Useful breakdown. One edge case worth adding: on burstable instance types, steal can look like noisy-neighbour contention when it's really credit exhaustion, so correlating the steal graph with the provider's CPU-credit balance metric helps separate the two. Another question is sampling: since /proc/stat counters are cumulative, per-second tools can hide short bursts that still hurt p99 latency. Would recording steal alongside request latency percentiles (rather than load average alone) give a cleaner signal for deciding when to escalate to the provider versus resizing? Steal also tends to hit latency-sensitive, single-threaded workloads harder than throughput jobs, which may be worth testing separately.