health monitor (ops-18/19): spend/disk/task-queue thresholds -> staff alerts, edge-triggered, opt-in

DECISIONS.md

@@ -60,6 +60,16 @@ Decisions inside the set architecture. D-NNN, never renumbered.
   broken classifier must never mute the bot; the budget gate already
   bounds spend. Its verdict gates BEFORE the main call, the
   envelope's answer_needed still gates after — two independent nets.
+- **D-021** — Health monitoring (FDB-012, SPEC-012 OPS-18/19): a
+  separate `monitor_loop` (own cadence, default 300 s) rather than
+  folding checks into the 60 s task loop — monitoring is coarse and
+  should not run every minute. Checks are edge-triggered (alert on the
+  rising edge, re-arm on recovery) so a standing condition never spams;
+  they reuse the existing rate-limited staff-alert path. Metrics are
+  the cheap, high-signal ones (spend vs budget, free disk, task-queue
+  depth); each is independently skippable when it has no data, so a
+  deployment without a budget or store still runs the others. Opt-in
+  (`enable-monitoring`) like every other operational rollout.
 - **D-020** — Web search via Exa (FDB-022, SPEC-015): a `web_search`
   tool alongside fetch_url/IGDB/codex/get_news, filling the "look it up
   on the open web" gap. Exa (not a raw search-engine scrape) because it