fix(ops): bound CD DB probes and restore SigNoz collector

scripts/reboot-recovery/signoz-canonical-route-preflight.py

@@ -22,6 +22,9 @@ EXPECTED_BLOCKERS = [
     "direct_ingress_policy_not_closed",
     "http_bridge_not_supervised",
     "filelog_normalization_degraded",
+    "api_runtime_cooldown_pending",
+    "cd_probe_safety_fix_not_deployed",
+    "backup_collector_restore_guard_not_deployed",
     "wave_b_not_authorized",
 ]
 

scripts/reboot-recovery/tests/test_signoz_canonical_route_migration.py

@@ -23,6 +23,7 @@ GRPC_BRIDGE = ROOT / "scripts/reboot-recovery/signoz-188-otlp-grpc-bridge.sh"
 GRPC_UNIT = ROOT / "ops/systemd/user/awoooi-signoz-otlp-grpc-bridge.service"
 GRPC_VERIFIER = ROOT / "scripts/reboot-recovery/verify-signoz-otel-grpc-runtime.sh"
 GRPC_RUNTIME_RECEIPT = ROOT / "ops/signoz/p0-obs-002-grpc-runtime-receipt.yaml"
+POST_CLOSURE_REGRESSION = ROOT / "ops/signoz/p0-obs-002-post-closure-regression.yaml"
 
 
 def test_wave_a_contract_keeps_active_route_and_all_producers_on_incumbent() -> None:
@@ -266,6 +267,14 @@ def test_grpc_runtime_verifier_uses_real_service_aggregates_and_ten_minute_gate(
     assert receipt["completion"]["grpc_runtime_asset"] == "closed"
     assert receipt["completion"]["program"] == "partial_degraded"
 
+    regression = yaml.safe_load(POST_CLOSURE_REGRESSION.read_text(encoding="utf-8"))
+    assert regression["baseline"]["verifier_terminal"] == "pass"
+    assert regression["regressions"]["api_runtime"]["last_observed_cooldown_closed"] is False
+    assert regression["controlled_recovery"]["stateful_services_touched"] == 0
+    assert regression["controlled_recovery"]["grpc_4317_listening"] is True
+    assert regression["scope_boundaries"]["grpc_bridge_rollback_indicated"] is False
+    assert regression["terminal"]["status"] == "partial_degraded"
+
 
 def test_managed_promotion_and_bridge_retirement_fail_closed_without_receipts() -> None:
     env = os.environ.copy()