Bugfixes 1 (#99)

* refactor(web): rewrite VehicleCommandCenter around shared range/command hooks

Redesigns the vehicle command center into modular components (hero, readiness strip, workspace, safety panel, activity feed) under features/system/components/command-center/, replacing the monolithic VehicleCommandCenter with domain-grouped command browsing and a dedicated /vehicles/{id}/command endpoint contract.

Introduces useRangeState with shared cross-page localStorage persistence (SHARED_RANGE_STORAGE_KEY) so date-range selections propagate between pages, and migrates all range-picker consumers (StatisticsPage, EnergyPage, ChargingListPage, CostAnalysisPage, DriveScorePage, DrivesListPage, DrivetrainHealthPage, EfficiencyPage, RouteEfficiencyPage, TripListPage, MyActivityPage) off ad-hoc useUrlString/useUrlBatch date defaults.

Adds a refetchInterval to useCommandLatest, normalizes command-query invalidation keys via a shared commandKeys helper, fixes MediaPlayerPage volume formatting to respect global precision, and removes an unstable Tesla charging-history sort parameter. Also relaxes several Go/TS command types to optional/nullable fields and adds CollapsibleCommandGroup vehicleKey prop rename.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat: add Tesla vehicle management

Adds vehicle management APIs, partner-token support, cached metadata, enterprise operations, privacy-safe audit logging, and a React workspace with confirmation flows for paid and state-changing requests.

* fix: scope warranty data by vehicle

Move warranty API routes and Tesla requests to vehicle/VIN-scoped endpoints, update frontend hooks and widgets, and handle empty management responses with updated tests and SLO routes.

* refactor(web): use shared VehicleSelect in management page

Replace VehicleManagementPage's inline Select/Badge vehicle picker with the shared VehicleSelect component from @/components/forms, always showing the dropdown even for single-vehicle fleets. Removes now-unused useMemo-based option building and manual selected-name logic. Adds a test asserting the dropdown remains visible with one vehicle.

* feat(web): improve vehicle management views

Add structured views for options, specifications, warranties, subscriptions, and enterprise roles, with technical response details, improved endpoint cards, and expanded test coverage. Keep vehicle selection visible for single-vehicle fleets.

* refactor(web): SI-canonical fields in weekly digest

Converts the weekly-digest feature (types, useWeeklyDigest, and all section components) from mixed display-unit fields (km, kWh, min, Wh/km) to SI-canonical fields (m, Wh, s, Wh/m), converting only at the render boundary via useUnits(). Adds a shared formatEfficiencyFromSI helper and a useAlertHistory hook backed by a bounded /alerts?limit= query. Drive/charging fetches are now scoped to an explicit two-week analytical window instead of relying on default pagination, and alerts are filtered by vehicle_id. Updates all associated tests and i18n strings to match.

* feat(geofences): add charging place pricing

Add discovered charging places, effective-dated geofence rates, protected cost provenance, historical backfill, and drive/charge geofence attribution.

Expose pricing lifecycle, rate preview/apply, summaries, and activity APIs with a complete Charging Places workspace. Add migration, metrics, tracing, SLO dashboards, alerts, and coverage audit updates.

* fix(web): show breadcrumbs on all routes

Render Home and the current page for registered top-level routes, and move the quick-search hint into the global breadcrumb chrome. Update layout and breadcrumb tests accordingly.

* fix: repair charging SI values and geofences

Normalize Tesla charging energy and power to Wh/W, repair historical data, and preserve display-boundary conversions. Unify geofence and charging-place management with categories, alerts, bulk actions, search, and protected-session attribution.

* fix(web): refine range persistence and previews

Use rolling seven-day defaults with versioned shared date-range preferences, and improve charging-rate preview actions with clearer guidance, focus, and modal scrolling.

* feat(web): redesign digital twin with photo compositor overlay

Reworks VehicleTwin's SVG to trace real Model Y proportions (traced body/DLO paths, clipped shading, redesigned Gemini-style wheels/spokes, refined lights and glass gradients) and adds an optional photo mode: a new `teslaCompositor.ts` builds a Tesla configurator side-view render URL per paint/model, which VehicleTwin overlays live telemetry indicators on top of, aligning the SVG coordinate system to the photo's traced geometry. Falls back to the hand-drawn SVG if the photo fails to load. Passes `model` through from DigitalTwinWidget, DigitalTwinMiniWidget, and DigitalTwinPage. Also boosts paint palette opacity stops in vehicleColors.ts so the body reads as a solid painted surface rather than translucent.

