Host→service placement as data (endpoint-resolver config), shared
probeK8sHealth for check/system-health and joelclaw status, hostname
normalized before lookup. On non-hosting hosts kubectl never executes
and k8s never enters degraded/criticalDown/system.fatal. Remote tailnet
probing deferred (flagg has no panda kubeconfig). Worker-built,
steering-reviewed: 23 targeted tests, tsc green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
shitratgit[bot]