Module health 

The health tree and its three projections.

Every stage reports into one registry: sources, decode, contract/DQ, transform DAG nodes, each sink, the recovery driver, the offset store. Each reports ok | degraded | down plus the numbers behind it (lag, fill ratio, circuit state, commit latency). Backpressure state is not a separate signal — it is the connector-core four-state machine (Normal/Warning/Critical/Stuck) projected per stage: Warning/Critical → degraded, Stuck → down.

K8s probes read only the HTTP status code, never the body, so the rich JSON is invisible to the kubelet by design. Three projections of one tree:

• GET /health → 200 almost always; full JSON stage tree, with an overall status code and a one-line summary at the top. For humans, dashboards and scrapers — not what K8s probes.
• GET /ready → 200 or 503, tiny body. Work-gating. Gated ONLY by source health and the primary-raw sink: if a source is down or raw cannot be written, the pod is not ready (the source cannot safely ack). Every other stage is display-only and never drops readiness.
• GET /live → 200 unless fatal, tiny body. Liveness. Fails only on genuinely unrecoverable in-process state — never on a saturated sink or a rebalance, since restarting does not fix a data-plane problem and would cause restart loops.

Extension path (not built yet): a per-stage ignore | degrade | fail readiness policy, the monitoring-side twin of the sink block | isolate failure policy, for when a stage beyond source/primary-raw should gate readiness.