* UPdated

* fix(web): animate vehicle twin wheel visibility

Keep vector wheels visible during drive-in and driving, then fade them out when the parked photo settles so the photo's wheels are revealed.

* Added Wheels

* fix(web): stop wheel spinner drift on slow photo load

Shrink the wheel crop radius (34→28) so the crop stays strictly on the rim face; larger radii dragged the tire's baked-in lighting/aero deflector around the hub, reading as a wobbling second wheel.

Also gate the entry spin animation on photo load timing: if the vehicle photo arrives more than 700ms after mount, the drive-in slide has already finished, so skip the spin instead of playing it against an already-parked car.

* fix(web): align VehicleTwin wheel spinners to hub centers

PhotoWheelSpinner previously derived crop position from viewBox-space wheel constants, causing the rotating crop to be visibly offset from the actual photo wheel. Now it reads hub centers and crop radius directly from COMPOSITOR_METRICS in image space, computed via imgScale/imgLeft/imgTop, so the crop and photo share one coordinate system. Also sets transformOrigin to 50% 50% for correct rotation pivot, tags spinners with data-wheel-spinner for testability, and adds a regression test asserting calibrated crop centers for both wheels.

* fix(web): feather wheel crop edge in VehicleTwin

Split the wheel spinner into a static masked container plus an inner rotating rotor, so the crop radius can extend to the rim/tire boundary while a radial-gradient mask feathers the outer 4px into transparency. This removes the hard-edged wobble previously caused by keeping the crop strictly inside the alloy face.

Updated COMPOSITOR_METRICS with wheelCropRadius=54 and new wheelCropFeather=4, and adjusted VehicleTwin tests to assert the new mask-image and rotor transform-origin.

* Add Tempo tracing backend and fix dashboard queries

Adds a Tempo container (compose + Helm) alongside the OTel collector for TraceQL, service-graph, and span-metrics dashboards, wiring the metrics generator to remote-write into Prometheus. Updates Grafana dashboard datasource UIDs, span-metric attribute names (OTel semconv 1.x: http.response.status_code, messaging.destination.name, etc.), and Prometheus scrape targets/ports for workers.

Rewrites many Grafana panel queries that were previously disabled or stubbed (ADR-002 placeholders) to pull from their now-available source tables (climate_snapshots, motor_snapshots, security_events, drive_telemetry, tesla_battery_passport_ledger, etc.) instead of signal_log placeholders. Adds vehicle/drive picker dropdowns backed by SQL variables in several dashboards, adds an automation-worker service to docker-compose.dev.yml, exposes /metrics on all workers via promhttp, and improves HTTP route attribution in the tracing middleware by tagging spans with chi's matched route after routing completes.

Also fixes the validate_grafana_signal_log.py script to use a relative dashboard path and substitute more template variables.

* fix(mqtt): ack poison payloads to unblock ingest

Fleet Telemetry ingestion stalled when malformed QoS 1 payloads accumulated in the broker's in-flight receive window. MQTT 3.1.1 has no NACK, so returning without acking never triggered a same-connection redelivery — it just consumed an in-flight slot permanently.

The PipelineSubscriber now gives every terminal failure (codec drop, VIN resolver infra error, unexpected pipeline error, non-shutdown deadline, recovered panic) one bounded DLQ publish attempt followed by an unconditional ACK. Only shutdown-driven cancellation leaves a message unacked so the broker preserves it for the next connection.

- Removed the process-local RedeliveryTracker, MaxRedeliveries/TrackerCapacity config, TESLA_MQTT_MAX_REDELIVERIES Helm setting, and mqtt.maxRedeliveries value.
- Ack is now idempotent via atomic CAS so a panicking DLQPublisher cannot double-ack.
- Observability: tesla_mqtt_dlq_writes_total{reason} label set changed to codec_drop, vin_resolver_error, other, dlq_publish_failure; dashboards filtering on dlq_max_redeliveries must update their selector.
- Updated tests, docs, and CHANGELOG accordingly, including a regression test that replays a 32-message poison burst matching the production EMQX inflight=32/32 signature.

