Operational health

Duckbill™ exposes process probes and per-account sync health without mail bodies, tokens, or secrets (MAIL-47 / MAIL-75 / ADR 0026).

Probes

Endpoint	Meaning	Provider down
`GET /api/health/live`	Process is alive. Always HTTP 200 if the host can answer.	Still 200
`GET /api/health/ready`	Database reachable and required configuration present.	Still 200 when the app can accept work
`GET /api/health`	Operational document: queues, DLQ, drift, recovery mode, per-account lag.	HTTP 200, `providers.overall = degraded`
`GET /api/providers/health`	`GetProviderHealth` shape: auth, sync, last success, push, backlog, stale.	HTTP 200, accounts labeled

A Microsoft Graph outage degrades mailbox sync. It does not restart the process and it does not make the whole application unready.

Stale versus empty success

If an account has never synced, or the last successful checkpoint is older than 15 minutes, the document sets stale: true and staleReason. Operators must not read a missing timestamp as a healthy empty mailbox.

Metrics

@inbox-agent/observability emits:

sync.lag_seconds
sync.last_success_age_seconds
queue.depth / queue.oldest_age_seconds
dlq.open_count
reconciliation.drift_count
api.duration_ms (p95 from stored samples)

Labels are account and provider identifiers only. Field redaction runs before a sink sees the sample.

Admin view

/ops renders the same health document. It is an operator surface, not triage or write-back.

Schema

Migration 0018_ops_health.sql adds recovery mode, API latency samples, durable application_rules / application_corrections, and ops_backup_runs.