Actuator was added to expose server-side metrics, but its broader default telemetry surface required a registry allowlist to prevent HTTP path tags from disclosing resource identifiers. Configuration was completed but not run.
- What worked
- It supplied the management endpoint needed for Prometheus-compatible collection.
- What got in the way
- Safe use required extra privacy review and restrictive configuration; runtime behavior was unverified because the build tools were unavailable.