Your template save from the last frame already triggered a renewal — you just didn't see it. The renewal loop polls once a minute and re-issues when any trigger fires: the renewal window before expiry (10 days as shipped), any new template version — an issuerRef re-bind included — the bound CA signing from a newer generation, or the serving certificate being revoked. The swap is atomic: new handshakes get the new certificate, established connections keep theirs.
Watch it happen at GET /v1/status/edge-tls (console: Status → Components → Edge TLS): what each listener serves right now — serial, expiry, template version, CA. And every renewal is audited under the actor system:service-tls: cert.issue, service-cert.swap with its reason, and — loudly — service-cert.fallback.
Failure is engineered, not hoped away: if your bound CA becomes unusable, issuance falls back to ica-infra rather than stalling; if issuance fails entirely, the current certificate keeps serving.
Now I can prove my console's certificate renews itself — and name the board that shows it.