feat(health): bind probe process from listen env

ARCHITECTURE.md

@@ -84,6 +84,7 @@ research_contribution
 tenant_authorization
 integration_outbox
 integration_inbox
+health_probes
 ```
 
 Splitting a module into a separate service later must not change its domain semantics or bypass existing versioned contracts.

CHANGELOG.md

@@ -5,6 +5,11 @@ All notable product and architecture changes are recorded here. Releases use imm
 ## Unreleased
 
 ### Added
+- Operator health probes can start from `HEALTH_LISTEN_ADDR` or platform `PORT`, optionally observe `DATABASE_URL` only for GET `/ready`, and keep GET `/live` free of store I/O when the store is down. Blank, padded, or unknown listen/store/backlog values fail closed. Caller-measured `HEALTH_BACKLOG_HEALTH` is required before readiness can be true; the process does not invent a backlog threshold.
+- Operator health probes can observe a live PostgreSQL operational snapshot and answer GET `/live` and GET `/ready` without exposing driver errors. GET `/live` does not perform store I/O. Bare GET `/ready` on the PostgreSQL adapter requires `postgres_operational_store`. The bound listener applies a 2-second I/O timeout and rejects oversized requests without echoing them. Measured backlog thresholds remain caller-supplied.
+- PostgreSQL operational health snapshot composes runtime and relation probes with caller-supplied backlog into one fail-closed `RuntimeHealthSnapshot` without exposing driver errors.
+- A bound TCP listener can serve operator GET `/live` and GET `/ready` probes in a blocking accept loop until accept fails, or one HTTP/1.1 request per accepted connection. Accept retries Interrupted, ConnectionAborted, and ConnectionReset. A dropped probe connection does not stop later probes on either the in-memory or PostgreSQL-backed serve loop. It does not add public product routes, TLS, keep-alive, or measured SLO values.
+- Operator HTTP probes translate the domain health snapshot into GET `/live` and GET `/ready` responses with an as-built OpenAPI 3.2.0 contract. Liveness stays independent of operation readiness; named required capabilities, stalled backlog, unknown integrity, and unknown capabilities fail closed. Unsupported methods and paths return RFC 9457 problem details with explicit `urn:psychometrics-commons:problem:` types, not `about:blank`, and without raw store errors.
 - Scoring-job cancel and lease-expiry fallback classification lock the current row until the caller transaction ends, so concurrent workers cannot rewrite terminal or unleased evidence.
 - PostgreSQL operational-store readiness probe classifies the supported major version and write-readiness, and fails closed when a caller-declared required relation is missing.
 - PostgreSQL scoring-job cancellation: queued, leased, or retry-scheduled work becomes cancelled without transferring a fence, exact replay is idempotent, and completed or quarantined evidence cannot be rewritten.

README.md

@@ -52,6 +52,10 @@ It does **not** duplicate psychometric numerical kernels, identity credentials,
 - [CLAUDE.md](CLAUDE.md) — concise coding-agent entry point into the same normative contracts.
 - [Changelog](CHANGELOG.md) — unreleased and released product/architecture changes.
 
+## Operator health probes
+
+To run the first process surface, set `HEALTH_LISTEN_ADDR` (for example `127.0.0.1:8080`) or platform `PORT`, then call `psychometrics_commons_runtime::health_process::run_health_process`. Point liveness at GET `/live` and readiness at GET `/ready`. Set `DATABASE_URL` only when the process should observe PostgreSQL for readiness, and set `HEALTH_BACKLOG_HEALTH=within_bounds` only after backlog is actually measured. A down store must not take `/live` with it.
+
 ## Architecture authority and implementation status
 
 An accepted ADR must define concrete ownership, interfaces, invariants, failure behavior, security/privacy/tenancy boundaries, migration and rollback, validation evidence, alternatives, and reversal conditions. Material implementation that contradicts an accepted ADR requires an explicit superseding decision rather than silent architectural drift.