* feat: durable onboarding state and component health alerts

Persist first-run setup completion so a Fleet Telemetry outage or an expired Tesla token no longer sends a configured installation back through onboarding.

Backend:
- Add migration 000230 creating the single-row `onboarding_state` table with a backfill for already-configured installs, plus `OnboardingStateRepo` (ratcheting `MarkComplete`).
- `GET /onboarding/status` now returns `setup_complete`/`setup_required` (with `is_complete` kept as a backward-compatible alias), `last_telemetry_at`, and an informational `telemetry_health`.
- Replace the watchdog's unconditional success recording with real probes for database, MQTT (including Fleet Telemetry subscriber health), Redis, Tesla auth, worker, and telemetry freshness.
- Add edge-triggered, cooldown-debounced outage/recovery notifications that respect per-channel preferences and fall back to direct dispatch when MQTT is down, with an in-memory channel/preference cache so database outages can still notify.
- Add a stable event-type catalog in `internal/notification` served at `GET /notifications/event-types`.
- Add `PipelineSubscriber.IsHealthy` and `Worker.HealthSnapshot`.

Frontend:
- Add `useRuntimeStatus`, notification event-type/preference hooks, a global `RuntimeHealthBanner`, and a per-channel `HealthAlertPreferencesPanel`.
- Route the onboarding gate off `setup_required`, add a runtime-health notice, extract the setup status band, and improve mobile layout/scrolling on the onboarding page.

Update OpenAPI docs and add unit/integration tests across all touched areas.

* Consolidate battery health analytics into one endpoint

Replace signal_log replay with bounded cagg_battery_daily aggregation for battery-health history, and merge the separate degradation/session queries into a single /analytics/battery-health response (parallel history/summary/charging-analysis loaders, in-memory cache with per-vehicle load coalescing, Server-Timing headers, and OTel tracing).

Frontend: drop useBatteryDegradation and useChargingSessionsPaginated in favor of the consolidated useBatteryHealthAnalytics hook (15-minute staleTime, no retry). Update BatteryHealthAnalytics/BatteryHealthSnapshot types to canonical SI field names (estimated_capacity_wh, range_m, odometer_m, etc.) and extract chart/insight logic from BatteryHealthPage into lazily-loaded, deferred (in-view) components: BatteryTrendCharts, BatteryChargingCharts, and shared helpers.

Add an SLO for battery-health request latency and update all affected tests/fixtures accordingly.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: atulmgupta

.env.example

@@ -36,6 +36,12 @@ GRAFANA_PORT=3001
 GRAFANA_USER=admin
 GRAFANA_PASSWORD=changeme
 
+# Distributed tracing (optional — pair with: docker compose --profile tracing up)
+# Required for the Tempo, service-graph, span-metrics, and SLO trace dashboards.
+OTEL_ENABLED=false
+OTEL_ENDPOINT=otel-collector:4317
+OTEL_INSECURE=true
+
 # MQTT
 MQTT_PORT=1883
 

.github/copilot-instructions.md

@@ -467,7 +467,7 @@ Vehicle ─mTLS▶ Fleet Telemetry ─MQTT▶ PipelineSubscriber ─▶ Codec 
 
