[epic] ActiveSync operations monitor (CLI + admin signals) #99

Summary

Operator-facing ActiveSync operations monitor: live “top-like” CLI plus health signals on the existing Horde admin device page. Shared read-only health model — not a protocol-library dashboard.

Design (to be committed with docs issue): doc/ops-monitor.md in horde/ActiveSync.

Goals (v1)

1. Which devices are active right now?
2. Which sync keys / collections look stuck?
3. Where are loop-guard / heartbeat problems concentrating?
4. How to jump from a bad device to per-device logs and admin actions?

Non-goals (v1)

• Historical metrics / alerting / webhooks
• HTTP 503 / X-MS-Throttle
• Replacing logging.type = perdevice
• Mutating protocol behaviour
• CLI wipe/block (Web already has those)

Architecture

CLI-first for live watch; Web reuses the same snapshot. CLI ships with the install (horde-* family), not via optional hordectl.

Implementation order

A (evaluator) → B (snapshot) → C (summary/show) → D (top)
                              ↘ E (admin UI)     → F (docs)

Follow-ups after v1 use: G (request touchpoints), H (log-scan).

Sub-issues

v1

• A feat(ops): device/collection health evaluator and DTOs #100 — health evaluator + DTOs
• B feat(activesync): ops snapshot service over State + SyncCache Core#216 — snapshot service
• C feat(activesync): horde-activesync summary and show base#145 — horde-activesync summary|show
• D feat(activesync): horde-activesync top watch monitor base#146 — horde-activesync top
• E feat(admin): ActiveSync ops health badges on device admin base#144 — admin health badges
• F docs(ops): link ops-monitor design from todo and README #101 — docs / todo links

Follow-ups

• G feat(activesync): optional last_command / in_flight request touches Core#217 — optional request touchpoints
• H feat(activesync): optional per-device log error sampling base#147 — optional log error sampling

Closed (wrong home)

• hordectl#20–22 → moved to horde/base #145–#147

Epic acceptance

• horde-activesync top --watch shows active vs stuck during real Ping/Sync
• summary exits non-zero on critical health (cron-friendly)
• Admin device page shows the same signals without duplicating rule code
• Per-device logs remain the deep-dive path
• No protocol behaviour change; no DB migrations for v1

Target

Additive on FRAMEWORK_6_0. Keep the read model thin so FRAMEWORK_6_1 storage work can make fleet queries cheaper later.