Observability and diagnostics

Operational endpoints expose bounded counts and database size without returning credentials, record bodies or session tokens.

GET /system/health
GET /system/ready
GET /system/version
GET /admin/v1/operations

The first three endpoints are deliberately narrow. The authenticated operations summary includes collection, file, session and event counts plus the SQLite page-derived size.

Logging

Every HTTP request receives an X-Request-ID and a structured completion log. Audit facts retain the same identifier for supported mutations. Logs are operational evidence, not a substitute for backups or durable metrics.

Retention

Keep logs and exported audit facts according to the deployment's privacy and incident-response requirements. Avoid indefinite retention by accident.

Provider storage

The operations summary reports provider facts on both engines: SQLite reports page-based database size and PostgreSQL reports pg_database_size(current_database()), with bounded object counts and the audit boundary note.