like a relay regression; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Best latency per DERP region | correct | Source question/metric/aggregation/unit are consistent: Best (minimum) device→DERP-region latency across the tailnet, per region.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Devices per DERP region | correct | Source question/metric/aggregation/unit are consistent: Number of devices reporting latency to each DERP region.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Preferred DERP region distribution | correct | Source question/metric/aggregation/unit are consistent: Number of devices that prefer each DERP region.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Advertised routes | broken | Metadata consumes initial width, intended namedmeasure offscreen; numericidentifierabbreviations fold0212/0215. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Approved routes | broken | Metadata consumes initial width, intended namedmeasure offscreen; numericidentifierabbreviations fold0212/0215. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Health messages | broken | Metadata consumes initial width, intended namedmeasure offscreen; numericidentifierabbreviations fold0212/0215. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Home DERP region | broken | Metadata consumes initial width, intended namedmeasure offscreen; numericidentifierabbreviations fold0212/0215. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Network & service telemetry / Node Metrics | Peer relay endpoints | broken | Metadata consumes initial width, intended namedmeasure offscreen; numericidentifierabbreviations fold0212/0215. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Security/lifecycle changes/s | correct | Source question/metric/aggregation/unit are consistent: Rate of audit change events by change kind and action.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Device churn | correct | Source question/metric/aggregation/unit are consistent: Device add/remove/update rate over time.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Changes by actor type | correct | Source question/metric/aggregation/unit are consistent: Total change events in the selected range, broken out by actor type (user/api-key/etc).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Audit actions over time | misleading | count_over_time(…[$__auto]) yields event counts per rolling window, but defaults.unit=cps labels the output as events per second. The frozen audit substitutes 60s, creating a factor-60 rate interpretation error. Several Audit Trail and Log explorer panels label count_over_time over a variable automatic interval with count-per-second units. The query returns window counts; changing the automatic interval changes the quantity while the displayed rate interpretation remains fixed. | TSO-0226 (Keep rolling audit-log counts distinct from per-second rates) |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Audit events (range) | correct | Source question/metric/aggregation/unit are consistent: Total config-audit events over the selected dashboard time range.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Failed changes — WARN (range) | missing-signal | Audit logs are present but the WARN-only subset is empty. Source severity is assigned from provider error presence, so absence means no matching warning records observed. | |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Audit events by target type | misleading | count_over_time(…[$__auto]) yields event counts per rolling window, but defaults.unit=cps labels the output as events per second. The frozen audit substitutes 60s, creating a factor-60 rate interpretation error. Several Audit Trail and Log explorer panels label count_over_time over a variable automatic interval with count-per-second units. The query returns window counts; changing the automatic interval changes the quantity while the displayed rate interpretation remains fixed. | TSO-0226 (Keep rolling audit-log counts distinct from per-second rates) |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Audit action breakdown (logs) | misleading | count_over_time(…[$__auto]) yields event counts per rolling window, but defaults.unit=cps labels the output as events per second. The frozen audit substitutes 60s, creating a factor-60 rate interpretation error. Several Audit Trail and Log explorer panels label count_over_time over a variable automatic interval with count-per-second units. The query returns window counts; changing the automatic interval changes the quantity while the displayed rate interpretation remains fixed. | TSO-0226 (Keep rolling audit-log counts distinct from per-second rates) |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Top $topn actors over time | misleading | count_over_time(…[$__auto]) yields event counts per rolling window, but defaults.unit=cps labels the output as events per second. The frozen audit substitutes 60s, creating a factor-60 rate interpretation error. Several Audit Trail and Log explorer panels label count_over_time over a variable automatic interval with count-per-second units. The query returns window counts; changing the automatic interval changes the quantity while the displayed rate interpretation remains fixed. | TSO-0226 (Keep rolling audit-log counts distinct from per-second rates) |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Top $topn targets over time | misleading | Default annotations obscure the named time-series view; this render finding is independent of backend query success. | TSO-0226 (Keep rolling audit-log counts distinct from per-second rates); TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Audit: metric vs log | misleading | Published fresh solo view has correct metric and distinct log-event legend/spikes with no native error. D36 is fixed. Earlier default-grid annotation interference remains separately filed; a solo pass is not default-grid proof. | TSO-0172 (comprehensive live dashboard audit); TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Recent configuration changes | misleading | Inline metadata wraps across many lines per entry and reduces default scanning/event coverage. | TSO-0232 (Keep default log rows scannable while retaining metadata details) |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Log stream — $log_event | misleading | Inline metadata wraps across many lines per entry and reduces default scanning/event coverage. | TSO-0232 (Keep default log rows scannable while retaining metadata details) |
| tailscale2otel-tailnet | Security, identity & governance / Audit Trail | Log volume by event | misleading | Default annotations obscure the named time-series view; this render finding is independent of backend query success. | TSO-0226 (Keep rolling audit-log counts distinct from per-second rates); TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Security, identity & governance / Risk & ACL | Wildcard rules | correct | Source question/metric/aggregation/unit are consistent: Number of ACL rules containing wildcards, by section and position.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Risk & ACL | Unrestricted rules (grants) | correct | Source question/metric/aggregation/unit are consistent: Grant rules with no destination restriction.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Risk & ACL | Unrestricted rules (acls) | correct | Source question/metric/aggregation/unit are consistent: ACL rules with no destination restriction.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Risk & ACL | SSH wildcard | correct | Source question/metric/aggregation/unit are consistent: Whether any SSH rule uses a wildcard source or destination.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Risk & ACL | Auto-approvers by kind | misleading | Root inspection finds generic Value/unlabeled categories instead of the named source dimension. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Security, identity & governance / Risk & ACL | Posture-gated rules | correct | Source question/metric/aggregation/unit are consistent: Rules that require a passing device-posture check, by section.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Risk & ACL | Unrestricted ACL/grant rules (log detail) | missing-signal | Unrestricted ACL/grant counts and SSH wildcard flag are zero; changed-policy risk-detail logs require a matching risk observation. Other risk classes or change timing are not independently evidenced. | |
| tailscale2otel-tailnet | Security, identity & governance / Risk & ACL | Tailnet-lock errors | correct | Source question/metric/aggregation/unit are consistent: Devices with a non-empty tailnet-lock error (e.g; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Risk & ACL | Nodes with tailnet-lock errors | missing-signal | Fleet tailnet-lock error gauge is observed as zero; per-device error logs require a lock error. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Integrations configured | correct | Source question/metric/aggregation/unit are consistent: Configured device-posture (MDM/EDR) integrations, e.g; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Devices matched by integration | misleading | Root inspection finds generic Value/unlabeled categories instead of the named source dimension. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Oldest sync age | correct | Source question/metric/aggregation/unit are consistent: Time since the least-recently-synced integration last synced (alert on staleness).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Posture match rate | correct | Source question/metric/aggregation/unit are consistent: Fraction of possible-match devices that were actually matched by the integration.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Integration sync detail | misleading | Related measurements are split into repeated sparse entity rows with blank siblings; source data does not arrive as a coherent operator-facing row. | TSO-0218 (Join related measurements into coherent per-entity table rows) |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Encryption posture population | broken | Root inspection finds clipped/truncated or overlapping category/Unknown text that prevents reliable recovery of the named population. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Compliance distribution | misleading | Root inspection finds generic Value/unlabeled categories instead of the named source dimension. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Posture attribute values by device | correct | Measurement columns and units readable; snapshot logdense butpopulated. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Posture attribute expiry — time remaining | missing-signal | Root count of explicit attribute-expiry series is empty throughout the frozen range while ordinary attribute data exists. The explicit-expiry prerequisite is absent from observed telemetry; no source expiry can be invented from an attribute value. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Expiring posture attributes (log detail) | missing-signal | Root count of explicit attribute-expiry series is empty throughout the frozen range while ordinary attribute data exists. The explicit-expiry prerequisite is absent from observed telemetry; no source expiry can be invented from an attribute value. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Client posture population | correct | Measurement columns and units readable; snapshot logdense butpopulated. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Devices needing update | correct | Source question/metric/aggregation/unit are consistent: Count of devices with a client update available.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Release track split | correct | Source question/metric/aggregation/unit are consistent: Device count by Tailscale release track (stable/unstable), from posture data.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Client version distribution | correct | Source question/metric/aggregation/unit are consistent: Device count by reported Tailscale client version, from posture data.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Posture & Compliance | Device posture snapshot | correct | Measurement columns and units readable; snapshot logdense butpopulated. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Device keys ≤7d | correct | Source question/metric/aggregation/unit are consistent: Devices whose node key expires within 7 days and has not already expired; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Device keys ≤30d | correct | Source question/metric/aggregation/unit are consistent: Devices whose node key expires within 30 days — the early-warning counterpart to the 7-day tile, sized for a rotation window rather than an incident.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | API/auth keys ≤7d | correct | Source question/metric/aggregation/unit are consistent: Tailnet API keys and auth keys expiring within 7 days; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | API/auth keys ≤30d | correct | Source question/metric/aggregation/unit are consistent: Tailnet API keys and auth keys expiring within 30 days.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Device shares: pending vs accepted | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Device share invites grouped by accepted status; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Exit-node-granting shares | correct | Source question/metric/aggregation/unit are consistent: Device share invites that also grant exit-node use, so the recipient can route their traffic through the shared device; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Multi-use shares | correct | Source question/metric/aggregation/unit are consistent: Device share invites that can be redeemed more than once, so a single leaked link admits an unbounded number of recipients.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Expiring device keys (log detail) | missing-signal | Root actual 14-day positive-lifetime warning predicate is empty; source expiry data exists (earliest endpoint remaining lifetime exceeds 14d). No eligible observed device expiry warnings. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Expiring auth keys & credentials (log detail) | missing-signal | Root configured 168h positive-lifetime predicate is empty; key expiry input exists. No eligible observed credential expiry warnings in the fixed window. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Key & user-invite lifecycle timeline | missing-signal | Lifecycle selector has no matching event. User collection is successful and separate invite API flags are present; deployed code emits lifecycle records only for newly observed/disappearing invites or key creation/revocation. Quiet inventory alone is not a lifecycle event. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Key age (p50 / p90) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: How old the tailnet’s credentials are; 2 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Keys by owner and type | correct | Source question/metric/aggregation/unit are consistent: Who holds the tailnet’s credentials, by owning user id and key type; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Unrestricted OAuth clients | correct | Source question/metric/aggregation/unit are consistent: OAuth clients whose device-create capability is restricted to no tags at all, so any device they register can claim any tag.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | OAuth client tag restrictions | misleading | Count visible, descriptiontexttruncated; fold0212. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Credential privilege class (blast radius) | correct | Privilege class readable despitemetadatawidth. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | OAuth client tag restriction class | broken | The actual table leaves the named Tag scope/Expires in/Alive/Enabled measurement offscreen or clipped behind metadata. Tailnet settings is the table, not its similarly named Overview time series. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | User account age (p50 / p90) | misleading | Root exhaustive native partition confirms readable measures with annotation occlusion/clutter; readability of the primary measure does not remove the filed presentation defect. Source question/metric/aggregation/unit are consistent: Age of the tailnet’s user accounts; 2 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Pending user-invite age (p50 / p90) | missing-signal | Separate invite API state flags are present, users collection succeeds, and no per-open-invite observation series exists. Deployed collector emits invite buckets only for returned open invites; manual invitations without email timestamps also do not create pending-age observations. No identity values are required. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Pending device-invite age (p50 / p90) | missing-signal | Root pending-device invite probe is empty while accepted/share inventory exists. The pending subset has no observed members, so pending age and pending exit-node-share panels have no input; do not relabel all invite inventory as absent. | |
| tailscale2otel-tailnet | Security, identity & governance / Identity & Keys | Contact needs verification | correct | Source question/metric/aggregation/unit are consistent: Whether any tailnet contact address requires re-verification (admin/security/billing).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Kubernetes API requests/s | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Requests by verb | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Requests by namespace | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Requests by resource (top $topn) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Requests by user agent (top $topn) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Kubernetes request paths | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Sensitive reads/s by resource | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Sensitive reads by namespace | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Sensitive reads by user agent (top $topn) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Users reading sensitive resources ($topn) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Exec sessions/s by command class | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Exec sessions by namespace | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Exec sessions by session type | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Users by exec/attach/portforward sessions ($topn) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Mutations/s by verb | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Mutations by resource (top $topn) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Mutations by namespace | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Users making mutating requests ($topn) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | RBAC probes/s by resource | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | RBAC probes by namespace | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Users making RBAC/permission probes ($topn) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Sessions started/s by type | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Sessions by namespace | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Sessions by command class | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Users starting terminal sessions ($topn) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Schema drift events/s by field | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Schema drift events (range) | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit is disabled; has_k8s_audit and schema-drift sentinels are empty, so this tab/row is hidden. Its fallback zero is not evidence of an active healthy feed and is not claimed as a currently visible defect. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Recent Kubernetes API requests | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Recent terminal sessions | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Secret & sensitive resource reads | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Permission enumeration probes | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Pod log read attempts | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Security, identity & governance / Kubernetes Audit | Exec / attach / port-forward requests | missing-signal | Actual scoped frozen sentinel receipts make the source visibility condition false; this view is ineligible and no pixel pass is claimed. Kubernetes audit collector is explicitly disabled; do not infer zero Kubernetes activity from absent counters/logs. | |