 **Boot-time sanity** (look for these lines in `docker logs teslasync-api`):
 ```
-"phase-42 PipelineSubscriber started" topic=telemetry/+/v/+ max_redeliveries=5
+"phase-42 PipelineSubscriber started" topic=telemetry/+/v/+ codec_failure_disposition=dlq_ack
 "phase-42a: fleet-telemetry PipelineSubscriber active" writer_count=12
 "signal store hydrated from signal_log via stateReader"
 "FSM vehicle state engine active — declarative transition table with 20 transitions"

CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to TeslaSync are documented here.
 
+## [Unreleased] — MQTT ingest liveness
+
+- Fixed Fleet Telemetry ingestion stalling when malformed QoS 1 payloads filled
+  the broker's in-flight receive window. Failed payloads now receive one
+  bounded DLQ publish attempt and a terminal ACK instead of waiting for a
+  same-connection redelivery that MQTT 3.1.1 cannot provide.
+- Removed the unused `TESLA_MQTT_MAX_REDELIVERIES` Helm setting and the
+  process-local redelivery tracker.
+- **Observability label change:** `tesla_mqtt_dlq_writes_total{reason}` now
+  uses `codec_drop`, `vin_resolver_error`, `other`, and
+  `dlq_publish_failure`; dashboards filtering on `dlq_max_redeliveries` must
+  update their selector.
+
 ## [Unreleased] — System Status polish + /admin removal
 
 System Status (`/system-status`) is now the single operator-facing

cmd/automation-worker/main.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	pahomqtt "github.com/eclipse/paho.mqtt.golang"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 
@@ -295,6 +296,7 @@ func main() {
 	port := healthPort()
 	healthMux := http.NewServeMux()
 	healthMux.HandleFunc("/healthz", healthHandler(db))
+	healthMux.Handle("/metrics", promhttp.Handler())
 	go func() {
 		log.Info().Str("port", port).Msg("health endpoint listening")
 		if err := http.ListenAndServe(":"+port, healthMux); err != nil && err != http.ErrServerClosed {

cmd/export-worker/main.go

@@ -12,6 +12,7 @@ import (
 
 	backupmodel "github.com/ev-dev-labs/teslasync/internal/models/backup"
 
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"go.opentelemetry.io/otel"
@@ -211,6 +212,7 @@ func main() {
 	healthPort := resolveHealthPort()
 	healthMux := http.NewServeMux()
 	healthMux.HandleFunc("/healthz", newHealthHandler(db))
+	healthMux.Handle("/metrics", promhttp.Handler())
 	go func() {
 		log.Info().Str("port", healthPort).Msg("health endpoint listening")
 		if err := http.ListenAndServe(":"+healthPort, healthMux); err != nil && err != http.ErrServerClosed {

cmd/notification-worker/main.go

@@ -15,6 +15,7 @@ import (
 
 	alertmodel "github.com/ev-dev-labs/teslasync/internal/models/alert"
 
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"go.opentelemetry.io/otel"
@@ -384,6 +385,7 @@ func main() {
 	}
 	healthMux := http.NewServeMux()
 	healthMux.HandleFunc("/healthz", healthzHandler(db))
+	healthMux.Handle("/metrics", promhttp.Handler())
 	go func() {
 		log.Info().Str("port", healthPort).Msg("health endpoint listening")
 		if err := http.ListenAndServe(":"+healthPort, healthMux); err != nil && err != http.ErrServerClosed {

cmd/slogen/generate_dashboards.go

@@ -145,7 +145,7 @@ func runGenerateDashboards(args []string) error {
 	return nil
 }
 
-var prometheusDS = datasource{Type: "prometheus", UID: "prometheus"}
+var prometheusDS = datasource{Type: "prometheus", UID: "DS_TESLASYNC_PROMETHEUS"}
 
 func renderSLODashboard(s SLO) (string, error) {
 	var min0 float64 = 0

docker-compose.dev.yml

@@ -1,8 +1,8 @@
 # docker-compose.dev.yml — Development stack with ALL components enabled.
 # Usage:  docker compose -f docker-compose.dev.yml up --build
 #
-# Includes: API, Web (Nginx), Notification Worker, Export Worker,
-#           PostgreSQL, Redis, Mosquitto, Grafana, Jaeger (tracing).
+# Includes: API, Web (Nginx), Notification Worker, Export Worker, Automation Worker,
+#           PostgreSQL, Redis, Mosquitto, Grafana, Tempo + Jaeger (tracing).
 # All tracing and telemetry features are enabled by default.
 #
 # ⚠️  TimescaleDB-HA migration (ADR-007):
@@ -51,7 +51,7 @@ services:
