A detection lab built with Terraform, cross-platform endpoints, and a full emulation stack... and the two unbounded logging defaults that quietly took out two hosts while everything still reported healthy. Part one: the platform.