Service outage

An out-of-band worker hits each subsystem directly — SELECT 1 on Postgres, /ping on ClickHouse, /health on the ingest gateway. No synthetic transactions, no guesswork.

Each probe is hard-capped at an 8s timeout. A slow-but-alive response reads degraded; only a failed call reads outage. We don't catastrophize a transient blip.

Every check is written to an append-only log kept for 90 days. The trace above is that history, drawn as a single worst-of-all-subsystems signal — the same rollup that lights the banner.

Our database scales to zero when idle. Rather than wake it every few minutes just to check, we probe it only while real traffic is flowing — so an untouched subsystem reads idle · cost-safe, never a fabricated green.