       - FLEET_TELEMETRY_FALLBACK_POLL_INTERVAL=5m
       # Tracing enabled by default in dev
       - OTEL_ENABLED=true
-      - OTEL_ENDPOINT=jaeger:4317
+      - OTEL_ENDPOINT=otel-collector:4317
       - OTEL_SERVICE_NAME=teslasync-api
       - OTEL_INSECURE=true
       - GOOGLE_MAPS_API_KEY=${GOOGLE_MAPS_API_KEY:-}
@@ -63,7 +63,7 @@ services:
         condition: service_started
       redis:
         condition: service_healthy
-      jaeger:
+      otel-collector:
         condition: service_started
     healthcheck:
       test: ["CMD", "/usr/local/bin/teslasync", "healthcheck"]
@@ -104,14 +104,16 @@ services:
       - LOG_LEVEL=error
       - HEALTH_PORT=8081
       - OTEL_ENABLED=true
-      - OTEL_ENDPOINT=jaeger:4317
+      - OTEL_ENDPOINT=otel-collector:4317
       - OTEL_SERVICE_NAME=teslasync-notification-worker
       - OTEL_INSECURE=true
     depends_on:
       postgres:
         condition: service_healthy
       mosquitto:
         condition: service_started
+      otel-collector:
+        condition: service_started
     healthcheck:
       test: ["CMD", "/usr/local/bin/notification-worker", "healthcheck"]
       interval: 15s
@@ -139,21 +141,63 @@ services:
       - LOG_LEVEL=error
       - HEALTH_PORT=8082
       - OTEL_ENABLED=true
-      - OTEL_ENDPOINT=jaeger:4317
+      - OTEL_ENDPOINT=otel-collector:4317
       - OTEL_SERVICE_NAME=teslasync-export-worker
       - OTEL_INSECURE=true
     depends_on:
       postgres:
         condition: service_healthy
       mosquitto:
         condition: service_started
+      otel-collector:
+        condition: service_started
     healthcheck:
       test: ["CMD", "/usr/local/bin/export-worker", "healthcheck"]
       interval: 15s
       timeout: 5s
       retries: 3
       start_period: 10s
 
+  automation-worker:
+    build:
+      context: .
+      dockerfile: Dockerfile.automation
+      args:
+        VERSION: dev
+    container_name: teslasync-automation-worker-dev
+    restart: unless-stopped
+    environment:
+      - DATABASE_HOST=postgres
+      - DATABASE_PORT=5432
+      - DATABASE_USER=teslasync
+      - DATABASE_PASSWORD=teslasync
+      - DATABASE_NAME=teslasync
+      - DATABASE_SSL_MODE=disable
+      - MQTT_HOST=mosquitto
+      - MQTT_PORT=1883
+      - TESLA_CLIENT_ID=${TESLA_CLIENT_ID:-dev-client-id}
+      - TESLA_CLIENT_SECRET=${TESLA_CLIENT_SECRET:-dev-client-secret}
+      - TESLA_API_BASE_URL=${TESLA_API_BASE_URL:-https://fleet-api.prd.na.vn.cloud.tesla.com}
+      - LOG_LEVEL=error
+      - HEALTH_PORT=8083
+      - OTEL_ENABLED=true
+      - OTEL_ENDPOINT=otel-collector:4317
+      - OTEL_SERVICE_NAME=teslasync-automation-worker
+      - OTEL_INSECURE=true
+    depends_on:
+      postgres:
+        condition: service_healthy
+      mosquitto:
+        condition: service_started
+      otel-collector:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/automation-worker", "healthcheck"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
   # ── Infrastructure ────────────────────────────────────────
 
   postgres:
@@ -229,13 +273,35 @@ services:
       - POSTGRES_USER=teslasync
       - POSTGRES_PASSWORD=teslasync
       - POSTGRES_DB=teslasync
+      - PROMETHEUS_URL=http://prometheus:9090
     volumes:
       - dev_grafana_data:/var/lib/grafana
-      - ./grafana/provisioning:/etc/grafana/provisioning
+      - ./grafana/custom.ini:/etc/grafana/grafana.ini:ro
+      - ./grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
+      - ./grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards:ro
       - ./grafana/dashboards:/var/lib/grafana/dashboards
     depends_on:
       postgres:
         condition: service_healthy
+      prometheus:
+        condition: service_started
+
+  prometheus:
+    image: prom/prometheus:v2.51.0
+    container_name: teslasync-prometheus-dev
+    restart: unless-stopped
+    ports:
+      - "9099:9090"
+    volumes:
+      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - ./helm/teslasync/files/prometheus/recording-rules.yaml:/etc/prometheus/rules/recording-rules.yaml:ro
