1 files changed, 24 insertions, 0 deletions
diff --git a/scripts/lib/site-checks.sh b/scripts/lib/site-checks.sh
index f6ac55c..4f46acd 100644
--- a/scripts/lib/site-checks.sh
+++ b/scripts/lib/site-checks.sh
@@ -108,6 +108,30 @@ check_routes() {
     return $rc
 }
 
+# Is the app actually serving, not merely listening?
+#
+# /health pings the database rather than returning an unconditional 200. During
+# the 2026-08-04 incident a liveness stub stayed green for three days while
+# every DB-touching request path was wedged, which is why it was changed. The
+# gateway route checks above would not catch that: `/` answers 303 to the login
+# page without going near the database.
+APP_HEALTH_URL="${APP_HEALTH_URL:-http://127.0.0.1:38080/health}"
+check_app_health() {
+    local code
+    # Two attempts a few seconds apart — a single blip should not be reported as
+    # an outage, and the caller may act on this by restarting the service.
+    for attempt in 1 2; do
+        if ! code=$(curl -sS -o /dev/null --max-time 10 -w '%{http_code}' "$APP_HEALTH_URL" 2>/dev/null); then
+            code="000"
+        fi
+        code=${code:-000}
+        [ "$code" = "200" ] && { _chk_pass "app health (db ping) -> 200"; return 0; }
+        [ "$attempt" = "1" ] && sleep 5
+    done
+    _chk_fail "app health (db ping) -> ${code}"
+    return 1
+}
+
 # Does the running binary report the commit we expect? Only meaningful right
 # after a deploy, so it is optional.
 check_build_stamp() {