# Revert Health Check Status Controller

## Background

Clinic PR #1706 was merged as `8e9a4ced` and coupled Health Check migration 97
to Clinic API startup. The production Clinic rollout failed before the HTTP
server became available, leaving Kong without a ready peer. app-delivery was
rolled back to the known-good Clinic image, but the faulty source commit remains
on `master`, so a later Clinic deployment from `master` could repeat the outage.

PR #1712 removes the startup DDL path, but it deliberately retains the new
Health Check runtime contract and therefore requires the target database schema
to be prepared first. The staging database DDL and markers have been applied,
with final physical verification still pending; an unrelated production
deployment must not be blocked on rushing #1712.

## Goal

Restore `master` to the pre-#1706 Health Check runtime and schema contract so an
urgent Clinic deployment cannot execute migration 97 during startup. Preserve
later unrelated master changes, including #1713.

## Target Contract

- Revert the runtime source, generated API documentation, and feature tests
  introduced by squash commit `8e9a4ced`.
- Retain the existing generic CI disk cleanup and adapt the restored Health
  Check tests to use local mocks. These test-only safeguards do not ship in an
  image and prevent the rollback PR from restoring known non-hermetic failures.
- Do not drop or otherwise roll back database columns, indexes, tables, or
  migration markers already added through the independent database process.
- Do not merge PR #1712 on top of this revert. The forward implementation must
  later be rebuilt from the reverted `master` after the database-first rollout
  is ready for every target environment.
- Restore the previous Health Check status behavior, accepting that the original
  list/detail status defect temporarily returns.

## Affected Modules

- Root Go module Health Check API, DB models/migrations, Internal API adapter,
  configuration, and task-manager Health Check job packages.
- Executables and images whose source changes: `cmd/server` / `clinic`,
  `cmd/internal_server` / `internal_api`, and `cmd/task_manager` /
  `task_manager`.
- Generated Clinic API Swagger artifacts and focused Health Check test fixtures.
- The repository's existing generic runner disk cleanup remains unchanged.

The repository module-to-image and app-delivery ownership mapping is unchanged,
so `docs/clinic-module-overview.md` does not require modification.

## Implementation

1. Start from the latest `origin/master`.
2. Revert squash commit `8e9a4cedfe825495b10e3d6bd6c5aece155079f3`.
3. Retain only its generic runner disk cleanup and make the restored legacy
   tests hermetic with existing in-memory repositories and fixed URLs.
4. Inspect the complete diff to ensure later #1713 log/NGM changes remain and no
   unrelated runtime source is changed.
5. Add this rollback plan without introducing any Health Check-specific CI or
   database operation.
6. Run focused tests, formatting/diff checks, and repository CI.

## Compatibility and Exclusions

The previously added database objects are additive. Old application models
ignore extra columns, and old writes use the compatible defaults, so the
database is intentionally left as-is. The controller was not enabled in
production, so no protocol-v2 writer is expected to have produced rows.

This rollback does not change producer/inspection-item services, app-delivery,
Kubernetes configuration, or any database contents. It does not attempt to fix
the original Health Check status bug and includes no pressure or load test.
Because #1706 bundled the controller redesign with Task Manager safety and
observability changes, the emergency runtime rollback also restores the prior
response-reading and logging behavior. That legacy behavior is an accepted
temporary tradeoff and must be reconsidered when the feature is reintroduced.

## Validation

- `go test ./pkg/api/healthcheck ./pkg/api/internal_api ./pkg/db ./pkg/task_manager/task/healthcheck ./pkg/config -count=1`
- `git diff --check`
- Confirm migration 97, the controller scanner, protocol-v2 fields, and
  list/detail pure-read behavior from #1706 are absent from the final source.
- Confirm #1713 files retain their current `master` content.
- Confirm the PR's normal repository CI passes.

## Release Boundary

Creating and merging this source PR does not deploy production. If the urgent
release is `components=clinic`, deploy only the exact post-revert `master` SHA
through Clinic CD and the normal reviewed app-delivery PR. Do not use
`components=all`.

Production `internal-api` must not be replaced from `master` while the behavior
currently supplied by open PR #1700 is absent. There is no reason to replace
`task-manager` as part of this emergency rollback because the known-good version
is already running and the Health Check controller must remain disabled.

Required deployment modules for an authorized Clinic rollback release:

- Clinic CD `environment=prod-cloud`, `components=clinic`;
- app-delivery application `clinic-api`;
- Kubernetes `Deployment/clinic`.

Staging and production deployment, app-delivery merge, and source PR merge each
remain separate authorization boundaries.