> **Relayed** to mgf-cloud-provision#PAPER-02 by the supervisor (FB-05).

### PAPER — self-heal crons POST success-heartbeats to OO; watcher pages on staleness (PAPER-111 signal)

- **Severity:** 🟡 Sharp edge
- **Filed by:** mgf-standard (PAPER-111 investigation) on 2026-07-10
- **What hurts:** healthy reconciler runs are **silent by design** (its log
  cannot distinguish "healthy" from "cron dead"), `self-heal.sh` logs only
  locally, and the estate watcher (agent2) probes uptime only — so a dead
  safety net pages nobody (proven: the 17-day 401 outage above). MGF_INFRA §5
  already names the mechanism ("the self-heal signals as they migrate" to the
  `backup_heartbeats` stream); it just isn't implemented.
- **Suggested shape:** (a) both crons POST a success-only heartbeat record
  (`job=agent-reconciler` / `job=self-heal`) to the OO `backup_heartbeats`
  stream via the existing `/etc/mgf/backup-heartbeat.{url,token}` root-600
  files; (b) `estate-watch.sh` gains the freshness check MGF_INFRA §5 already
  plans (stale > N → page), with N ≈ 30 min for the self-heal jobs vs 26 h for
  backups; (c) optionally the watcher also probes `GET /api/queue/info`
  directly once an admin credential exists on agent2 — until then the
  heartbeat-staleness route needs no new secret distribution.
- **Status:** OPEN