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | ACL change evidence age | misleading | The populated measure is colored warning-like red without a supported health interpretation in the documented quantity. | TSO-0219 (Align health and inventory colors with documented semantics) |
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | ACL size | misleading | The populated measure is colored warning-like red without a supported health interpretation in the documented quantity. | TSO-0219 (Align health and inventory colors with documented semantics) |
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | ACL rules by section | broken | Root inspection finds clipped/truncated or overlapping category/Unknown text that prevents reliable recovery of the named population. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | Auto-approvers (inventory) | misleading | Root inspection finds generic Value/unlabeled categories instead of the named source dimension. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | Posture-gated rules (inventory) | correct | Source question/metric/aggregation/unit are consistent: Rules carrying a device-posture condition, by section; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | ACL policy validated | correct | Source question/metric/aggregation/unit are consistent: 1 when the active policy — including the tests embedded in its own tests section — validated cleanly on the last check; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. |
|
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | Validation issues (last check) | correct | Source question/metric/aggregation/unit are consistent: Counts from the last policy validation; 3 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | Validation issues by kind (logs) | missing-signal | All three last-check validation issue gauges are observed as zero and validation-ok is one; issue logs emit only for nonzero issue kinds. | |
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | Policy snapshots (chunked) | misleading | Populated longlines extend beyondwidth; fold0232, notmissingdata. | TSO-0232 (Keep default log rows scannable while retaining metadata details) |
| tailscale2otel-tailnet | Policy & configuration / Access & ACL | Policy changes (unified diffs) | correct | Readablediff with showmore; expandedcontentnotinspected. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | MagicDNS | correct | Publishedfreshcorrecttitle concreteenabledstate,noredindicator. Priorwarningnonreproduced, no sourcecauseclaim. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Nameservers | correct | Source question/metric/aggregation/unit are consistent: Global nameservers configured for the tailnet; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Search paths | correct | Source question/metric/aggregation/unit are consistent: Search domains appended to unqualified names on every device; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Split-DNS zones | correct | Source question/metric/aggregation/unit are consistent: Zones routed to a specific resolver rather than the global nameservers; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Override local DNS | correct | Source question/metric/aggregation/unit are consistent: Whether the tailnet’s nameservers replace each device’s local resolvers outright, rather than being added alongside them.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Exit-node resolvers | correct | Source question/metric/aggregation/unit are consistent: Configured resolvers marked usable while a device is routing through an exit node.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Search domains | correct | Source question/metric/aggregation/unit are consistent: The individual search domains behind the Search paths count, one bar each — the fastest way to spot a stale or duplicated entry.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Resolvers | correct | PolicyDNS tablemeasures/statestate visible; distinctfromOverviewtimeseries. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Tailnet settings | broken | The actual table leaves the named Tag scope/Expires in/Alive/Enabled measurement offscreen or clipped behind metadata. Tailnet settings is the table, not its similarly named Overview time series. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Device key duration | misleading | The populated measure is colored warning-like red without a supported health interpretation in the documented quantity. | TSO-0219 (Align health and inventory colors with documented semantics) |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Tailnet features | correct | PolicyDNS tablemeasures/statestate visible; distinctfromOverviewtimeseries. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | External-tailnets role | correct | PolicyDNS tablemeasures/statestate visible; distinctfromOverviewtimeseries. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Route-selection mode | broken | Root inspection finds clipped/truncated or overlapping category/Unknown text that prevents reliable recovery of the named population. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Webhook endpoints | correct | Source question/metric/aggregation/unit are consistent: Configured webhook endpoints on the tailnet; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | DNS configuration snapshots | missing-signal | Root retained matching snapshot evidence places the latest dns emission before the audit window and its configured 24h next heartbeat after the window. No change-triggered snapshot emission is observed in the window. This explains an enabled snapshot panel being empty without inventing a disabled feature or claiming upstream configuration never changed. | |
| tailscale2otel-tailnet | Policy & configuration / DNS & Settings | Tailnet settings snapshots | missing-signal | Root retained matching snapshot evidence places the latest settings emission before the audit window and its configured 24h next heartbeat after the window. No change-triggered snapshot emission is observed in the window. This explains an enabled snapshot panel being empty without inventing a disabled feature or claiming upstream configuration never changed. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Stale users (>30d) | misleading | Root inspected green No data/absence states. Known no-match predicates, empty desired configuration and missing telemetry must not share an unsupported healthy color. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | User invites | missing-signal | Separate invite API state flags are present, users collection succeeds, and no per-open-invite observation series exists. Deployed collector emits invite buckets only for returned open invites; manual invitations without email timestamps also do not create pending-age observations. No identity values are required. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Users by role | correct | Source question/metric/aggregation/unit are consistent: Tailnet users by assigned role (owner / admin / member / …); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Users by status | correct | Source question/metric/aggregation/unit are consistent: Tailnet users by account status (active / idle / suspended / needs-approval); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Users by type | correct | Source question/metric/aggregation/unit are consistent: Tailnet users by type — a member of the tailnet versus a shared-in user from another tailnet.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Per-user detail | misleading | Related measurements are split into repeated sparse entity rows with blank siblings; source data does not arrive as a coherent operator-facing row. | TSO-0218 (Join related measurements into coherent per-entity table rows) |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Keys by type | correct | Source question/metric/aggregation/unit are consistent: API and auth keys the tailnet holds, split by key type and by auth kind (user-owned versus OAuth-minted); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Credential scopes (top-N) | misleading | Whole-panel absence text is injected into a nullable Owner cell even while the row has a numeric scope measure. | TSO-0230 (Keep whole-panel absence explanations out of nullable table cells) |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Key scope inventory (logs) | misleading | The actual table uses generic Value #A instead of a meaningful observation measure header. | TSO-0216 (Restore meaningful category names in distribution charts) |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Key expiry (time until) | broken | The actual table leaves the named Tag scope/Expires in/Alive/Enabled measurement offscreen or clipped behind metadata. Tailnet settings is the table, not its similarly named Overview time series. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | Preauthorized auth keys | correct | Source question/metric/aggregation/unit are consistent: Count of auth keys marked preauthorized (auto-approved, no manual login).; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | OAuth applications | correct | Source question/metric/aggregation/unit are consistent: Registered OAuth applications on the tailnet; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | OAuth apps by privilege class | missing-signal | OAuth application count is observed as zero throughout the window; per-app and age/scope observations have no population. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | OAuth app age (p50 / p90) | missing-signal | OAuth application count is observed as zero throughout the window; per-app and age/scope observations have no population. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | OAuth app scope & attribute counts | missing-signal | OAuth application count is observed as zero throughout the window; per-app and age/scope observations have no population. | |
| tailscale2otel-tailnet | Policy & configuration / Identity & Credentials | OAuth application inventory (logs) | missing-signal | OAuth application count is observed as zero throughout the window; per-app and age/scope observations have no population. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Services (VIP) | correct | Source question/metric/aggregation/unit are consistent: Tailscale Services (VIP services) advertised in the tailnet.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Backing hosts by service | correct | Root independent review confirms Hosts and, where applicable, Port rules are visible with the service identity. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Service tags (rollup) | broken | Root inspection finds clipped/truncated or overlapping category/Unknown text that prevents reliable recovery of the named population. | TSO-0211 (Keep dense entity and category labels readable in dashboard panels) |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Port rules per service | correct | Source question/metric/aggregation/unit are consistent: Port rules exposed by each Service; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | VIP service health | correct | Root independent review confirms Hosts and, where applicable, Port rules are visible with the service identity. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Backing host identity | misleading | Root independent review confirms a misleading display state, quantity, unit or label; see the named filed follow-up for the bounded correction. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Policy & configuration / Integrations | VIP service topology | broken | The actual topology is blank without an operator explanation despite backend query data; exact frontend/plugin cause is unresolved. | TSO-0221 (Make topology panels interpretable in populated and empty states) |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Desired-event coverage | missing-signal | desired_events has length zero; deployed webhook collector returns before emitting desired-coverage/mismatch signals. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Unrecognized desired events | misleading | Root inspected green No data/absence states. Known no-match predicates, empty desired configuration and missing telemetry must not share an unsupported healthy color. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Subscribers per event category | correct | Source question/metric/aggregation/unit are consistent: Endpoints subscribed to each documented category; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Per-endpoint subscriptions | missing-signal | Configured webhook endpoint count is zero throughout the window; per-endpoint subscription and age families have no population. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Webhook endpoint age (p50 / p90) | missing-signal | Configured webhook endpoint count is zero throughout the window; per-endpoint subscription and age families have no population. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Desired-event mismatches (logs) | missing-signal | desired_events has length zero; deployed webhook collector returns before emitting desired-coverage/mismatch signals. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | GeoIP database age since build | correct | Source question/metric/aggregation/unit are consistent: How old the LOADED database’s build is, per database (country / asn); 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | GeoIP database downloads | misleading | Root verified default annotation regions/time-label clipping obscure the actual time-series trace. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Policy & configuration / Integrations | GeoIP lookups by database and result | misleading | Root verified default annotation regions/time-label clipping obscure the actual time-series trace. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Policy & configuration / Integrations | GeoIP database reloads | misleading | Root verified default annotation regions/time-label clipping obscure the actual time-series trace. | TSO-0220 (Keep default annotations and time axes from obscuring traces) |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Posture integration last-sync errors | correct | Integration, Provider, Last sync errored and Age fields are all visible in root exact independent review. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Webhook configuration snapshots | missing-signal | Root retained matching snapshot evidence places the latest webhooks emission before the audit window and its configured 24h next heartbeat after the window. No change-triggered snapshot emission is observed in the window. This explains an enabled snapshot panel being empty without inventing a disabled feature or claiming upstream configuration never changed. | |
| tailscale2otel-tailnet | Policy & configuration / Integrations | Posture-integration configuration snapshots | correct | Root independent review confirms timestamped snapshot bodies are visible. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Connectors | correct | Source question/metric/aggregation/unit are consistent: Configured Border0 PAM connectors.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Services by type | correct | Source question/metric/aggregation/unit are consistent: Border0 PAM services grouped by socket type; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Policies | correct | Source question/metric/aggregation/unit are consistent: Configured Border0 PAM policies.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Identities by kind and role | correct | Source question/metric/aggregation/unit are consistent: PAM identities split by kind and role; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Connector health | misleading | Related measurements are split into repeated sparse entity rows with blank siblings; source data does not arrive as a coherent operator-facing row. | TSO-0218 (Join related measurements into coherent per-entity table rows) |
| tailscale2otel-tailnet | Policy & configuration / PAM | Connector builds | correct | Connector, Version and Build date all visible in root independent review. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Service health | broken | The actual table leaves the named Tag scope/Expires in/Alive/Enabled measurement offscreen or clipped behind metadata. Tailnet settings is the table, not its similarly named Overview time series. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Policy & configuration / PAM | Service settings | broken | The actual table leaves the named Tag scope/Expires in/Alive/Enabled measurement offscreen or clipped behind metadata. Tailnet settings is the table, not its similarly named Overview time series. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Policy & configuration / PAM | Policy settings | broken | The actual table leaves the named Tag scope/Expires in/Alive/Enabled measurement offscreen or clipped behind metadata. Tailnet settings is the table, not its similarly named Overview time series. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Policy & configuration / PAM | Organization settings | broken | The actual table leaves the named Tag scope/Expires in/Alive/Enabled measurement offscreen or clipped behind metadata. Tailnet settings is the table, not its similarly named Overview time series. | TSO-0212 (Keep table measurements visible ahead of metadata) |
| tailscale2otel-tailnet | Policy & configuration / PAM | Plan | correct | Root independent review confirms the named plan text is visible; one-hot numeric Value is not required. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Subscription limits | correct | Source question/metric/aggregation/unit are consistent: Configured subscription ceilings by stable limit name.; 1 query identity/identities return numeric data. Native view is bound to the explicit root reviewer/image partition. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Authorized sessions | missing-signal | pam_sessions scrape succeeds at all 91 returned points. Deployed code emits counters/duration/events only for newly observed sessions and active snapshots only for returned active members; these input populations are not observed. Inventory does not imply sessions, and this is not an authentication/unsupported failure. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Active sessions | misleading | Root final actual review confirms a green No data state for the absent session population; missing activity must not be represented as a healthy measured zero. | TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) |
| tailscale2otel-tailnet | Policy & configuration / PAM | Killed sessions | missing-signal | pam_sessions scrape succeeds at all 91 returned points. Deployed code emits counters/duration/events only for newly observed sessions and active snapshots only for returned active members; these input populations are not observed. Inventory does not imply sessions, and this is not an authentication/unsupported failure. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Session duration (p50 / p90 / p99) | missing-signal | pam_sessions scrape succeeds at all 91 returned points. Deployed code emits counters/duration/events only for newly observed sessions and active snapshots only for returned active members; these input populations are not observed. Inventory does not imply sessions, and this is not an authentication/unsupported failure. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | Session events | missing-signal | pam_sessions scrape succeeds at all 91 returned points. Deployed code emits counters/duration/events only for newly observed sessions and active snapshots only for returned active members; these input populations are not observed. Inventory does not imply sessions, and this is not an authentication/unsupported failure. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | PAM authorized session records | missing-signal | PAM session records are explicitly disabled by session_log_enabled=false. | |
| tailscale2otel-tailnet | Policy & configuration / PAM | PAM configuration snapshots | correct | Root independent review confirms timestamped snapshot bodies are visible. |
Catalog dispositions bound to published final window 3
Task: TSO-0172 (comprehensive live dashboard audit).
