When a web node is unable to reach any database replica, it should report an unavailable status from /status/.

This would allow a configuration across multiple datacenters (where some replicas are mutually unreachable) to automatically stop sending traffic to web nodes in the bad datacenter after losing services there.

Doing this with SSH might be a little trickier, but you should be able to use the same health check to decide whether to connect to a box over SSH, and I think the configuration in the Phacility cluster (where SSH application servers and Web application servers share the same nodes) is generally a sensible one, so we may not really need more than this.