The section on the stats callback firing while the broker is unreachable stood out to me — a health check that only looks at "did the callback fire recently" would happily report healthy during a disconnect. Parsing the broker connection state off-thread feels like the crucial half of this pattern that most write-ups skip.