CT-log ingestion freshness (public status-page scrape target)

Ingestion freshness across tracked CT logs. Public, unauthenticated, and cached server-side for 30 s so the managed status page can scrape it on a 1-minute cadence.

The freshness SLI is p95_backlog_entries — the 95th percentile of per-log ingestion BACKLOG (entries a log has published that CertIndex has not ingested, GREATEST(0, tree_size - last_index)). 0 means we are level with the CT log heads.

*_advance_age_seconds (and its deprecated *_lag_seconds aliases) is a SECONDARY quantity: seconds since a log last delivered new entries. It is per-log-useful for spotting a log that went dark, but it is NOT ingestion lag — CT logs are temporally sharded, so a shard whose expiry window is still in the future is structurally quiet and its advance age grows while its backlog stays 0 (GH #292).

aggregate_scope names the population the percentiles describe. stale_logs counts logs with a frozen cursor for an unexpected reason (not retired from the CT log list); retired_logs counts logs frozen by design. logs provides a per-log breakdown of both quantities, sorted worst-backlog-first. straggler_alert judges backlog, and straggler_criterion publishes the exact threshold and inputs it evaluated.

visibility_latency_p95_seconds_24h (issue #360) is a rolling 24h aggregate of the live 1h p95 above, pre-computed by a beat job into freshness_rollup_24h and read here via an indexed lookup — the stable figure to quote as an SLA number, since the 1h window alone is too volatile hour-to-hour. rollup_sample_count reports how many of the expected 96 samples (24h at 15-min cadence) actually exist; a low count means the rollup job is degraded or newly deployed, independent of whether the 24h figure itself is populated.

Two latency cohorts on one payload: visibility_latency_* measures live ingestion (issue → index) for recently issued certs; backfill_latency_* measures catch-up hydration (logged_at → first_seen) for the backfill cohort. Neither replaces p95_backlog_entries as the ingestion SLI. Historical logged_at NULL tail progress (sample_estimate, not coverage/SLA) is published separately at GET /v1/status/logged-at-backfill.