A status surface must never show green for a state it cannot prove. Five independent fail-closed fixes plus five silent excepts that now leave a log line: - doctor: new blocker `journal_maint_tasks` check surfaces failed and stuck maint tasks (unreadable state -> warn, no local journal -> skip), so a startup migration stuck in "failed" is no longer invisible. - pipeline_health: summarize_pipeline_day no longer returns "healthy" on a raised scan or on a past captured day with no health dir -- both now yield status "unknown" with a segments_not_thought marker that steward and home react to; genuinely idle days (no captures) stay healthy. - convey init wizard: init_finalize reports degraded secure-listener startup via a warnings envelope, surfaced in init.html before the redirect; local setup still succeeds. - convey /init/validate-provider: map provider verdicts through the bounded provider_readiness presenter -- no raw exception text at HTTP 200 (verdict carries a bounded `message`, not raw error); genuine dispatch failures return a non-2xx envelope (PROVIDER_VALIDATION_FAILED). - five silent excepts (convey/apps, observe/sense, think/models, think/capture_health, speakers/status) now emit a log line; behavior otherwise unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>