feat: provide foreign-key-free fresh install baseline

cmd/orbit-admin/main.go

@@ -23,19 +23,21 @@ func main() {
 }
 func run() error {
 	if len(os.Args) < 2 {
-		return errors.New("usage: orbit-admin bootstrap|verify|retention inventory|credential status|rotate|revoke|apply")
+		return errors.New("usage: orbit-admin bootstrap|verify|observe snapshot|retention inventory|credential status|rotate|revoke|apply")
 	}
 	switch os.Args[1] {
 	case "bootstrap":
 		return runBootstrap(os.Args[2:])
 	case "verify":
 		return runVerify(os.Args[2:])
+	case "observe":
+		return runObserve(os.Args[2:])
 	case "retention":
 		return runRetention(os.Args[2:])
 	case "credential":
 		return runCredential(os.Args[2:])
 	}
-	return errors.New("usage: orbit-admin bootstrap|verify|retention inventory|credential status|rotate|revoke|apply")
+	return errors.New("usage: orbit-admin bootstrap|verify|observe snapshot|retention inventory|credential status|rotate|revoke|apply")
 }
 
 func runVerify(args []string) error {
@@ -69,6 +71,42 @@ func runVerify(args []string) error {
 	return nil
 }
 
+// runObserve exposes the same bounded, read-only snapshot used by the private
+// metrics sampler. It is deliberately an operator command rather than a
+// tenant-facing API: values are per database node and may be truncated.
+func runObserve(args []string) error {
+	if len(args) != 1 || args[0] != "snapshot" {
+		return errors.New("usage: orbit-admin observe snapshot")
+	}
+	cfg, err := config.Load()
+	if err != nil {
+		return err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	db, err := mysql.Open(ctx, cfg.MySQLDSN, 2, 1)
+	if err != nil {
+		return errors.New("database unavailable")
+	}
+	defer db.Close()
+	snapshot, err := mysql.ReadOperationalSnapshot(ctx, db)
+	if err != nil {
+		return errors.New("operational snapshot unavailable")
+	}
+	output := struct {
+		Snapshot           mysql.OperationalSnapshot `json:"snapshot"`
+		SampleLimit        int                       `json:"sample_limit"`
+		EventWindowSeconds int                       `json:"event_window_seconds"`
+		Scope              string                    `json:"scope"`
+	}{
+		Snapshot:           snapshot,
+		SampleLimit:        10000,
+		EventWindowSeconds: 300,
+		Scope:              "single database node; bounded sample, not a global exact count",
+	}
+	return json.NewEncoder(os.Stdout).Encode(output)
+}
+
 func runRetention(args []string) error {
 	if len(args) == 0 || args[0] != "inventory" {
 		return errors.New("usage: orbit-admin retention inventory --before RFC3339")