The dashboard that watches a 152-cluster hybrid cloud.

The data was scattered across planes that don't agree.

Monitoring Azure Local isn't one feed — it's many, and they have different truth models. Some data comes from scheduled health reports. Some is a live WMI fault that fires and clears in seconds. Some is a firehose of forwarded Windows events. Some is an Azure API you poll, with its own clock and throttle. And it all lives in five Active Directory domains, where non-production can't reach production services directly.

The lazy version flattens everything into one table and fakes the joins. This one doesn't. Report-backed data is tied to a real report; live data stays live and reportless. That single decision is what makes the dashboard trustworthy instead of just busy.

Windows Event Forwarding has limits it doesn't print on the box. In April the single subscription failed with error 50 (ERROR_NOT_SUPPORTED): too many queries. Two lists of 37 and 52 queries came first; eight lists, one per domain, is what held. Then the record IDs. WEF keeps each source's own EventRecordID, so IDs from hundreds of hosts interleave and can't be a watermark. The watcher hashes first — SHA-256 in UTF-16LE, byte-matching SQL's HASHBYTES — and renders XML only for events SQL hasn't seen.

Five domains, and none of them trust each other. Non-production can't reach production, and Get-Cluster has no -Credential parameter, so the health collector is a credentialed wrapper around a perform script. Lower-environment WMI faults are relayed through production with per-file replay cursors. Azure credentials are bound to a tenant per environment group, and a missing one fails instead of falling back to production. Environment codes are stamped at ingestion; an unknown one throws.

A query that looked indexed wasn't. The live timeline's header counts took about 105 seconds — a full index scan over roughly 17 million rows, even for a 60-minute window. Assigning results to variables (SELECT @Count = …) switches off OPTION (RECOMPILE) parameter embedding, so catch-all @X IS NULL OR col = @X filters never became seeks; a temp-table INSERT … SELECT fixed it. Query Store also caught one-second routes reading 150,000+ pages per probe. Now a probe reads 5, and nothing counts as indexed without logical-read and plan evidence.

Changing the engine in flight. In one September week, most node data moved from PowerShell remoting to Resource Graph, ARM, and metrics — the first big step of an API-first switch that's still under way — with operator decisions and alert history intact. The same three months brought Bun to Node, SQL Server 2025, and most of Effect 4: about 2,600 commits, one developer plus AI coding agents, kept safe by 35 CI gates, drift checks against the live database, and deploys that wait for a drain receipt.

• Event Intelligence — turns the forwarded-event stream into ranked findings with researched meanings and replayable runs. See the full breakdown →
• The Forge — governed automation inside the dashboard: allowlisted, hash-pinned PowerShell commands on a SQL-backed queue, one runner per environment, artifacts, and a full audit trail. No arbitrary shell from a browser. It also inherited the redeployment console's post-deploy checks. See the full breakdown →
• Ask ALDHI — the platform's own AI assistant, on TanStack AI + OpenRouter: 38 typed tools over the same repositories the UI reads. No model-written SQL, no secrets in context, capped reads, and no email without a preview and an explicit send. See the full breakdown →