Verify all 8 pinned Grafana tags actually boot and seed — record the results table

[myselfsiddharth]

Context

ADR-0003 pins eight Grafana OSS versions in scripts/testbed/matrix.json — 9.5.21, 10.0.13, 10.4.19, 11.0.0, 11.5.2, 12.0.0, 12.2.1, 13.0.3. The harness (src/testbed/, npm run testbed) ships compose + provisioning + an HTTP seed client, and the --dry-run path is verified. But ADR-0003's own Open questions admit the honest state:

Whether every matrix tag still pulls cleanly on all CI runners (tags cited from Docker Hub / GitHub on 2026-07-25; not every tag was pulled in this environment).

docs/gate/testbed.md says the same: "Do not claim a seeded instance is up unless compose up + health + seed succeeded." Nobody has run it. The whole matrix is a citation, not an observation.

Everything downstream — recording, compiling, replaying per version — is blocked on knowing which of these eight tags actually work.

What to do

This is an empirical issue. Run it, write down what happened.

For each of the eight pinned versions:

npm run testbed -- --version <X>          # compose up + wait + provision + seed
# verify by hand:
#   - http://127.0.0.1:3000/login renders
#   - admin login works with the compose fixture credentials
#   - the provisioned TestData datasource (uid paragent-testdata) is listed
#   - the seed dashboard (uid paragent-seed) opens and renders its panels
npm run testbed -- --version <X> --down   # tears down with no orphans

Record, per version: image pulled y/n, container reached healthy y/n, seed succeeded y/n, dashboard rendered y/n, and any error text (trimmed, no credentials).

Deliverables

1. A results table in docs/gate/testbed.md, replacing the current unverified matrix table or sitting directly beneath it. Columns: version, pulled, healthy, seeded, dashboard renders, notes, verified_on date, and the Docker image digest you actually pulled (docker image inspect --format '{{index .RepoDigests 0}}' grafana/grafana:<tag>). The digest is what makes this reproducible later.
2. Fixes for anything cheap that breaks. Expect trouble around the TestData plugin id flip (testdata below v10 vs grafana-testdata-datasource from v10) — src/testbed/provisioning.ts already rewrites the overlay per major, but that logic has never met a real 9.5.21 container. If a fix is more than a few lines, open a separate issue rather than growing this PR.
3. Amend scripts/testbed/matrix.json for any version that cannot be made to work: add "status": "unavailable" plus a "reason" string. Do not delete the row and do not silently substitute a nearby tag — a shrinking matrix is a finding, and the gate writeup has to disclose it.
4. Update ADR-0003's Open questions to reflect what is now verified.

Constraints

• No credentials in the results table, in error text, or in commit messages. GF_SECURITY_ADMIN_PASSWORD: paragent in scripts/testbed/docker-compose.yml is a local fixture, not a secret — do not add new ones.
• Do not weaken the harness to make a version pass. If 9.5.21 cannot be provisioned the way the others are, record that asymmetry.
• Report what happened, including partial failures. A five-of-eight matrix that is honestly documented is worth more than eight rows of assumption.

How to test

docker info                               # Docker daemon must be running
npm run testbed -- --list
npm run testbed -- --version 11.0.0 --dry-run   # plan path, no daemon needed
npm run testbed -- --version 11.0.0
npm run testbed -- --version 11.0.0 --down
npm run ci

Run the up/down cycle twice for at least one version to confirm teardown leaves no orphaned volumes or networks (docker ps -a, docker volume ls).

Before you open the PR

• All eight versions attempted; every outcome recorded, including failures
• Image digests captured for versions that booted
• npm run ci and npm run test:canary green
• npm run secret-scan green; no credential or session material in the diff
• docs/gate/testbed.md and ADR-0003 Open questions updated
• Any version marked unavailable carries a reason
• Branch track1/b1-testbed-verify