+      - ./helm/teslasync/files/prometheus/alerting-rules.yaml:/etc/prometheus/rules/alerting-rules.yaml:ro
+      - dev_prometheus_data:/prometheus
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.retention.time=15d'
+      - '--web.enable-remote-write-receiver'
+      - '--enable-feature=exemplar-storage'
 
   # ── Observability ─────────────────────────────────────────
 
@@ -245,13 +311,46 @@ services:
     restart: unless-stopped
     ports:
       - "16686:16686"   # Jaeger UI
-      - "4317:4317"     # OTLP gRPC
-      - "4318:4318"     # OTLP HTTP
     environment:
       - COLLECTOR_OTLP_ENABLED=true
 
+  tempo:
+    image: grafana/tempo:2.7.0
+    container_name: teslasync-tempo-dev
+    restart: unless-stopped
+    command:
+      - "-config.file=/etc/tempo/config.yaml"
+    ports:
+      - "3200:3200"
+    volumes:
+      - ./observability/tempo/config.yaml:/etc/tempo/config.yaml:ro
+      - dev_tempo_data:/var/tempo
+    depends_on:
+      prometheus:
+        condition: service_started
+
+  otel-collector:
+    image: otel/opentelemetry-collector-contrib:0.103.1
+    container_name: teslasync-otel-collector-dev
+    restart: unless-stopped
+    command:
+      - "--config=/etc/otelcol/config.yaml"
+    volumes:
+      - ./observability/otel-collector/config.yaml:/etc/otelcol/config.yaml:ro
+    ports:
+      - "4317:4317"
+      - "4318:4318"
+      - "9464:9464"
+    depends_on:
+      jaeger:
+        condition: service_started
+      tempo:
+        condition: service_started
+
 volumes:
   dev_postgres_data:
   dev_redis_data:
   dev_mosquitto_data:
   dev_grafana_data:
+  dev_prometheus_data:
+  dev_tempo_data:

docker-compose.yml

@@ -295,7 +295,9 @@ services:
       - PROMETHEUS_URL=http://prometheus:9090
     volumes:
       - grafana_data:/var/lib/grafana
-      - ./grafana/provisioning:/etc/grafana/provisioning
+      - ./grafana/custom.ini:/etc/grafana/grafana.ini:ro
+      - ./grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
+      - ./grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards:ro
       - ./grafana/dashboards:/var/lib/grafana/dashboards
     depends_on:
       postgres:
@@ -329,6 +331,7 @@ services:
       - '--config.file=/etc/prometheus/prometheus.yml'
       - '--storage.tsdb.retention.time=15d'
       - '--web.enable-lifecycle'
+      - '--web.enable-remote-write-receiver'
       # exemplar-storage retains the trace_id/span_id labels attached to
       # histogram observations by internal/api/middleware.go +
       # internal/metrics/exemplar.go so Grafana can render the "View trace"
@@ -503,6 +506,33 @@ services:
         limits:
           memory: 256M
 
+  # Tempo (optional — docker compose --profile tracing up)
+  # Grafana's TraceQL, service-map, and span-metrics dashboards use this
+  # backend. Its metrics generator remote-writes RED and service-graph series
+  # to the Prometheus service above.
+  tempo:
+    image: grafana/tempo:2.7.0
+    container_name: teslasync-tempo
+    restart: unless-stopped
+    profiles:
+      - tracing
+    command:
+      - "-config.file=/etc/tempo/config.yaml"
+    ports:
+      - "${TEMPO_PORT:-3200}:3200"
+    volumes:
+      - ./observability/tempo/config.yaml:/etc/tempo/config.yaml:ro
+      - tempo_data:/var/tempo
+    depends_on:
+      prometheus:
+        condition: service_started
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+        reservations:
+          memory: 128M
+
   # OpenTelemetry Collector (optional — docker compose --profile tracing up)
   # Dev variant of helm/teslasync/files/otel-collector/config.yaml — 100%
   # sampling (no tail policy), CORS-enabled OTLP HTTP receiver for browser
@@ -532,6 +562,8 @@ services:
     depends_on:
       jaeger:
         condition: service_started
+      tempo:
+        condition: service_started
     deploy:
       resources:
         limits:
@@ -697,5 +729,6 @@ volumes:
   mosquitto_data:
   redis_data:
   prometheus_data:
+  tempo_data:
   pyroscope_data:
-  vehicle_photos:
+  vehicle_photos: