The client reads their own logs at a URL you never built

The client asks "is it running?" on a Saturday. The honest answer lives in a process manager on a box only you can reach, so the honest answer arrives Monday.

The app runs as a daemon program in the client's container, with stdout_logfile and stderr_logfile set in its JSON. That gives it two URLs the client can hold. GET /api/v1/daemon/status/{id} returns RUNNING, a PID and an uptime like 2:15:30. GET /api/v1/daemon/programs/{id}/logs returns what the app said last. Both go in the handoff document, under "Is it up?" and "What is it saying?". Proxy permissions decide who can open them; nothing else about the deployment changes.

Saturday's question gets answered by the process manager, at a URL, by the client, without you.