docs/DOCUMENTATION_ASSESSMENT.md

@@ -31,7 +31,7 @@ This reconciliation closes those architecture-definition gaps without promoting
 | Quality / risk / compliance readiness | **Sufficient as assurance baseline** | Evidence scenarios and risk state are explicit; readiness is not certification. |
 | Traceability | **Repaired in this reconciliation** | Baseline now names exact protected-main `748876…`, marks newly merged domain modules Implemented/Partial, and isolates PR #24 as Active PR. Must be updated after every material merge. |
 | Roadmap / agent guidance / changelog | **Sufficient for continued delivery** | Must remain code-current; documentation completion is not a terminal condition for the execution loop. |
-| Machine-readable OpenAPI / AsyncAPI | **Not yet applicable as as-built evidence** | Add and validate with the first implemented HTTP/event transport. Do not publish aspirational operations as deployed. |
+| Machine-readable OpenAPI / AsyncAPI | **Active PR for operator health probes only** | `openapi/health-probes.yaml` lists GET `/live` and GET `/ready`. Public/admin product routes and AsyncAPI remain unimplemented and must not be listed as deployed. |
 | Physical schema / as-built topology | **Partial / implementation-gated** | Logical ERD is authoritative target semantics. Actual migrations/topology/rollback/restore evidence must be compared to it as those artifacts land. |
 | Instrument-release evidence bundles | **Target** | Every publishable consumer instrument needs immutable rights, locale/translation, scoring/calibration/norm, DIF/invariance/linking where claimed, scoreability, intended-use and narrative-rule evidence. |
 

docs/OPERABILITY.md

@@ -44,6 +44,8 @@ The implementation must distinguish at least:
 
 Readiness must not fail solely because an optional capability is unavailable if the selected operation can safely proceed without it. Conversely, a process can be live while not ready to accept new state-changing requests.
 
+Operator HTTP probes, when implemented, are GET `/live` and GET `/ready`. `/live` answers process liveness only and must not perform store I/O; a hung or failed PostgreSQL connection must not restart a still-live process. `/ready` answers operation-scoped readiness and may name required capabilities as repeated `capability` query parameters. When the PostgreSQL adapter answers a bare GET `/ready` (no `capability=`), it requires `postgres_operational_store` so a read-only or unsupported store cannot advertise readiness to a load balancer. These probes do not publish measured SLO values. A bound TCP listener, when present, serves those same operations in a blocking accept loop until accept fails, or one request per accepted connection. Interrupted, aborted, or reset accepts retry, including `ConnectionReset` before `accept` returns, matching TCP reset processing in RFC 9293. A dropped probe connection does not stop later probes. It applies a bounded read/write timeout, rejects oversized requests without echoing them, and is not a measured availability claim. PostgreSQL observation happens after accept and only for GET `/ready`. Probe failure is unknown/unready and must not expose driver errors. Unsupported methods and paths use explicit `urn:psychometrics-commons:problem:` types rather than `about:blank`. Operators start the probe process with `run_health_process` after setting `HEALTH_LISTEN_ADDR` or platform `PORT`. Optional `DATABASE_URL` is observed only for GET `/ready`. Optional `HEALTH_BACKLOG_HEALTH` must be `within_bounds`, `stalled`, or `unknown`; missing backlog stays unknown and not ready. Point liveness at GET `/live` and readiness at GET `/ready`. Do not treat a single `accept_one_*` call as a running probe server.
+
 ## 4. Capability degradation matrix
 
 | Dependency/capability failure | Required product behavior |
@@ -229,6 +231,12 @@ Never collapse these maturity levels. SOC 2/CSAP readiness work may map evidence
 
 ## 15. References
 
+Eddy, W. (Ed.). (2022). *Transmission Control Protocol (TCP)* (RFC 9293). Internet Engineering Task Force. https://doi.org/10.17487/RFC9293
+
+Fielding, R., Nottingham, M., & Reschke, J. (Eds.). (2022). *HTTP Semantics* (RFC 9110). Internet Engineering Task Force. https://doi.org/10.17487/RFC9110
+
 International Organization for Standardization & International Electrotechnical Commission. (2023). *ISO/IEC 25010:2023 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Product quality model*.
 
+Kubernetes Authors. (2024). *Configure liveness, readiness and startup probes*. Kubernetes Documentation. https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
+
 National Institute of Standards and Technology. (2022). *Secure Software Development Framework (SSDF) Version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST SP 800-218). https://doi.org/10.6028/NIST.SP.800-218

docs/QUALITY_ATTRIBUTES.md

@@ -68,6 +68,12 @@ This document converts broad quality goals into **stimulus → environment → r
 - **Response:** completed response snapshot remains durable; scoring job waits/retries; no invented score.
 - **Evidence:** worker/job state and recovery test.
 
+### QA-AVL-04 — Operational store down during health probes
+
+- **Stimulus:** `DATABASE_URL` is configured and the operational store refuses connections while the health-probe process is running.
+- **Response:** GET `/live` remains HTTP 200 without store I/O or driver text; GET `/ready` returns HTTP 503 without echoing the URL or driver error.
+- **Evidence:** `tests/health_process_contract.rs` unreachable-store listener contract.
+
 ## 4. Security
 
 ### QA-SEC-01 — Cross-tenant object reference