class MemoryProvider(ABC):
    # ... existing methods ...

    def health_check(self) -> tuple[bool, str]:
        """Probe the backing service and report (healthy, reason).

        Default implementation delegates to ``is_available()`` — for
        provider implementations that haven't yet defined a real
        probe, the contract is preserved: the (False, "is_available
        returned False") case still fires when the basic config is
        missing.

        Implementations that CAN probe should override:

          * Return (True, "") when the backend responds successfully
            within a reasonable timeout (default ~5 seconds).
          * Return (False, "<one-line reason>") for any failure.
            Reason should distinguish auth vs network so the operator
            knows which fix to apply (rotate key vs wait / check
            connectivity). Strings like "auth: API key rejected",
            "unreachable: connection refused", "not_found: endpoint
            404", "rate_limited: 429" are good prefixes.

        Must never raise — doctor invokes this in a loop and a
        raised exception would crash the section.
        """
        try:
            return (self.is_available(), "" if self.is_available()
                                          else "is_available() returned False")
        except Exception as exc:  # noqa: BLE001
            return (False, f"is_available() raised: {exc}")

else:
    try:
        from plugins.memory import load_memory_provider
        _provider = load_memory_provider(_active_memory_provider)
        if not _provider:
            check_warn(f"{_active_memory_provider} plugin not found",
                       "run: hermes memory setup")
        else:
            healthy, reason = _provider.health_check()
            if healthy:
                check_ok(f"{_active_memory_provider} reachable")
            else:
                # Classify reason prefix → use existing _classify
                # logic (e.g. utils.classify_http_error analog for
                # message-prefix taxonomy).
                if reason.startswith("auth:"):
                    _fail_and_issue(
                        f"{_active_memory_provider} auth rejected",
                        reason, ...)
                elif reason.startswith("unreachable:"):
                    check_warn(
                        f"{_active_memory_provider} unreachable",
                        reason)
                else:
                    check_warn(
                        f"{_active_memory_provider} health check failed",
                        reason)
    except Exception as _e:
        check_warn(f"{_active_memory_provider} check failed", str(_e))