feat: add bounded operational metrics

docs/operations-runbook.md

@@ -25,6 +25,24 @@ the process is up; `/readyz` becomes successful only after durable recovery.
 The public endpoint accepts only `wss://HOST/v1/agent`. Do not publish port
 6900 or add a proxy route for JSON-RPC.
 
+## Health, metrics, and logs
+
+Keep the configured observability listener private to the host or monitoring
+network. `/metrics` exposes only bounded, aggregate Prometheus samples: health
+state; registration/takeover and protocol failures; session/reconnect and
+heartbeat timing; dispatch/event/transition counts and latency; and client
+output accounting. It never includes a command body, stdin, output, client ID,
+or UUID label. Duration histograms use fixed buckets, so monitoring traffic
+cannot create unbounded series.
+
+For a Windows client, readiness is false while its durable spool is recovering
+or it has no reconciled server session; it becomes true only while the active
+WSS session can exchange command data. Server liveness starts before
+asynchronous recovery, while server readiness remains false until that recovery
+completes. The configured rotating JSON/text service logs are diagnostics, not
+a command-output store; use `rvc` history and the audited storage for command
+evidence.
+
 ## Backup and restore
 
 Stop dispatch before copying data: stop the server gracefully, confirm it is