Actual source query references, not descriptions or variable-only claims. Histogram _bucket/_sum/_count references credit their base descriptor. Current catalog descriptors are compared against verified deployed v5.2.1 (exact count and catalog hash are in the JSON stats). The final horizon panels now reference catchup-skipped, which is absent from the verified deployed catalog. All current descriptors must reach an actual final-source panel or the one documented templated-event exemption. Templated webhook events are reached by the broad event picker regex. A matching query with data does not prove each signal in a compound expression is emitted.
| Kind | Signal | Deployed descriptor | Disposition | Panel references |
|---|---|---|---|---|
| log_event | tailscale.acl.policy_diff | yes | reaches-panel | tailscale2otel-tailnet/panel-274 |
| log_event | tailscale.acl.policy_snapshot | yes | reaches-panel | tailscale2otel-tailnet/panel-273 |
| log_event | tailscale.acl.risky_rule | yes | reaches-panel | tailscale2otel-tailnet/panel-194 |
| log_event | tailscale.acl.validation_issue | yes | reaches-panel | tailscale2otel-tailnet/panel-272 |
| log_event | tailscale.config.audit | yes | reaches-panel | tailscale2otel-health/panel-98, tailscale2otel-tailnet/panel-177, tailscale2otel-tailnet/panel-178, tailscale2otel-tailnet/panel-179, tailscale2otel-tailnet/panel-180, tailscale2otel-tailnet/panel-181, tailscale2otel-tailnet/panel-182, tailscale2otel-tailnet/panel-183, tailscale2otel-tailnet/panel-184, tailscale2otel-tailnet/panel-185 |
| log_event | tailscale.device.attribute.expiring | yes | reaches-panel | tailscale2otel-tailnet/panel-206 |
| log_event | tailscale.device.change | yes | reaches-panel | tailscale2otel-tailnet/panel-45 |
| log_event | tailscale.device.key_expiring | yes | reaches-panel | tailscale2otel-tailnet/panel-216 |
| log_event | tailscale.device.posture | yes | reaches-panel | tailscale2otel-tailnet/panel-211, tailscale2otel-tailnet/panel-82 |
| log_event | tailscale.device.posture.failing_assertions | no | reaches-panel | tailscale2otel-tailnet/panel-82 |
| log_event | tailscale.device.tailnet_lock_error | yes | reaches-panel | tailscale2otel-tailnet/panel-196 |
| log_event | tailscale.device_invite | yes | reaches-panel | tailscale2otel-tailnet/panel-44 |
| log_event | tailscale.dns.snapshot | yes | reaches-panel | tailscale2otel-tailnet/panel-289 |
| log_event | tailscale.k8s.api_request | yes | reaches-panel | tailscale2otel-tailnet/panel-259, tailscale2otel-tailnet/panel-261, tailscale2otel-tailnet/panel-262, tailscale2otel-tailnet/panel-263, tailscale2otel-tailnet/panel-264 |
| log_event | tailscale.k8s.session | yes | reaches-panel | tailscale2otel-tailnet/panel-260 |
| log_event | tailscale.key.created | yes | reaches-panel | tailscale2otel-tailnet/panel-218 |
| log_event | tailscale.key.expiring | yes | reaches-panel | tailscale2otel-tailnet/panel-217, tailscale2otel-tailnet/panel-218 |
| log_event | tailscale.key.revoked | yes | reaches-panel | tailscale2otel-tailnet/panel-218 |
| log_event | tailscale.key.scopes | yes | reaches-panel | tailscale2otel-tailnet/panel-299 |
| log_event | tailscale.logstream.error | yes | reaches-panel | tailscale2otel-health/panel-123 |
| log_event | tailscale.network.flow | yes | reaches-panel | tailscale2otel-tailnet/panel-118, tailscale2otel-tailnet/panel-119, tailscale2otel-tailnet/panel-140 |
| log_event | tailscale.oauth_app.info | yes | reaches-panel | tailscale2otel-tailnet/panel-306 |
| log_event | tailscale.pam.session | yes | reaches-panel | tailscale2otel-tailnet/panel-345 |
| log_event | tailscale.pam.snapshot | yes | reaches-panel | tailscale2otel-tailnet/panel-344 |
| log_event | tailscale.posture_integrations.snapshot | yes | reaches-panel | tailscale2otel-tailnet/panel-326 |
| log_event | tailscale.settings.snapshot | yes | reaches-panel | tailscale2otel-tailnet/panel-290 |
| log_event | tailscale.user_invite.no_longer_open | yes | reaches-panel | tailscale2otel-tailnet/panel-218 |
| log_event | tailscale.user_invite.observed | yes | reaches-panel | tailscale2otel-tailnet/panel-218 |
| log_event | tailscale.webhook. |
yes | structural-templated-event-reached-by-regex | tailscale2otel-tailnet/panel-186 |
| log_event | tailscale.webhook_endpoints.event_mismatch | yes | reaches-panel | tailscale2otel-tailnet/panel-319 |
| log_event | tailscale.webhooks.snapshot | yes | reaches-panel | tailscale2otel-tailnet/panel-325 |
| log_event | tailscale2otel.config.advisory | yes | reaches-panel | tailscale2otel-health/panel-157 |
| metric | process.cpu.time | yes | reaches-panel | tailscale2otel-health/panel-132, tailscale2otel-health/panel-16 |
| metric | process.uptime | yes | reaches-panel | tailscale2otel-health/panel-131, tailscale2otel-health/panel-14 |
| metric | tailscale.acl.autoapprovers | yes | reaches-panel | tailscale2otel-tailnet/panel-192, tailscale2otel-tailnet/panel-26, tailscale2otel-tailnet/panel-268 |
| metric | tailscale.acl.last_audit_change | yes | reaches-panel | tailscale2otel-tailnet/panel-265, tailscale2otel-tailnet/panel-5 |
| metric | tailscale.acl.last_changed | yes | reaches-panel | tailscale2otel-tailnet/panel-265, tailscale2otel-tailnet/panel-5 |
| metric | tailscale.acl.posture_gated_rules | yes | reaches-panel | tailscale2otel-tailnet/panel-193, tailscale2otel-tailnet/panel-269 |
| metric | tailscale.acl.rules | yes | reaches-panel | tailscale2otel-tailnet/panel-267 |
| metric | tailscale.acl.size | yes | reaches-panel | tailscale2otel-tailnet/panel-192, tailscale2otel-tailnet/panel-266, tailscale2otel-tailnet/panel-268 |
| metric | tailscale.acl.ssh_wildcard | yes | reaches-panel | tailscale2otel-tailnet/panel-191, tailscale2otel-tailnet/panel-30 |
| metric | tailscale.acl.unrestricted_rules | yes | reaches-panel | tailscale2otel-tailnet/panel-189, tailscale2otel-tailnet/panel-190, tailscale2otel-tailnet/panel-25 |
| metric | tailscale.acl.validation.errors | yes | reaches-panel | tailscale2otel-tailnet/panel-271 |
| metric | tailscale.acl.validation.ok | yes | reaches-panel | tailscale2otel-tailnet/panel-270 |
| metric | tailscale.acl.validation.test_failures | yes | reaches-panel | tailscale2otel-tailnet/panel-271 |
| metric | tailscale.acl.validation.warnings | yes | reaches-panel | tailscale2otel-tailnet/panel-271 |
| metric | tailscale.acl.wildcard_rules | yes | reaches-panel | tailscale2otel-tailnet/panel-188 |
| metric | tailscale.config.audit.changes | yes | reaches-panel | tailscale2otel-tailnet/panel-174, tailscale2otel-tailnet/panel-175, tailscale2otel-tailnet/panel-176, tailscale2otel-tailnet/panel-184 |
| metric | tailscale.config.audit.deferred.delay | yes | reaches-panel | tailscale2otel-health/panel-100 |
| metric | tailscale.config.audit.events | yes | reaches-panel | tailscale2otel-health/panel-97, tailscale2otel-tailnet/panel-12, tailscale2otel-tailnet/panel-14, tailscale2otel-tailnet/panel-15 |
| metric | tailscale.config.audit.processing.delay | yes | reaches-panel | tailscale2otel-health/panel-101 |
| metric | tailscale.config.audit.schema_drift | yes | reaches-panel | tailscale2otel-health/panel-102 |
| metric | tailscale.contact.needs_verification | yes | reaches-panel | tailscale2otel-tailnet/panel-228 |
| metric | tailscale.derp.region.devices | yes | reaches-panel | tailscale2otel-tailnet/panel-158 |
| metric | tailscale.derp.region.latency_min | yes | reaches-panel | tailscale2otel-tailnet/panel-157 |
| metric | tailscale.derp.region.preferred | yes | reaches-panel | tailscale2otel-tailnet/panel-159 |
| metric | tailscale.device.attribute | yes | reaches-panel | tailscale2otel-tailnet/panel-202, tailscale2otel-tailnet/panel-204 |
| metric | tailscale.device.attribute.expiry | yes | reaches-panel | tailscale2otel-tailnet/panel-205 |
| metric | tailscale.device.attribute.info | yes | reaches-panel | tailscale2otel-tailnet/panel-203 |
| metric | tailscale.device.attributes.dropped | yes | reaches-panel | tailscale2otel-tailnet/panel-71 |
| metric | tailscale.device.blocks_incoming_connections | yes | reaches-panel | tailscale2otel-tailnet/panel-61, tailscale2otel-tailnet/panel-68 |
| metric | tailscale.device.connectivity.direct_capable | yes | reaches-panel | tailscale2otel-tailnet/panel-86, tailscale2otel-tailnet/panel-92 |
| metric | tailscale.device.connectivity.endpoints | yes | reaches-panel | tailscale2otel-tailnet/panel-89, tailscale2otel-tailnet/panel-92 |
| metric | tailscale.device.connectivity.hard_nat | yes | reaches-panel | tailscale2otel-tailnet/panel-93 |
| metric | tailscale.device.connectivity.ipv6 | yes | reaches-panel | tailscale2otel-tailnet/panel-87, tailscale2otel-tailnet/panel-92 |
| metric | tailscale.device.connectivity.udp | yes | reaches-panel | tailscale2otel-tailnet/panel-88, tailscale2otel-tailnet/panel-92 |
| metric | tailscale.device.derp.latency | yes | reaches-panel | tailscale2otel-tailnet/panel-102, tailscale2otel-tailnet/panel-103 |
| metric | tailscale.device.distro | yes | reaches-panel | tailscale2otel-tailnet/panel-56 |
| metric | tailscale.device.exit_node | yes | reaches-panel | tailscale2otel-tailnet/panel-99 |
| metric | tailscale.device.key.expiry | yes | reaches-panel | tailscale2otel-tailnet/panel-212, tailscale2otel-tailnet/panel-213, tailscale2otel-tailnet/panel-4, tailscale2otel-tailnet/panel-59, tailscale2otel-tailnet/panel-72, tailscale2otel-tailnet/panel-74 |
| metric | tailscale.device.key_expiry_disabled | yes | reaches-panel | tailscale2otel-tailnet/panel-61, tailscale2otel-tailnet/panel-67 |
| metric | tailscale.device.last_seen | yes | reaches-panel | tailscale2otel-tailnet/panel-46, tailscale2otel-tailnet/panel-60 |
| metric | tailscale.device.multiple_connections | yes | reaches-panel | tailscale2otel-tailnet/panel-61, tailscale2otel-tailnet/panel-69 |
| metric | tailscale.device.online | yes | reaches-panel | tailscale2otel-tailnet/panel-1, tailscale2otel-tailnet/panel-13, tailscale2otel-tailnet/panel-23, tailscale2otel-tailnet/panel-24, tailscale2otel-tailnet/panel-31, tailscale2otel-tailnet/panel-32, tailscale2otel-tailnet/panel-33, tailscale2otel-tailnet/panel-38, tailscale2otel-tailnet/panel-4, tailscale2otel-tailnet/panel-63 |
| metric | tailscale.device.posture | yes | reaches-panel | tailscale2otel-tailnet/panel-207, tailscale2otel-tailnet/panel-209, tailscale2otel-tailnet/panel-210, tailscale2otel-tailnet/panel-75, tailscale2otel-tailnet/panel-76 |
| metric | tailscale.device.posture.impacting | no | reaches-panel | tailscale2otel-tailnet/panel-81 |
| metric | tailscale.device.posture.passing | no | reaches-panel | tailscale2otel-tailnet/panel-80 |
| metric | tailscale.device.posture_identity.disabled | yes | reaches-panel | tailscale2otel-tailnet/panel-61, tailscale2otel-tailnet/panel-70 |
| metric | tailscale.device.routes.advertised | yes | reaches-panel | tailscale2otel-tailnet/panel-100 |
| metric | tailscale.device.routes.enabled | yes | reaches-panel | tailscale2otel-tailnet/panel-100 |
| metric | tailscale.device.ssh_enabled | yes | reaches-panel | tailscale2otel-tailnet/panel-61, tailscale2otel-tailnet/panel-66 |
| metric | tailscale.device.update_available | yes | reaches-panel | tailscale2otel-tailnet/panel-2, tailscale2otel-tailnet/panel-208, tailscale2otel-tailnet/panel-34, tailscale2otel-tailnet/panel-58 |
| metric | tailscale.device.version_skew | yes | reaches-panel | tailscale2otel-tailnet/panel-62 |
| metric | tailscale.device_invites.count | yes | reaches-panel | tailscale2otel-tailnet/panel-229, tailscale2otel-tailnet/panel-230, tailscale2otel-tailnet/panel-231, tailscale2otel-tailnet/panel-29 |
| metric | tailscale.device_invites.pending_age | yes | reaches-panel | tailscale2otel-tailnet/panel-227 |
| metric | tailscale.devices.age | yes | reaches-panel | tailscale2otel-tailnet/panel-54 |
| metric | tailscale.devices.by_country | yes | reaches-panel | tailscale2otel-tailnet/panel-57 |
| metric | tailscale.devices.by_distro | yes | reaches-panel | tailscale2otel-tailnet/panel-55 |
| metric | tailscale.devices.by_tag | yes | reaches-panel | tailscale2otel-tailnet/panel-53 |
| metric | tailscale.devices.by_version | yes | reaches-panel | tailscale2otel-tailnet/panel-52 |
| metric | tailscale.devices.client_supports | yes | reaches-panel | tailscale2otel-tailnet/panel-85 |
| metric | tailscale.devices.count | yes | reaches-panel | tailscale2otel-tailnet/panel-1, tailscale2otel-tailnet/panel-202, tailscale2otel-tailnet/panel-207, tailscale2otel-tailnet/panel-37, tailscale2otel-tailnet/panel-39, tailscale2otel-tailnet/panel-4, tailscale2otel-tailnet/panel-40, tailscale2otel-tailnet/panel-41, tailscale2otel-tailnet/panel-42, tailscale2otel-tailnet/panel-43, tailscale2otel-tailnet/panel-83, tailscale2otel-tailnet/panel-84, tailscale2otel-tailnet/panel-90 |
