Console surfaces

Each console page answers one operator question. Use the page that owns the facts; do not reconstruct authority from a partial table on another surface.

Overview

Start every shift and incident here. Overview shows node readiness, /live and /ready probes, lane, writer term, route generation, ring generation, MQTT connection count, publish rate, ingress-ring pressure, and bridge backlog.

Route-to-node gates are listed individually with backend reasons. The page also carries incident-triage presets: All alerts, Bridge outage, HA/drain, ACL denies, Schema rejects, Reconnect storm, Ring pressure, and Replay lag.

Triage

Triage correlates already-redacted facts without exposing payloads. Open it from an Overview alert runbook or directly. URL parameters keep a shareable incident view:

/triage?preset=bridge_outage&alert=bridge-webhook-retry&runbook=bridge-outage

The Alert, Facts, Evidence and Support/Action indicator describes the operating sequence. Backend command state is reported separately.

Broker

Inspect sessions, subscriptions, retained-topic summaries, and offline-queue counts. Retained and offline collections expose size and age, never bodies. body_included must remain false.

Nginx owns connection lifecycle and packet shaping. nginz-iotd owns session tables, retain, offline queues, and replay.

Devices

Move from tenant posture to live clients. Filter by tenant, client ID, or principal reference. Record worker ID, connection ID, and session generation before opening Broker or the Reconnect storm preset.

The page does not discover fleet membership by inspecting packets.

Auth

Inspect policy generation, ACL-cache hit rate, denied publishes, and JWT skew rejects. Credential extraction can happen at the nginx edge; durable policy generations stay in nginz-iotd. Unknown generations fail closed.

Rules

Correlate topic filters, schema rejects, republish rate, and bridge-action rate. This is not a SQL rule engine or windowed aggregator. Activation requires config preflight, expected generation, audit evidence, and backend reconciliation.

Bridges

Inspect sink health, retry backlog, dead letters, and drain targets. A high backlog with no dead letters usually means retry is still active. Rising dead letters means the failure policy has been exhausted.

nginz-iot-bridge owns blocking clients. The console cannot complete a delivery itself.

Gateways

Inspect inbound WebSocket, MQTT-SN, CoAP, HTTPS, LwM2M, and LoRaWAN posture alongside daemon-owned Modbus polling and OPC UA client health. Direction determines the runtime owner; none of these adapters becomes an alternate owner of broker sessions or durability.

HA

Compare route decision, writer term, replay frontier, ring generation, controlled drain, and stale-active rejection before any traffic movement. Heartbeat and liveness can raise suspicion; they cannot grant ownership.

Observe

Use bounded counters and diagnostic-signal posture. Typical counters include connect/subscribe/publish allow and deny, current sessions, and unexpected errors. High label churn warns of cardinality growth.

Audit

Prove who performed an operational action. Records stay bounded and redacted. Filter by command ID, actor, bridge ID, rule generation, tenant, or incident term.

Support

Confirm bundle safety before creating a governed support bundle. Do not distribute a bundle if safe to share is false, redacted is false, or payloads/credentials are included.

Configuration

Inspect file-backed configuration generations, drift, and invalid directives. The console is not an in-browser config editor. Source-controlled files, nginx -t, and --test-config remain the activation path.

Command Center

Review governed preflight, submission, status, audit, and reconciliation evidence in one place. See governed commands.

Collection controls

Paginated collections share the same backend filters:

Filters run on the backend before pagination. Applying a filter resets the offset to zero.