An ECS task behind an ALB starts failing its target group health check on /health. What does the ALB itself do?

The ALB stops sending new requests to the unhealthy target and keeps checking it until it passes again. A load balancer only decides where to send traffic.

"It terminates the task and starts a replacement" is the ECS service's job, not the ALB's. ECS does this when the service is set to use the load balancer's health checks.

"It returns 503 for all requests until the target recovers" is also wrong. If every target is unhealthy, the ALB fails open: it sends traffic to all of them anyway.