Purpose-bound Caddy observation (server) using the existing fresh Stack-Monitor. Returns stack_caddy_decision, direct versus inferred status, evidence, optional version difference against a caller-owned baseline and reusable snapshot. Missing fingerprints do not prove absence. No background scheduling, CVE, compatibility or installed-extension inventory. Existing outbound safeguards remain in the injected motor. One public HTTPS root domain, up to150 baseline technologies; 9s timeout.