| metric | tailscale.devices.direct_capable | yes | reaches-panel | tailscale2otel-tailnet/panel-83 |
| metric | tailscale.devices.ephemeral | yes | reaches-panel | tailscale2otel-tailnet/panel-48 |
| metric | tailscale.devices.hard_nat | yes | reaches-panel | tailscale2otel-tailnet/panel-84, tailscale2otel-tailnet/panel-90 |
| metric | tailscale.devices.key_expiry | yes | reaches-panel | tailscale2otel-tailnet/panel-73 |
| metric | tailscale.devices.key_expiry_disabled | yes | reaches-panel | tailscale2otel-tailnet/panel-65 |
| metric | tailscale.devices.outdated | yes | reaches-panel | tailscale2otel-tailnet/panel-49 |
| metric | tailscale.devices.posture.failed | no | reaches-panel | tailscale2otel-tailnet/panel-78 |
| metric | tailscale.devices.posture.names_dropped | no | reaches-panel | tailscale2otel-tailnet/panel-79 |
| metric | tailscale.devices.posture_compliance.failed | yes | reaches-panel | tailscale2otel-tailnet/panel-77 |
| metric | tailscale.devices.ssh_enabled | yes | reaches-panel | tailscale2otel-tailnet/panel-64 |
| metric | tailscale.devices.untagged | yes | reaches-panel | tailscale2otel-tailnet/panel-28, tailscale2otel-tailnet/panel-47 |
| metric | tailscale.dns.magic_dns | yes | reaches-panel | tailscale2otel-tailnet/panel-275 |
| metric | tailscale.dns.nameservers.count | yes | reaches-panel | tailscale2otel-tailnet/panel-276 |
| metric | tailscale.dns.override_local | yes | reaches-panel | tailscale2otel-tailnet/panel-279 |
| metric | tailscale.dns.resolver | yes | reaches-panel | tailscale2otel-tailnet/panel-282 |
| metric | tailscale.dns.resolvers.use_with_exit_node | yes | reaches-panel | tailscale2otel-tailnet/panel-280 |
| metric | tailscale.dns.search_path | yes | reaches-panel | tailscale2otel-tailnet/panel-281 |
| metric | tailscale.dns.search_paths.count | yes | reaches-panel | tailscale2otel-tailnet/panel-277 |
| metric | tailscale.dns.split_zones.count | yes | reaches-panel | tailscale2otel-tailnet/panel-278 |
| metric | tailscale.exit_node.io | yes | reaches-panel | tailscale2otel-tailnet/panel-116 |
| metric | tailscale.exit_node.packets | yes | reaches-panel | tailscale2otel-tailnet/panel-117 |
| metric | tailscale.exit_nodes.count | yes | reaches-panel | tailscale2otel-tailnet/panel-94, tailscale2otel-tailnet/panel-95 |
| metric | tailscale.feature.enabled | yes | reaches-panel | tailscale2otel-tailnet/panel-16, tailscale2otel-tailnet/panel-285, tailscale2otel-tailnet/panel-6 |
| metric | tailscale.fleet.latest_version | yes | reaches-panel | tailscale2otel-tailnet/panel-51 |
| metric | tailscale.geoip.database.build_time | yes | reaches-panel | tailscale2otel-tailnet/panel-320 |
| metric | tailscale.geoip.downloads | yes | reaches-panel | tailscale2otel-tailnet/panel-321 |
| metric | tailscale.geoip.lookups | yes | reaches-panel | tailscale2otel-tailnet/panel-322 |
| metric | tailscale.geoip.reloads | yes | reaches-panel | tailscale2otel-tailnet/panel-323 |
| metric | tailscale.k8s.api.exec_sessions | yes | reaches-panel | tailscale2otel-tailnet/panel-242, tailscale2otel-tailnet/panel-243, tailscale2otel-tailnet/panel-244, tailscale2otel-tailnet/panel-245 |
| metric | tailscale.k8s.api.mutations | yes | reaches-panel | tailscale2otel-tailnet/panel-246, tailscale2otel-tailnet/panel-247, tailscale2otel-tailnet/panel-248, tailscale2otel-tailnet/panel-249 |
| metric | tailscale.k8s.api.rbac_probes | yes | reaches-panel | tailscale2otel-tailnet/panel-250, tailscale2otel-tailnet/panel-251, tailscale2otel-tailnet/panel-252 |
| metric | tailscale.k8s.api.requests | yes | reaches-panel | tailscale2otel-tailnet/panel-232, tailscale2otel-tailnet/panel-233, tailscale2otel-tailnet/panel-234, tailscale2otel-tailnet/panel-235, tailscale2otel-tailnet/panel-236, tailscale2otel-tailnet/panel-237 |
| metric | tailscale.k8s.api.sensitive_reads | yes | reaches-panel | tailscale2otel-tailnet/panel-238, tailscale2otel-tailnet/panel-239, tailscale2otel-tailnet/panel-240, tailscale2otel-tailnet/panel-241 |
| metric | tailscale.k8s.schema_drift | yes | reaches-panel | tailscale2otel-tailnet/panel-257, tailscale2otel-tailnet/panel-258 |
| metric | tailscale.k8s.session.started | yes | reaches-panel | tailscale2otel-tailnet/panel-253, tailscale2otel-tailnet/panel-254, tailscale2otel-tailnet/panel-255, tailscale2otel-tailnet/panel-256 |
| metric | tailscale.key.allowed_tags | yes | reaches-panel | tailscale2otel-tailnet/panel-221, tailscale2otel-tailnet/panel-222 |
| metric | tailscale.key.expiry | yes | reaches-panel | tailscale2otel-tailnet/panel-214, tailscale2otel-tailnet/panel-215, tailscale2otel-tailnet/panel-300 |
| metric | tailscale.key.preauthorized | yes | reaches-panel | tailscale2otel-tailnet/panel-301 |
| metric | tailscale.key.scope_class | yes | reaches-panel | tailscale2otel-tailnet/panel-223 |
| metric | tailscale.key.scopes | yes | reaches-panel | tailscale2otel-tailnet/panel-298 |
| metric | tailscale.key.tag_scope | yes | reaches-panel | tailscale2otel-tailnet/panel-224 |
| metric | tailscale.keys.age | yes | reaches-panel | tailscale2otel-tailnet/panel-219 |
| metric | tailscale.keys.by_owner | yes | reaches-panel | tailscale2otel-tailnet/panel-220 |
| metric | tailscale.keys.count | yes | reaches-panel | tailscale2otel-tailnet/panel-297 |
| metric | tailscale.logstream.bytes_sent | yes | reaches-panel | tailscale2otel-health/panel-116 |
| metric | tailscale.logstream.configured | yes | reaches-panel | tailscale2otel-health/panel-114 |
| metric | tailscale.logstream.destination.configured | yes | reaches-panel | tailscale2otel-health/panel-113 |
| metric | tailscale.logstream.entries_sent | yes | reaches-panel | tailscale2otel-health/panel-117 |
| metric | tailscale.logstream.error | yes | reaches-panel | tailscale2otel-health/panel-115 |
| metric | tailscale.logstream.last_activity | yes | reaches-panel | tailscale2otel-health/panel-122 |
| metric | tailscale.logstream.max_body_requests | yes | reaches-panel | tailscale2otel-health/panel-121 |
| metric | tailscale.logstream.requests | yes | reaches-panel | tailscale2otel-health/panel-118, tailscale2otel-health/panel-119 |
| metric | tailscale.logstream.requests_failed | yes | reaches-panel | tailscale2otel-health/panel-119, tailscale2otel-health/panel-120 |
| metric | tailscale.logstream.spoofed_entries | yes | reaches-panel | tailscale2otel-health/panel-121 |
| metric | tailscale.network.data_quality | yes | reaches-panel | tailscale2otel-tailnet/panel-113 |
| metric | tailscale.network.dedup.conflicts | yes | reaches-panel | tailscale2otel-tailnet/panel-114 |
| metric | tailscale.network.field.observations | yes | reaches-panel | tailscale2otel-tailnet/panel-112 |
| metric | tailscale.network.flow.logs_dropped | yes | reaches-panel | tailscale2otel-health/panel-165 |
| metric | tailscale.network.flows | yes | reaches-panel | tailscale2otel-tailnet/panel-106, tailscale2otel-tailnet/panel-107, tailscale2otel-tailnet/panel-108, tailscale2otel-tailnet/panel-109, tailscale2otel-tailnet/panel-110, tailscale2otel-tailnet/panel-113, tailscale2otel-tailnet/panel-114, tailscale2otel-tailnet/panel-115, tailscale2otel-tailnet/panel-12 |
| metric | tailscale.network.io | yes | reaches-panel | tailscale2otel-tailnet/panel-104, tailscale2otel-tailnet/panel-11, tailscale2otel-tailnet/panel-132, tailscale2otel-tailnet/panel-134, tailscale2otel-tailnet/panel-135, tailscale2otel-tailnet/panel-136, tailscale2otel-tailnet/panel-137, tailscale2otel-tailnet/panel-139 |
| metric | tailscale.network.io.rollup | yes | reaches-panel | tailscale2otel-health/panel-164, tailscale2otel-tailnet/panel-104, tailscale2otel-tailnet/panel-11, tailscale2otel-tailnet/panel-120, tailscale2otel-tailnet/panel-121, tailscale2otel-tailnet/panel-122, tailscale2otel-tailnet/panel-123, tailscale2otel-tailnet/panel-124, tailscale2otel-tailnet/panel-125, tailscale2otel-tailnet/panel-126, tailscale2otel-tailnet/panel-127, tailscale2otel-tailnet/panel-128, tailscale2otel-tailnet/panel-129, tailscale2otel-tailnet/panel-138 |
| metric | tailscale.network.packets | yes | reaches-panel | tailscale2otel-tailnet/panel-105, tailscale2otel-tailnet/panel-133 |
| metric | tailscale.network.packets.rollup | yes | reaches-panel | tailscale2otel-tailnet/panel-105 |
| metric | tailscale.network.reporter.observations | yes | reaches-panel | tailscale2otel-tailnet/panel-111 |
| metric | tailscale.network.store.dropped | yes | reaches-panel | tailscale2otel-tailnet/panel-115 |
| metric | tailscale.network.unique.dst_peers | yes | reaches-panel | tailscale2otel-tailnet/panel-130 |
| metric | tailscale.network.unique.dst_ports | yes | reaches-panel | tailscale2otel-tailnet/panel-131 |
| metric | tailscale.node.derp.home_region | yes | reaches-panel | tailscale2otel-tailnet/panel-164 |
| metric | tailscale.node.health_messages | yes | reaches-panel | tailscale2otel-tailnet/panel-160 |
| metric | tailscale.node.io | yes | reaches-panel | tailscale2otel-tailnet/panel-161, tailscale2otel-tailnet/panel-163 |
| metric | tailscale.node.packets | yes | reaches-panel | tailscale2otel-tailnet/panel-162, tailscale2otel-tailnet/panel-167 |
| metric | tailscale.node.packets.dropped | yes | reaches-panel | tailscale2otel-tailnet/panel-165, tailscale2otel-tailnet/panel-166, tailscale2otel-tailnet/panel-167 |
| metric | tailscale.node.peer_relay.endpoints | yes | reaches-panel | tailscale2otel-tailnet/panel-171, tailscale2otel-tailnet/panel-172 |
| metric | tailscale.node.peer_relay.io | yes | reaches-panel | tailscale2otel-tailnet/panel-168, tailscale2otel-tailnet/panel-169 |
| metric | tailscale.node.peer_relay.packets | yes | reaches-panel | tailscale2otel-tailnet/panel-170 |
| metric | tailscale.node.service.io | yes | reaches-panel | tailscale2otel-tailnet/panel-173 |
| metric | tailscale.node.up | yes | reaches-panel | tailscale2otel-health/panel-26, tailscale2otel-health/panel-27, tailscale2otel-health/panel-30, tailscale2otel-tailnet/panel-141 |
| metric | tailscale.oauth_app.node_attributes | yes | reaches-panel | tailscale2otel-tailnet/panel-305 |
| metric | tailscale.oauth_app.redirect_uris | yes | reaches-panel | tailscale2otel-tailnet/panel-305 |
| metric | tailscale.oauth_app.scope_class | yes | reaches-panel | tailscale2otel-tailnet/panel-303 |
| metric | tailscale.oauth_app.scopes | yes | reaches-panel | tailscale2otel-tailnet/panel-305 |
| metric | tailscale.oauth_apps.age | yes | reaches-panel | tailscale2otel-tailnet/panel-304 |
| metric | tailscale.oauth_apps.count | yes | reaches-panel | tailscale2otel-tailnet/panel-302 |
| metric | tailscale.organization.tailnets.count | yes | reaches-panel | tailscale2otel-tailnet/panel-36 |
| metric | tailscale.pam.connector.connected | yes | reaches-panel | tailscale2otel-tailnet/panel-331 |
| metric | tailscale.pam.connector.info | yes | reaches-panel | tailscale2otel-tailnet/panel-332 |
| metric | tailscale.pam.connector.last_seen_age | yes | reaches-panel | tailscale2otel-tailnet/panel-331 |
| metric | tailscale.pam.connector.plugins | yes | reaches-panel | tailscale2otel-tailnet/panel-331 |
| metric | tailscale.pam.connector.sockets | yes | reaches-panel | tailscale2otel-tailnet/panel-331 |
| metric | tailscale.pam.connector.tokens | yes | reaches-panel | tailscale2otel-tailnet/panel-331 |
| metric | tailscale.pam.connectors | yes | reaches-panel | tailscale2otel-tailnet/panel-327 |
| metric | tailscale.pam.identities | yes | reaches-panel | tailscale2otel-tailnet/panel-330 |
| metric | tailscale.pam.org.plan.info | yes | reaches-panel | tailscale2otel-tailnet/panel-337 |
| metric | tailscale.pam.org.setting.enabled | yes | reaches-panel | tailscale2otel-tailnet/panel-336 |
| metric | tailscale.pam.policies | yes | reaches-panel | tailscale2otel-tailnet/panel-329 |
| metric | tailscale.pam.policy.setting.enabled | yes | reaches-panel | tailscale2otel-tailnet/panel-335 |
| metric | tailscale.pam.service.alive | yes | reaches-panel | tailscale2otel-tailnet/panel-333 |
| metric | tailscale.pam.service.setting.enabled | yes | reaches-panel | tailscale2otel-tailnet/panel-334 |
| metric | tailscale.pam.services | yes | reaches-panel | tailscale2otel-tailnet/panel-328 |
| metric | tailscale.pam.session.duration | yes | reaches-panel | tailscale2otel-tailnet/panel-342 |
| metric | tailscale.pam.session.events | yes | reaches-panel | tailscale2otel-tailnet/panel-343 |
| metric | tailscale.pam.sessions | yes | reaches-panel | tailscale2otel-tailnet/panel-339 |
| metric | tailscale.pam.sessions.active | yes | reaches-panel | tailscale2otel-tailnet/panel-340 |
| metric | tailscale.pam.sessions.killed | yes | reaches-panel | tailscale2otel-tailnet/panel-341 |
| metric | tailscale.pam.subscription.limit | yes | reaches-panel | tailscale2otel-tailnet/panel-338 |
| metric | tailscale.posture_integration.error | yes | reaches-panel | tailscale2otel-tailnet/panel-324 |
| metric | tailscale.posture_integration.last_sync | yes | reaches-panel | tailscale2otel-tailnet/panel-199, tailscale2otel-tailnet/panel-201, tailscale2otel-tailnet/panel-324 |
| metric | tailscale.posture_integration.matched | yes | reaches-panel | tailscale2otel-tailnet/panel-198, tailscale2otel-tailnet/panel-200, tailscale2otel-tailnet/panel-201 |
| metric | tailscale.posture_integration.possible_matched | yes | reaches-panel | tailscale2otel-tailnet/panel-200, tailscale2otel-tailnet/panel-201 |
| metric | tailscale.posture_integration.provider_hosts | yes | reaches-panel | tailscale2otel-tailnet/panel-201 |
| metric | tailscale.posture_integrations.count | yes | reaches-panel | tailscale2otel-tailnet/panel-197 |
| metric | tailscale.rdns.cache.capacity | yes | reaches-panel | tailscale2otel-health/panel-60 |
| metric | tailscale.rdns.cache.entries | yes | reaches-panel | tailscale2otel-health/panel-60 |
| metric | tailscale.rdns.cache.evictions | yes | reaches-panel | tailscale2otel-health/panel-62 |
| metric | tailscale.rdns.cache.lookups | yes | reaches-panel | tailscale2otel-health/panel-61, tailscale2otel-health/panel-63 |
| metric | tailscale.rdns.cache.overflows | yes | reaches-panel | tailscale2otel-health/panel-63 |
| metric | tailscale.rdns.queries | yes | reaches-panel | tailscale2otel-health/panel-62 |
| metric | tailscale.rdns.refreshes | yes | reaches-panel | tailscale2otel-health/panel-62 |
| metric | tailscale.service.host.info | yes | reaches-panel | tailscale2otel-tailnet/panel-312, tailscale2otel-tailnet/panel-313 |
| metric | tailscale.service.hosts | yes | reaches-panel | tailscale2otel-tailnet/panel-308, tailscale2otel-tailnet/panel-311 |
| metric | tailscale.service.ports | yes | reaches-panel | tailscale2otel-tailnet/panel-310, tailscale2otel-tailnet/panel-311 |
| metric | tailscale.services.by_tag | yes | reaches-panel | tailscale2otel-tailnet/panel-309 |
| metric | tailscale.services.count | yes | reaches-panel | tailscale2otel-tailnet/panel-307 |
| metric | tailscale.setting.devices_key_duration | yes | reaches-panel | tailscale2otel-tailnet/panel-284 |
| metric | tailscale.setting.enabled | yes | reaches-panel | tailscale2otel-tailnet/panel-17, tailscale2otel-tailnet/panel-283 |
| metric | tailscale.setting.route_selection | yes | reaches-panel | tailscale2otel-tailnet/panel-287 |
| metric | tailscale.setting.users_external_tailnets_role | yes | reaches-panel | tailscale2otel-tailnet/panel-286 |
| metric | tailscale.stream.decode_errors | yes | reaches-panel | tailscale2otel-health/panel-81 |
| metric | tailscale.stream.inflight | yes | reaches-panel | tailscale2otel-health/panel-83 |
| metric | tailscale.stream.records | yes | reaches-panel | tailscale2otel-health/panel-80, tailscale2otel-health/panel-85 |
| metric | tailscale.stream.rejected | yes | reaches-panel | tailscale2otel-health/panel-81, tailscale2otel-health/panel-84, tailscale2otel-health/panel-88, tailscale2otel-health/panel-99 |
| metric | tailscale.stream.request.duration | yes | reaches-panel | tailscale2otel-health/panel-83 |
| metric | tailscale.stream.skipped | yes | reaches-panel | tailscale2otel-health/panel-85 |
| metric | tailscale.subnet_routes.advertised | yes | reaches-panel | tailscale2otel-tailnet/panel-98 |
| metric | tailscale.subnet_routes.enabled | yes | reaches-panel | tailscale2otel-tailnet/panel-97 |
| metric | tailscale.subnet_routes.routers | yes | reaches-panel | tailscale2otel-tailnet/panel-101 |
| metric | tailscale.subnet_routes.unapproved | yes | reaches-panel | tailscale2otel-tailnet/panel-27, tailscale2otel-tailnet/panel-96 |
| metric | tailscale.tailnet_lock.errors | yes | reaches-panel | tailscale2otel-tailnet/panel-195 |
| metric | tailscale.user.connected | yes | reaches-panel | tailscale2otel-tailnet/panel-296, tailscale2otel-tailnet/panel-35 |
| metric | tailscale.user.devices | yes | reaches-panel | tailscale2otel-tailnet/panel-296 |
| metric | tailscale.user.last_seen | yes | reaches-panel | tailscale2otel-tailnet/panel-291, tailscale2otel-tailnet/panel-296 |
| metric | tailscale.user_invites.count | yes | reaches-panel | tailscale2otel-tailnet/panel-292 |
| metric | tailscale.user_invites.pending_age | yes | reaches-panel | tailscale2otel-tailnet/panel-226 |
| metric | tailscale.users.age | yes | reaches-panel | tailscale2otel-tailnet/panel-225 |
| metric | tailscale.users.count | yes | reaches-panel | tailscale2otel-tailnet/panel-293, tailscale2otel-tailnet/panel-294, tailscale2otel-tailnet/panel-295, tailscale2otel-tailnet/panel-3 |
| metric | tailscale.webhook.duplicates | yes | reaches-panel | tailscale2otel-health/panel-87 |
| metric | tailscale.webhook.events | yes | reaches-panel | tailscale2otel-health/panel-82, tailscale2otel-health/panel-87 |
| metric | tailscale.webhook.inflight | yes | reaches-panel | tailscale2otel-health/panel-83 |
| metric | tailscale.webhook.rejected | yes | reaches-panel | tailscale2otel-health/panel-82, tailscale2otel-health/panel-84, tailscale2otel-health/panel-88, tailscale2otel-health/panel-99 |
| metric | tailscale.webhook.request.duration | yes | reaches-panel | tailscale2otel-health/panel-86 |
| metric | tailscale.webhook.schema_drift | yes | reaches-panel | tailscale2otel-health/panel-87 |
| metric | tailscale.webhook_endpoint.age | yes | reaches-panel | tailscale2otel-tailnet/panel-318 |
| metric | tailscale.webhook_endpoint.subscriptions | yes | reaches-panel | tailscale2otel-tailnet/panel-317 |
| metric | tailscale.webhook_endpoints.count | yes | reaches-panel | tailscale2otel-tailnet/panel-288 |
| metric | tailscale.webhook_endpoints.desired_unrecognized | yes | reaches-panel | tailscale2otel-tailnet/panel-315 |
| metric | tailscale.webhook_endpoints.event_desired_covered | yes | reaches-panel | tailscale2otel-tailnet/panel-314 |
| metric | tailscale.webhook_endpoints.event_subscriptions | yes | reaches-panel | tailscale2otel-tailnet/panel-316 |
| metric | tailscale2otel.admin.auth.rejected | yes | reaches-panel | tailscale2otel-health/panel-21 |
| metric | tailscale2otel.annotation.degraded | yes | reaches-panel | tailscale2otel-health/panel-106 |
| metric | tailscale2otel.annotation.dropped | yes | reaches-panel | tailscale2otel-health/panel-105 |
| metric | tailscale2otel.annotation.published | yes | reaches-panel | tailscale2otel-health/panel-104 |
| metric | tailscale2otel.api.availability | yes | reaches-panel | tailscale2otel-health/panel-51, tailscale2otel-tailnet/panel-1, tailscale2otel-tailnet/panel-3, tailscale2otel-tailnet/panel-4 |
| metric | tailscale2otel.api.duration | yes | reaches-panel | tailscale2otel-health/panel-42, tailscale2otel-health/panel-46 |
| metric | tailscale2otel.api.last_probe | yes | reaches-panel | tailscale2otel-health/panel-48 |
| metric | tailscale2otel.api.rate_limit.utilization | yes | reaches-panel | tailscale2otel-health/panel-44 |
| metric | tailscale2otel.api.rate_limit.wait | yes | reaches-panel | tailscale2otel-health/panel-45, tailscale2otel-health/panel-46, tailscale2otel-health/panel-47 |
| metric | tailscale2otel.api.requests | yes | reaches-panel | tailscale2otel-health/panel-22, tailscale2otel-health/panel-40, tailscale2otel-health/panel-43, tailscale2otel-health/panel-47, tailscale2otel-health/panel-64, tailscale2otel-health/panel-9, tailscale2otel-tailnet/panel-23 |
| metric | tailscale2otel.api.retries | yes | reaches-panel | tailscale2otel-health/panel-22, tailscale2otel-health/panel-41, tailscale2otel-health/panel-43 |
| metric | tailscale2otel.build_info | yes | reaches-panel | tailscale2otel-health/panel-5 |
| metric | tailscale2otel.capability.scope_satisfied | yes | reaches-panel | tailscale2otel-health/panel-50 |
| metric | tailscale2otel.capability.status | yes | reaches-panel | tailscale2otel-health/panel-49, tailscale2otel-health/panel-52 |
| metric | tailscale2otel.checkpoint.disk.size | yes | reaches-panel | tailscale2otel-health/panel-15 |
| metric | tailscale2otel.checkpoint.persist.age | yes | reaches-panel | tailscale2otel-health/panel-17 |
| metric | tailscale2otel.checkpoint.persist.errors | yes | reaches-panel | tailscale2otel-health/panel-19 |
| metric | tailscale2otel.component.errors | yes | reaches-panel | tailscale2otel-health/panel-20, tailscale2otel-tailnet/panel-20 |
| metric | tailscale2otel.config.valid | yes | reaches-panel | tailscale2otel-health/panel-12 |
| metric | tailscale2otel.config.warnings | yes | reaches-panel | tailscale2otel-health/panel-13 |
| metric | tailscale2otel.coordination.handovers | yes | reaches-panel | tailscale2otel-health/panel-23 |
| metric | tailscale2otel.coordination.leader | yes | reaches-panel | tailscale2otel-health/panel-6 |
| metric | tailscale2otel.dedup.evictions | yes | reaches-panel | tailscale2otel-health/panel-167, tailscale2otel-health/panel-90 |
| metric | tailscale2otel.dedup.hits | yes | reaches-panel | tailscale2otel-health/panel-90 |
| metric | tailscale2otel.dedup.overlap_horizon | yes | reaches-panel | tailscale2otel-health/panel-92 |
| metric | tailscale2otel.dedup.size | yes | reaches-panel | tailscale2otel-health/panel-166, tailscale2otel-health/panel-91 |
| metric | tailscale2otel.dedup.youngest_eviction_age | yes | reaches-panel | tailscale2otel-health/panel-92 |
| metric | tailscale2otel.enrich.cache_age | yes | reaches-panel | tailscale2otel-health/panel-58 |
| metric | tailscale2otel.enrich.cache_size | yes | reaches-panel | tailscale2otel-health/panel-59 |
| metric | tailscale2otel.export.datapoints | yes | reaches-panel | tailscale2otel-health/panel-175 |
| metric | tailscale2otel.export.diagnostics.suppressed | yes | reaches-panel | tailscale2otel-health/panel-111 |
| metric | tailscale2otel.export.duration | yes | reaches-panel | tailscale2otel-health/panel-10, tailscale2otel-health/panel-107, tailscale2otel-health/panel-108, tailscale2otel-health/panel-11 |
| metric | tailscale2otel.export.failures | yes | reaches-panel | tailscale2otel-health/panel-109, tailscale2otel-tailnet/panel-10 |
| metric | tailscale2otel.export.log_records | yes | reaches-panel | tailscale2otel-health/panel-175 |
| metric | tailscale2otel.export.spans | yes | reaches-panel | tailscale2otel-health/panel-110 |
| metric | tailscale2otel.flow_store.journal.size | yes | reaches-panel | tailscale2otel-health/panel-155 |
| metric | tailscale2otel.flow_store.last_checkpoint_timestamp | yes | reaches-panel | tailscale2otel-health/panel-156 |
| metric | tailscale2otel.ingest.capture.delay | yes | reaches-panel | tailscale2otel-health/panel-89 |
| metric | tailscale2otel.ingest.event.age | yes | reaches-panel | tailscale2otel-health/panel-89 |
| metric | tailscale2otel.ingest.last_event_timestamp | yes | reaches-panel | tailscale2otel-health/panel-89 |
| metric | tailscale2otel.ingest.records | yes | reaches-panel | tailscale2otel-health/panel-175, tailscale2otel-health/panel-88 |
| metric | tailscale2otel.ingest.size | yes | reaches-panel | tailscale2otel-health/panel-88 |
| metric | tailscale2otel.ingest.timestamp_skew | yes | reaches-panel | tailscale2otel-health/panel-89 |
| metric | tailscale2otel.ingress_wal.completion.markers | yes | reaches-panel | tailscale2otel-health/panel-77 |
| metric | tailscale2otel.ingress_wal.expired.entries | no | reaches-panel | tailscale2otel-health/panel-74 |
| metric | tailscale2otel.ingress_wal.orphan.size | yes | reaches-panel | tailscale2otel-health/panel-75 |
| metric | tailscale2otel.ingress_wal.orphan.stages | yes | reaches-panel | tailscale2otel-health/panel-77 |
| metric | tailscale2otel.ingress_wal.pending.entries | yes | reaches-panel | tailscale2otel-health/panel-77 |
| metric | tailscale2otel.ingress_wal.pending.entries.fill | yes | reaches-panel | tailscale2otel-health/panel-77 |
| metric | tailscale2otel.ingress_wal.pending.size | yes | reaches-panel | tailscale2otel-health/panel-75 |
| metric | tailscale2otel.ingress_wal.pending.size.fill | yes | reaches-panel | tailscale2otel-health/panel-76 |
| metric | tailscale2otel.ingress_wal.permanent.drops | yes | reaches-panel | tailscale2otel-health/panel-74 |
| metric | tailscale2otel.log.catchup.skipped | no | reaches-panel | tailscale2otel-health/panel-24, tailscale2otel-health/panel-25 |
| metric | tailscale2otel.log.record.truncated | yes | reaches-panel | tailscale2otel-health/panel-95 |
| metric | tailscale2otel.log.truncated.bytes | yes | reaches-panel | tailscale2otel-health/panel-95 |
| metric | tailscale2otel.metrics.auth.rejected | yes | reaches-panel | tailscale2otel-health/panel-57 |
| metric | tailscale2otel.metrics.scrape.duration | yes | reaches-panel | tailscale2otel-health/panel-53 |
| metric | tailscale2otel.metrics.scrape.gather_errors | yes | reaches-panel | tailscale2otel-health/panel-56 |
| metric | tailscale2otel.metrics.scrape.in_flight | yes | reaches-panel | tailscale2otel-health/panel-55 |
| metric | tailscale2otel.metrics.scrape.requests | yes | reaches-panel | tailscale2otel-health/panel-54 |
| metric | tailscale2otel.nodemetrics.discovery.success | yes | reaches-panel | tailscale2otel-health/panel-28, tailscale2otel-tailnet/panel-142 |
| metric | tailscale2otel.nodemetrics.discovery.targets | yes | reaches-panel | tailscale2otel-health/panel-29 |
| metric | tailscale2otel.nodemetrics.metric_names.dropped | yes | reaches-panel | tailscale2otel-health/panel-176, tailscale2otel-health/panel-177 |
| metric | tailscale2otel.nodemetrics.scrape.failures | yes | reaches-panel | tailscale2otel-health/panel-31 |
| metric | tailscale2otel.objectstore.backlog | yes | reaches-panel | tailscale2otel-health/panel-68 |
| metric | tailscale2otel.objectstore.bytes | yes | reaches-panel | tailscale2otel-health/panel-70 |
| metric | tailscale2otel.objectstore.cursor.age | yes | reaches-panel | tailscale2otel-health/panel-65 |
| metric | tailscale2otel.objectstore.decompressed.bytes | yes | reaches-panel | tailscale2otel-health/panel-70 |
| metric | tailscale2otel.objectstore.discovered.newest.age | yes | reaches-panel | tailscale2otel-health/panel-65 |
| metric | tailscale2otel.objectstore.expansion.limit_failures | yes | reaches-panel | tailscale2otel-health/panel-71 |
| metric | tailscale2otel.objectstore.gap.healthy | yes | reaches-panel | tailscale2otel-health/panel-66 |
| metric | tailscale2otel.objectstore.gap.oldest.age | yes | reaches-panel | tailscale2otel-health/panel-69 |
| metric | tailscale2otel.objectstore.gaps | yes | reaches-panel | tailscale2otel-health/panel-69 |
| metric | tailscale2otel.objectstore.objects | yes | reaches-panel | tailscale2otel-health/panel-70 |
| metric | tailscale2otel.objectstore.pending.oldest.age | yes | reaches-panel | tailscale2otel-health/panel-68 |
| metric | tailscale2otel.objectstore.records | yes | reaches-panel | tailscale2otel-health/panel-70 |
| metric | tailscale2otel.objectstore.request.duration | yes | reaches-panel | tailscale2otel-health/panel-73 |
| metric | tailscale2otel.objectstore.requests | yes | reaches-panel | tailscale2otel-health/panel-73 |
| metric | tailscale2otel.objectstore.retries | yes | reaches-panel | tailscale2otel-health/panel-71 |
| metric | tailscale2otel.objectstore.scan.truncated | yes | reaches-panel | tailscale2otel-health/panel-67 |
| metric | tailscale2otel.objectstore.skipped | yes | reaches-panel | tailscale2otel-health/panel-71, tailscale2otel-health/panel-72, tailscale2otel-health/panel-88 |
| metric | tailscale2otel.pii_filter.category | yes | reaches-panel | tailscale2otel-health/panel-112 |
| metric | tailscale2otel.processor.dropped | yes | reaches-panel | tailscale2otel-health/panel-94 |
| metric | tailscale2otel.processor.queue.capacity | yes | reaches-panel | tailscale2otel-health/panel-93 |
| metric | tailscale2otel.processor.queue.size | yes | reaches-panel | tailscale2otel-health/panel-93 |
| metric | tailscale2otel.profiling.upload.attempts | yes | reaches-panel | tailscale2otel-health/panel-143, tailscale2otel-health/panel-144 |
| metric | tailscale2otel.profiling.upload.consecutive_failures | yes | reaches-panel | tailscale2otel-health/panel-145 |
| metric | tailscale2otel.profiling.upload.duration | yes | reaches-panel | tailscale2otel-health/panel-142 |
| metric | tailscale2otel.profiling.upload.failures | yes | reaches-panel | tailscale2otel-health/panel-144 |
| metric | tailscale2otel.profiling.upload.last_success | yes | reaches-panel | tailscale2otel-health/panel-146 |
| metric | tailscale2otel.receiver.misconfigured | yes | reaches-panel | tailscale2otel-health/panel-103 |
| metric | tailscale2otel.runtime.gc.count | yes | reaches-panel | tailscale2otel-health/panel-136 |
| metric | tailscale2otel.runtime.gc.cpu_fraction | yes | reaches-panel | tailscale2otel-health/panel-138 |
| metric | tailscale2otel.runtime.gc.next_target | yes | reaches-panel | tailscale2otel-health/panel-139 |
| metric | tailscale2otel.runtime.gc.pause_time | yes | reaches-panel | tailscale2otel-health/panel-137 |
| metric | tailscale2otel.runtime.gomaxprocs | yes | reaches-panel | tailscale2otel-health/panel-130, tailscale2otel-health/panel-4 |
| metric | tailscale2otel.runtime.goroutines | yes | reaches-panel | tailscale2otel-health/panel-129, tailscale2otel-health/panel-135, tailscale2otel-health/panel-3 |
| metric | tailscale2otel.runtime.memory.alloc | yes | reaches-panel | tailscale2otel-health/panel-140 |
| metric | tailscale2otel.runtime.memory.heap_alloc | yes | reaches-panel | tailscale2otel-health/panel-133, tailscale2otel-health/panel-139 |
| metric | tailscale2otel.runtime.memory.heap_inuse | yes | reaches-panel | tailscale2otel-health/panel-134 |
| metric | tailscale2otel.runtime.memory.heap_objects | yes | reaches-panel | tailscale2otel-health/panel-141 |
| metric | tailscale2otel.runtime.memory.heap_sys | yes | reaches-panel | tailscale2otel-health/panel-134 |
| metric | tailscale2otel.runtime.memory.limit | no | reaches-panel | tailscale2otel-health/panel-133 |
| metric | tailscale2otel.runtime.memory.stack_inuse | yes | reaches-panel | tailscale2otel-health/panel-134, tailscale2otel-health/panel-135 |
| metric | tailscale2otel.runtime.memory.sys | yes | reaches-panel | tailscale2otel-health/panel-134 |
| metric | tailscale2otel.scrape.budget | yes | reaches-panel | tailscale2otel-health/panel-39 |
| metric | tailscale2otel.scrape.duration | yes | reaches-panel | tailscale2otel-health/panel-33 |
| metric | tailscale2otel.scrape.duration.histogram | yes | reaches-panel | tailscale2otel-health/panel-32, tailscale2otel-health/panel-35 |
| metric | tailscale2otel.scrape.errors | yes | reaches-panel | tailscale2otel-health/panel-18, tailscale2otel-health/panel-37, tailscale2otel-health/panel-99, tailscale2otel-tailnet/panel-18, tailscale2otel-tailnet/panel-9 |
| metric | tailscale2otel.scrape.last_timestamp | yes | reaches-panel | tailscale2otel-health/panel-36, tailscale2otel-health/panel-8, tailscale2otel-tailnet/panel-19 |
| metric | tailscale2otel.scrape.staleness | yes | reaches-panel | tailscale2otel-health/panel-38, tailscale2otel-tailnet/panel-23 |
| metric | tailscale2otel.scrape.success | yes | reaches-panel | tailscale2otel-health/panel-2, tailscale2otel-health/panel-34, tailscale2otel-health/panel-7, tailscale2otel-health/panel-96, tailscale2otel-tailnet/panel-8 |
| metric | tailscale2otel.series.active | yes | reaches-panel | tailscale2otel-health/panel-159, tailscale2otel-health/panel-160, tailscale2otel-health/panel-161, tailscale2otel-health/panel-162, tailscale2otel-health/panel-163, tailscale2otel-health/panel-168, tailscale2otel-health/panel-170, tailscale2otel-health/panel-174 |
| metric | tailscale2otel.series.by_group | yes | reaches-panel | tailscale2otel-health/panel-173, tailscale2otel-health/panel-176 |
| metric | tailscale2otel.series.limit | yes | reaches-panel | tailscale2otel-health/panel-159, tailscale2otel-health/panel-162, tailscale2otel-health/panel-168, tailscale2otel-health/panel-170 |
| metric | tailscale2otel.series.overflowing | yes | reaches-panel | tailscale2otel-health/panel-159, tailscale2otel-health/panel-162, tailscale2otel-health/panel-168, tailscale2otel-health/panel-169, tailscale2otel-health/panel-170, tailscale2otel-health/panel-172 |
| metric | tailscale2otel.subrequest.attempts | yes | reaches-panel | tailscale2otel-health/panel-78 |
| metric | tailscale2otel.subrequest.coverage | yes | reaches-panel | tailscale2otel-health/panel-79 |
| metric | tailscale2otel.subrequest.failures | yes | reaches-panel | tailscale2otel-health/panel-78 |
| metric | tailscale2otel.tls.cert.not_after | yes | reaches-panel | tailscale2otel-health/panel-151 |
| metric | tailscale2otel.tls.cert.not_before | yes | reaches-panel | tailscale2otel-health/panel-153 |
| metric | tailscale2otel.tls.cert.reload.failures | yes | reaches-panel | tailscale2otel-health/panel-152 |
| metric | tailscale2otel.tls.cert.reload.last_success | yes | reaches-panel | tailscale2otel-health/panel-154 |
| metric | tailscale2otel.up | yes | reaches-panel | tailscale2otel-health/panel-1, tailscale2otel-tailnet/panel-7 |
| metric | tailscale2otel.update_available | yes | reaches-panel | tailscale2otel-tailnet/panel-50 |
Loop33 row actionability
All170 rows assessed. No whole-row deletion/merge justified; optional empty features remain distinct from redundant questions. Per-panel defects remain filed follow-ups.
| Dashboard | Row identity | Row | Action |
|---|---|---|---|
| tailscale2otel-health | tailscale2otel-health/layout/tabs/0/layout/rows/0 | Golden signals | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/0/layout/rows/1 | Collecting | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/0/layout/rows/2 | Delivering | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/0/layout/rows/3 | Application health | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/0/layout/rows/4 | Degradation summary | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/0/layout/rows/5 | API throttling | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/0/layout/rows/6 | Coordination churn | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/0/layout/rows/7 | Log acceptance horizon | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/0 | Scraper health | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/1 | Scrape performance by collector | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/2 | Scrape freshness | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/3 | API requests | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/4 | API retries | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/5 | API latency | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/6 | API rate-limiter wait & probe freshness | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/7 | Capability & scope preflight | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/8 | Prometheus pull endpoint | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/9 | Enrichment cache | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/10 | rDNS resolver | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/0/layout/rows/11 | Per-tailnet API errors | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/0 | Object-store ingestion status | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/1 | Object-store ingestion throughput & faults | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/2 | Ingress WAL | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/3 | Per-entity subrequest fan-out | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/4 | Stream ingestion | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/5 | Webhook ingestion | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/6 | Receiver health | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/7 | Receiver configuration | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/8 | Receiver loss detail | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/9 | Ingestion volume | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/10 | Accepted-data freshness | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/11 | Cross-source dedup | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/12 | Processor queue | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/13 | Log truncation | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/14 | Audit pipeline state | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/15 | Audit pipeline latency | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/1/layout/rows/16 | Audit schema drift | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/2/layout/rows/0 | Annotations | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/2/layout/rows/1 | OTLP export health | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/2/layout/rows/2 | PII filter status | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/2/layout/rows/3 | SIEM log shipping | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/2/layout/rows/4 | Traces & spans | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/1/layout/tabs/2/layout/rows/5 | Traces & spans (metrics) | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/0/layout/rows/0 | Go runtime | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/0/layout/rows/1 | GC & memory | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/0/layout/rows/2 | Profiling upload | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/0/layout/rows/3 | Profiles | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/0/layout/rows/4 | TLS certificate | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/0/layout/rows/5 | Flow-store persistence | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/0/layout/rows/6 | Config advisories | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/1/layout/rows/0 | Cardinality cap & overflow | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/1/layout/rows/1 | Overflow diagnostics — self-report vs backend labels | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/1/layout/rows/2 | Active series by group | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/1/layout/rows/3 | Series budget | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/1/layout/rows/4 | Ingest vs export cost | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/1/layout/rows/5 | Node-metrics name budget | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/1/layout/rows/6 | Flow cardinality drivers | retain |
| tailscale2otel-health | tailscale2otel-health/layout/tabs/2/layout/tabs/1/layout/rows/7 | Cross-source dedup | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/0/layout/rows/0 | Tailnet health | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/0/layout/rows/1 | Exporter health | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/0/layout/rows/2 | Activity | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/0/layout/rows/3 | Audit & event rates | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/0/layout/rows/4 | Capabilities | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/0/layout/rows/5 | Exporter degradation detail | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/0/layout/rows/6 | MSP / multi-tailnet summary | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/0/layout/rows/7 | Security scorecard | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/0/layout/rows/0 | Inventory | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/0/layout/rows/1 | Authorization & sharing | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/0/layout/rows/2 | Device change log | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/0/layout/rows/3 | Trends | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/0/layout/rows/4 | Device online state by node | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/0/layout/rows/5 | Fleet hygiene | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/0/layout/rows/6 | Device health | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/1/layout/rows/0 | Server posture assertion changes | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/1/layout/rows/1 | Server-evaluated posture failures | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/1/layout/rows/2 | Server-evaluated device verdicts | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/1/layout/rows/3 | Device security flags | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/1/layout/rows/4 | Key-expiry distribution | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/1/layout/rows/5 | Device posture | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/2/layout/rows/0 | Connectivity | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/2/layout/rows/1 | Connectivity detail (per device) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/2/layout/rows/2 | Exit nodes | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/2/layout/rows/3 | Exit-node inventory | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/2/layout/rows/4 | Subnet routes | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/1/layout/tabs/2/layout/rows/5 | Connectivity / DERP | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/0 | Flow summary | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/1 | Current flow composition | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/2 | Flow integrity | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/3 | Flow ingestion hygiene | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/4 | Exit-node I/O | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/5 | Observed bytes (flow logs) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/6 | Throughput & talkers — ROLLUP (bounded top-N) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/7 | Path & DERP context — ROLLUP | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/8 | Top talkers — ROLLUP | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/9 | Traffic topology - ROLLUP (install netsage-sankey-panel) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/10 | Peer & port topology — ROLLUP | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/11 | Throughput & talkers — RAW (full detail) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/12 | Top talkers — RAW | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/13 | Traffic topology - RAW (install netsage-sankey-panel) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/14 | Top node-pair talkers (flow logs) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/0/layout/rows/15 | Flow log stream | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/1/layout/rows/0 | Scraper health | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/1/layout/rows/1 | Traffic (tailscaled) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/1/layout/rows/2 | Packet drops (raw tailscaled) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/1/layout/rows/3 | Connection paths (DERP vs direct) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/1/layout/rows/4 | Client health (curated) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/1/layout/rows/5 | Service throughput (curated) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/1/layout/rows/6 | Packet drops & peer relay (curated) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/1/layout/rows/7 | DERP regions (tailnet rollup) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/2/layout/tabs/1/layout/rows/8 | Routing & health | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/0/layout/rows/0 | Audit changes | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/0/layout/rows/1 | Configuration audit | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/0/layout/rows/2 | Configuration audit — actors & correlation | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/0/layout/rows/3 | Log explorer | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/1/layout/rows/0 | ACL risk indicators | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/1/layout/rows/1 | Tailnet lock | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/2/layout/rows/0 | Posture integrations (MDM/EDR sync) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/2/layout/rows/1 | MDM device posture | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/2/layout/rows/2 | Posture attribute risk — per device | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/2/layout/rows/3 | Security posture | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/2/layout/rows/4 | Device posture log | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/3/layout/rows/0 | Key & access expiry risk | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/3/layout/rows/1 | Device share invites | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/3/layout/rows/2 | Expiring keys & credentials | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/3/layout/rows/3 | Key & user-invite lifecycle | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/3/layout/rows/4 | Key inventory & age | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/3/layout/rows/5 | Credential scope & blast radius | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/3/layout/rows/6 | Identity & invite hygiene | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/0 | Kubernetes API request volume | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/1 | Kubernetes request paths | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/2 | Sensitive resource reads | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/3 | Sensitive resource reads — top readers | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/4 | Exec / attach / portforward sessions | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/5 | Exec / attach / portforward sessions — top users | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/6 | Mutating requests | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/7 | Mutating requests — top users | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/8 | RBAC / permission probes | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/9 | RBAC / permission probes — top users | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/10 | Terminal sessions started | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/11 | Terminal sessions — top users | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/12 | Schema drift (feed health) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/13 | Kubernetes audit log detail | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/14 | Kubernetes audit investigations | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/3/layout/tabs/4/layout/rows/15 | Kubernetes audit investigations — exec detail | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/0/layout/rows/0 | Access control (ACL) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/0/layout/rows/1 | ACL policy validation | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/0/layout/rows/2 | Policy history (explicit raw-body opt-in) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/1/layout/rows/0 | DNS | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/1/layout/rows/1 | Settings & features | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/1/layout/rows/2 | Configuration history (explicit snapshot opt-in) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/2/layout/rows/0 | Users | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/2/layout/rows/1 | Per-user detail | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/2/layout/rows/2 | API keys & credential scopes | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/2/layout/rows/3 | Key expiry detail | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/2/layout/rows/4 | OAuth applications | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/3/layout/rows/0 | Services / VIP | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/3/layout/rows/1 | VIP service detail | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/3/layout/rows/2 | Backing host identity | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/3/layout/rows/3 | VIP service topology | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/3/layout/rows/4 | Webhook endpoint inventory | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/3/layout/rows/5 | GeoIP enrichment | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/3/layout/rows/6 | Device-posture integrations | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/3/layout/rows/7 | Integration configuration history (explicit snapshot opt-in) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/4/layout/rows/0 | PAM inventory | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/4/layout/rows/1 | Connector health | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/4/layout/rows/2 | Configuration shape | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/4/layout/rows/3 | Organization and limits | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/4/layout/rows/4 | Session telemetry | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/4/layout/rows/5 | Session history (explicit log opt-in) | retain |
| tailscale2otel-tailnet | tailscale2otel-tailnet/layout/tabs/4/layout/tabs/4/layout/rows/6 | Configuration history (explicit snapshot opt-in) | retain |
Follow-up mapping after repair1
Task: TSO-0172 (comprehensive live dashboard audit). All 25 root-filed dashboard follow-ups remain outside admitted source work. Updates available table 58 is withdrawn from TSO-0212 (keep table measurements visible): membership plus Host/OS/version is the correct display and numeric one-hot Value is intentionally hidden.
| Follow-up | Panel references |
|---|---|
| TSO-0211 (Keep dense entity and category labels readable in dashboard panels) | tailscale2otel-tailnet/panel-130, tailscale2otel-tailnet/panel-131, tailscale2otel-tailnet/panel-202, tailscale2otel-tailnet/panel-267, tailscale2otel-tailnet/panel-287, tailscale2otel-tailnet/panel-309, tailscale2otel-tailnet/panel-5, tailscale2otel-tailnet/panel-53, tailscale2otel-tailnet/panel-63, tailscale2otel-tailnet/panel-93, tailscale2otel-tailnet/panel-99 |
| TSO-0212 (Keep table measurements visible ahead of metadata) | tailscale2otel-health/panel-112, tailscale2otel-health/panel-122, tailscale2otel-health/panel-30, tailscale2otel-health/panel-50, tailscale2otel-health/panel-8, tailscale2otel-tailnet/panel-102, tailscale2otel-tailnet/panel-148, tailscale2otel-tailnet/panel-149, tailscale2otel-tailnet/panel-150, tailscale2otel-tailnet/panel-151, tailscale2otel-tailnet/panel-152, tailscale2otel-tailnet/panel-164, tailscale2otel-tailnet/panel-17, tailscale2otel-tailnet/panel-222, tailscale2otel-tailnet/panel-224, tailscale2otel-tailnet/panel-283, tailscale2otel-tailnet/panel-300, tailscale2otel-tailnet/panel-312, tailscale2otel-tailnet/panel-333, tailscale2otel-tailnet/panel-334, tailscale2otel-tailnet/panel-335, tailscale2otel-tailnet/panel-336, tailscale2otel-tailnet/panel-59, tailscale2otel-tailnet/panel-60, tailscale2otel-tailnet/panel-75 |
| TSO-0213 (Distinguish absent telemetry from healthy states in generated panels) | tailscale2otel-health/panel-15, tailscale2otel-health/panel-158, tailscale2otel-health/panel-47, tailscale2otel-health/panel-56, tailscale2otel-health/panel-65, tailscale2otel-health/panel-66, tailscale2otel-health/panel-67, tailscale2otel-health/panel-72, tailscale2otel-health/panel-96, tailscale2otel-tailnet/panel-29, tailscale2otel-tailnet/panel-291, tailscale2otel-tailnet/panel-315, tailscale2otel-tailnet/panel-340, tailscale2otel-tailnet/panel-36, tailscale2otel-tailnet/panel-61, tailscale2otel-tailnet/panel-68, tailscale2otel-tailnet/panel-69, tailscale2otel-tailnet/panel-79 |
| TSO-0214 (Keep the organization-tailnet card legible when data is absent) | tailscale2otel-tailnet/panel-36, tailscale2otel-tailnet/panel-61 |
| TSO-0215 (Keep metadata free of numeric and duration formatting) | tailscale2otel-health/panel-125, tailscale2otel-health/panel-127, tailscale2otel-health/panel-170, tailscale2otel-health/panel-35, tailscale2otel-health/panel-46, tailscale2otel-tailnet/panel-59, tailscale2otel-tailnet/panel-60 |
| TSO-0216 (Restore meaningful category names in distribution charts) | tailscale2otel-health/panel-126, tailscale2otel-health/panel-60, tailscale2otel-tailnet/panel-109, tailscale2otel-tailnet/panel-110, tailscale2otel-tailnet/panel-113, tailscale2otel-tailnet/panel-114, tailscale2otel-tailnet/panel-115, tailscale2otel-tailnet/panel-192, tailscale2otel-tailnet/panel-198, tailscale2otel-tailnet/panel-203, tailscale2otel-tailnet/panel-268, tailscale2otel-tailnet/panel-299 |
| TSO-0217 (Use a comparable scale and explicit measures for observed flow bytes) | tailscale2otel-tailnet/panel-118 |
| TSO-0218 (Join related measurements into coherent per-entity table rows) | tailscale2otel-tailnet/panel-100, tailscale2otel-tailnet/panel-201, tailscale2otel-tailnet/panel-296, tailscale2otel-tailnet/panel-331 |
| TSO-0219 (Align health and inventory colors with documented semantics) | tailscale2otel-health/panel-131, tailscale2otel-health/panel-14, tailscale2otel-health/panel-52, tailscale2otel-health/panel-79, tailscale2otel-health/panel-97, tailscale2otel-health/panel-98, tailscale2otel-tailnet/panel-265, tailscale2otel-tailnet/panel-266, tailscale2otel-tailnet/panel-284 |
| TSO-0220 (Keep default annotations and time axes from obscuring traces) | tailscale2otel-health/panel-10, tailscale2otel-health/panel-101, tailscale2otel-health/panel-102, tailscale2otel-health/panel-104, tailscale2otel-health/panel-105, tailscale2otel-health/panel-107, tailscale2otel-health/panel-108, tailscale2otel-health/panel-109, tailscale2otel-health/panel-11, tailscale2otel-health/panel-110, tailscale2otel-health/panel-116, tailscale2otel-health/panel-117, tailscale2otel-health/panel-118, tailscale2otel-health/panel-120, tailscale2otel-health/panel-121, tailscale2otel-health/panel-155, tailscale2otel-health/panel-156, tailscale2otel-health/panel-16, tailscale2otel-health/panel-166, tailscale2otel-health/panel-167, tailscale2otel-health/panel-18, tailscale2otel-health/panel-22, tailscale2otel-health/panel-31, tailscale2otel-health/panel-32, tailscale2otel-health/panel-33, tailscale2otel-health/panel-37, tailscale2otel-health/panel-38, tailscale2otel-health/panel-40, tailscale2otel-health/panel-41, tailscale2otel-health/panel-42, tailscale2otel-health/panel-43, tailscale2otel-health/panel-44, tailscale2otel-health/panel-58, tailscale2otel-health/panel-59, tailscale2otel-health/panel-61, tailscale2otel-health/panel-62, tailscale2otel-health/panel-63, tailscale2otel-health/panel-7, tailscale2otel-health/panel-75, tailscale2otel-health/panel-76, tailscale2otel-health/panel-77, tailscale2otel-health/panel-78, tailscale2otel-health/panel-80, tailscale2otel-health/panel-81, tailscale2otel-health/panel-83, tailscale2otel-health/panel-84, tailscale2otel-health/panel-85, tailscale2otel-health/panel-88, tailscale2otel-health/panel-89, tailscale2otel-health/panel-9, tailscale2otel-health/panel-90, tailscale2otel-health/panel-91, tailscale2otel-health/panel-94, tailscale2otel-health/panel-99, tailscale2otel-tailnet/panel-107, tailscale2otel-tailnet/panel-108, tailscale2otel-tailnet/panel-11, tailscale2otel-tailnet/panel-111, tailscale2otel-tailnet/panel-112, tailscale2otel-tailnet/panel-116, tailscale2otel-tailnet/panel-117, tailscale2otel-tailnet/panel-12, tailscale2otel-tailnet/panel-120, tailscale2otel-tailnet/panel-121, tailscale2otel-tailnet/panel-122, tailscale2otel-tailnet/panel-124, tailscale2otel-tailnet/panel-125, tailscale2otel-tailnet/panel-13, tailscale2otel-tailnet/panel-14, tailscale2otel-tailnet/panel-143, tailscale2otel-tailnet/panel-144, tailscale2otel-tailnet/panel-145, tailscale2otel-tailnet/panel-146, tailscale2otel-tailnet/panel-147, tailscale2otel-tailnet/panel-15, tailscale2otel-tailnet/panel-153, tailscale2otel-tailnet/panel-154, tailscale2otel-tailnet/panel-16, tailscale2otel-tailnet/panel-160, tailscale2otel-tailnet/panel-161, tailscale2otel-tailnet/panel-162, tailscale2otel-tailnet/panel-165, tailscale2otel-tailnet/panel-166, tailscale2otel-tailnet/panel-167, tailscale2otel-tailnet/panel-171, tailscale2otel-tailnet/panel-172, tailscale2otel-tailnet/panel-183, tailscale2otel-tailnet/panel-184, tailscale2otel-tailnet/panel-187, tailscale2otel-tailnet/panel-219, tailscale2otel-tailnet/panel-225, tailscale2otel-tailnet/panel-229, tailscale2otel-tailnet/panel-321, tailscale2otel-tailnet/panel-322, tailscale2otel-tailnet/panel-323, tailscale2otel-tailnet/panel-73, tailscale2otel-tailnet/panel-89, tailscale2otel-tailnet/panel-90, tailscale2otel-tailnet/panel-91 |
| TSO-0221 (Make topology panels interpretable in populated and empty states) | tailscale2otel-tailnet/panel-138, tailscale2otel-tailnet/panel-313 |
| TSO-0222 (Restore Active series by metric family rendering on Grafana 13) | tailscale2otel-health/panel-174 |
| TSO-0223 (Use the correct ratio scale for delivery failure charts) | tailscale2otel-health/panel-119 |
| TSO-0224 (Make ingestion and export cost comparisons dimensionally consistent) | tailscale2otel-health/panel-175, tailscale2otel-health/panel-176 |
| TSO-0225 (Render device-country markers for a populated valid-code frame) | tailscale2otel-tailnet/panel-57 |
| TSO-0226 (Keep rolling audit-log counts distinct from per-second rates) | tailscale2otel-health/panel-25, tailscale2otel-tailnet/panel-177, tailscale2otel-tailnet/panel-180, tailscale2otel-tailnet/panel-181, tailscale2otel-tailnet/panel-182, tailscale2otel-tailnet/panel-183, tailscale2otel-tailnet/panel-187 |
| TSO-0227 (Name used scrape budget consistently with the displayed fraction) | tailscale2otel-health/panel-39 |
| TSO-0228 (Expose truthful receiver batch trace observations on the durable WAL path) | tailscale2otel-health/panel-128 |
| TSO-0229 (Name active-series cap utilization as a ratio rather than a count) | tailscale2otel-health/panel-162 |
| TSO-0230 (Keep whole-panel absence explanations out of nullable table cells) | tailscale2otel-tailnet/panel-298, tailscale2otel-tailnet/panel-92 |
| TSO-0231 (Show top node-pair talkers as an identifiable ranking) | tailscale2otel-tailnet/panel-119 |
| TSO-0232 (Keep default log rows scannable while retaining metadata details) | tailscale2otel-tailnet/panel-140, tailscale2otel-tailnet/panel-185, tailscale2otel-tailnet/panel-186, tailscale2otel-tailnet/panel-273 |
| TSO-0233 (Render duration rates as dimensionless quantities) | tailscale2otel-health/panel-25, tailscale2otel-health/panel-46 |
| TSO-0234 (Label histogram heatmap intensity as observation frequency) | tailscale2otel-health/panel-35 |
| TSO-0235 (Render actionable trace results when the dashboard search returns data) | tailscale2otel-health/panel-124 |
Final independent review3 PASS. The observed missing-binding/mapping negatives now fail correctly; current checks and all six regressions pass. All197 broken/misleading panels have filed tasks. Exact source correction gate passed before publication.
Final Summary
Loop33 accepted:522 panel verdicts,752 exact query identities,374 catalog dispositions,170 row decisions and25 filed dashboard follow-ups. Sole Loki-macro correction371cd92 has exact committed gate, hosted CI, GitSync/live-spec equality and actual frontend metric/log proof. Evidence repairs passed independent review3; raw captures remain untracked. Runtime deployment of the newly landed exporter changes is not claimed.