Health

Liveness + capabilities + cascade readiness probe.

status stays "ok" whenever the process is up — the HTTP code is a liveness signal and a degraded cascade must not trigger a restart (a crash-loop fixes neither a bad md file nor disk bloat). The cascade block is the readiness signal: healthy=false with human-readable reasons only when the projection pipeline itself is stuck (drain failing, optimize stuck, version cleanup stalled). failed_permanent — files awaiting cascade fix — is a data-quality backlog reported as an informational count that does not flip healthy. Alert on cascade.healthy.