Read owned-state checks

stella doctor list lists the local plugin engine’s checks. It does not query service doctor-check/v1 catalogs and does not list OwnedStateSizeBudgetCheck. The plugin engine uses IDoctorCheck; installed services register these storage checks through the separate IServiceDoctorCheck contract.

Surface	What it returns
`stella doctor list`	Checks available to the local plugin engine
`GET /doctor/{service}/checks`	Live SDK results from that service, including its registered owned states
`GET /api/v1/platform/doctor/capabilities`	Registered capability claims and heartbeat freshness; not measurement results
`GET /api/v1/platform/doctor/aggregate`	Results pulled from registered services, with per-service errors and freshness

The HTTP read surfaces require an operator token with ops.health. Use the gateway origin for your installation. In the local estate, for an existing token exported as STELLAOPS_OPERATOR_TOKEN:

curl --fail-with-body --silent --show-error \
  -H "Authorization: Bearer ${STELLAOPS_OPERATOR_TOKEN}" \
  https://stella-ops.local/doctor/scanner-web/checks

curl --fail-with-body --silent --show-error \
  -H "Authorization: Bearer ${STELLAOPS_OPERATOR_TOKEN}" \
  https://stella-ops.local/api/v1/platform/doctor/aggregate

For a direct response, verify contractVersion, service and checks. Owned states appear in checks[].evidence["state.id"]. Read these fields together:

state.kind: the storage technology or boundary being measured.
state.size.bytes: the completed byte measurement.
state.size.budget-bytes and state.size.utilization: present for a valid positive configured budget; utilization is a ratio, so 0.800 means 80%.
healthy, severity and message: the check result, including measurement failure.

A missing budget field means the SDK result is unbudgeted, even when healthy is true. It does not prove that a write-admission budget is configured correctly. The Scanner and OfflineKit write guards separately reject invalid declared budgets. Use the sizing guide and the owner procedures.

The aggregate is limited to registered services. A missing service is not a zero-byte measurement. Inspect each services[] entry’s stale, error and results; HTTP 200 can contain failed pulls. Query the service directly when its registration is absent or stale. The capability catalog records claims, not executed checks. A Console HTML fallback is also not a Doctor result, even if its HTTP status is 200.

Verified against source f4629743479525a79f7c6ccc59f1ecd953c25217: DoctorCommandGroup.ListChecksAsync, DoctorEngine.ListChecks, DoctorCapabilityEndpoints, DoctorAggregateService and OwnedStateSizeBudgetCheck. Repeat the HTTP reads above with the authorized token and confirm the response shape and service identity. The dated acceptance receipt records 401/403/200 controls for all three HTTP surfaces. At that observation, Scanner returned four owned states directly but was absent from the nine-service aggregate catalog; six aggregate pulls failed and one service was stale. Those dated counts demonstrate the coverage limits, not current estate health.