Check 5 is the one that would have saved me the most trouble. I have seen a renewal succeed on disk while the server kept serving the old certificate, and the only reason it was caught was an outside check, not the renewal log. