v2.5.0 — Observability: the system screams first (first-client gate OPEN)

v2.5.0 — Observability: the system screams first

The release that opens the first-client gate.

• OBS-01: Error capture with a legal-grade PII allow-list — Sentry events carry only message, stack, companyId, requestId, route, method, status, release. Nothing else can leak: the event is rebuilt field by field, never filtered. Empty DSN = fully disabled (#78)
• Honest /health per component — db, redis, queues (worker heartbeats), migrations, storage. HTTP 503 only when Postgres is down; every other failure is named and returns 200. Real version, no more hardcoded 1.0.0
• Durable metrics — hourly p95/p99 rollups from the existing request-log path, queue depth samples, webhook acceptance counters (~30d retention). The in-memory store that a restart wiped is no longer the evidence
• OpsAlert — platform alerts generalized from the S4 channel pattern: queue depth, failed jobs, error-rate spike, p95 breach. Named reasons, OPEN/RESOLVED, one open alert per (company, type, scope) — no alert storms. Surfaced in Notification Center and the Observability panel; the dashboard Live badge reflects them
• ops-hygiene runs on the reconciliation queue, not the Shopify one — tenants without a channel still get platform alerts

First-client gate: OPEN. CI that bites + verified backups with drill cadence + five rehearsed founder runbooks + observability. DockingWare can be billed for.

Rollback: re-deploy v2.4.0 (migration in range is additive — safe). Release smoke: PASS (ledger witness included — L17). Owner tasks after deploy: SENTRY_DSN (Railway) · sentryDsn (Vercel prod) · UptimeRobot monitor on /health.