System health & diagnostics

Every workspace admin gets a self-serve diagnostic at /app/system-health. The page is read-only — it does not call any external API and cannot mutate state — and it surfaces the four config gaps that account for ~90% of "the bot isn't working" support tickets:

1. LLM provider — resolves the bound OpenAiClient. Green when Workers AI / OpenAI / OpenRouter is configured. Red when the deterministic FakeOpenAi is in play (no real provider).
2. Cloudflare creds — checks CLOUDFLARE_ACCOUNT_ID + CLOUDFLARE_API_TOKEN. Amber when only one is present; green when both are.
3. Embedding fallback — checks OPENAI_API_KEY. Amber when missing: the install works on the happy path but the next Workers AI rate-limit will halt indexing.
4. Queue worker — surfaces the queue driver, pending count, and failed-job count. Amber when queue is sync (fine for dev, broken for prod where SSE + crawl jobs need their own workers).

Source-level problems

Beneath the four cards is a list of every Source in the workspace whose status is failed or stuck on crawling, ordered by most recently updated. IndexDocumentJob stamps the exception class name into each row's error column, so the admin can tell a rate-limit ([OpenAiRateLimitException]) apart from a bad-request ([OpenAiBadRequestException]) apart from a Cloudflare 40040 (Vectorize provisioning lag).

Access control

Workspace owners + admins can load the page; viewers get 403. The sidebar entry under "Run your workspace" only appears for users who can see the route.