Match each LLM app incident pattern to the dashboard signal that catches it first

An LLM application produces a portfolio of signals: judge scores from evals, latency percentiles, cost per request, error rates by class, retrieval recall on probe sets, per-tenant variants of each. The portfolio's value is that **each kind of incident leaves a distinctive signature** on a specific subset of those panels. The matches in this question are the canonical signatures. **Silent vendor snapshot roll**, the `gpt-4o` alias advanced to a new snapshot without notice. Quality on a fixed input set changes; the daily canary eval set is the deterministic detector that catches this against its rolling baseline. **Rate-limit cascade**, primary provider is throttling. The 429 count spikes; p99 latency rises because requests wait for retries before falling back; downstream services queue up. **Cost runaway from a recursive agent loop**, an agent's tool-call loop fails to terminate, generating thousands of tokens per request. Cost per request jumps, output-token histogram develops a long tail. **Hallucination spike after retrieval index rebuild**, the new index returns different top-k passages for the same queries, so faithfulness drops specifically on RAG traces tagged with the new index version. **Per-tenant cohort regression**, one customer cohort's metric tanked while global aggregate stayed flat. Only the per-tenant breakdown reveals it. **Model deprecation**, provider sunset the pinned model id. Sustained `model_not_found` or `deprecated` 4xx errors on that specific id.

The right framing is that **production LLM dashboards should be designed around the cause signatures of known incident classes**, not as a generic catch-all panel. The six matches in this question cover the headline incident classes a 2026-era LLM application team should expect to see annually. Each has a distinctive fingerprint on the dashboard. Snapshot rolls show up only on input-controlled metrics (the canary), because real-traffic metrics shift constantly from traffic mix; the canary is the deterministic baseline. Rate-limit cascades show as 429 spikes plus latency rise because retries wait the full backoff budget before fallback. Cost runaways from agent loops show as p99 cost per request and output token length tail expansion; the median may stay flat because only the runaway requests blow up. Index-rebuild hallucinations show up as faithfulness regression on RAG-only traces, broken down by index version, the breakdown is the diagnostic. Cohort regressions hide in global aggregates and surface only on per-tenant panels; this is the one that escapes if the dashboard does not have a per-tenant facet. Model deprecation shows as a clean 4xx error class on a pinned model id, usually preceded by a deprecation notice that the team missed, sometimes not. The operational implication is that the dashboard's panels are the runbook. When a page fires, the on-call looks at which panel moved and immediately knows which incident class to investigate first.