Day-two operation of a CA is a short list of habits, each catching a different way things rot quietly:
| Continuous | CRL freshness and publication convergence — the artifacts relying parties actually fetch. |
| Nightly | GET /v1/audit/verify?limit=0 — alert on anything but intact. Plus a verified backup, restored on rehearsal schedule. |
| Daily | The request queue filtered to failures from the last day. Failures are ordinary outcomes one at a time and a pattern in aggregate — the detail column is what makes the pattern visible. |
| Weekly | Open ceremonies nobody has touched in seven days. An abandoned ceremony is a key operation somebody stopped halfway. |
| After any ceremony, rollover or root change | An event-driven backup — the moments a nightly cadence exists to miss. |
| Quarterly | Access review: who still has a default binding, who can still log in, which recovery-code counts are low. |
| Per release | Read the release notes, then re-read the manual chapters they name — the manual ships with the release it describes. |
Now I have a duty cadence instead of a vague sense of responsibility.