What this page is actually checking

Most of the protections in this system fail open when the key-value store is unreachable, and every one of them is right to. A KV outage must not drop a Stripe webhook, refuse a paying member, or break a checkout. But fail-open has a property that is easy to miss: it is invisible. Nothing errors, nothing logs, and the system looks completely healthy while running without the guarantees it normally has.

So the interesting question is not “is the site up” — you can see that by loading it. It is which guarantees are currently in force. That is what the degraded array reports, and it is why this page leads with it rather than with a green tick.

• Reading…

What “degraded” covers

When the store is unreachable these are the guarantees that quietly stop applying. The behaviour is deliberate in every case; the point of naming them is that you can tell when they are in force and when they are not.

• Webhook idempotency. A retried Stripe event can re-run a side effect.
• Distributed rate limits. Every cap falls back to per-instance counting, which across serverless instances means effectively no cap.
• Entitlement caching. Every gate re-walks Stripe on each request. Slower, not wrong.
• The trial gate. A used trial can no longer be remembered.
• The upsell cooldown. A once-per-six-hours prompt becomes once per question.

What this page is not

It is a live reading, not an uptime history — there is no ninety-day bar chart here, because we do not yet retain ninety days of readings and a chart drawn from anything less would be decoration. There is no published SLA on the self-serve plans; Enterprise is where an SLA and a named contact are written down. If you need historical availability evidence before you buy, ask and we will tell you what we actually have.

The raw payload, unchanged, is at:

Related: how we handle missing data · the error contract · the MCP & API