Queue depth. A deep queue that is draining is fine; a shallow queue whose oldest item is an hour old is not.
The scan tier is scaled and alarmed on oldest-unscanned age per lane, because the promise being kept is time-to-verdict rather than throughput
CPU and worker count are capacity inputs, not symptoms — alarming on them produces pages nobody can act on
The four alarms
Oldest-unscanned age per lane past its band — the saturation signal that drives the shedding order
An object in a non-terminal state past its expected dwell time — the stuck-object signal, which is both a support ticket and a security hole
A serve attempt against a non-available object, which should be impossible and therefore matters; and signature-set age, which bounds how stale the platform's knowledge is
Measured, not alarmed
Claimed-versus-determined content type disagreement rate, which is an early signal of either a buggy client or a deliberate one
Dedup hit rate and scan cost per 1,000 objects, because the cost model is a design parameter rather than a monthly surprise
Releases, overrides and break-glass reads — low-volume, high-consequence, reviewed rather than paged
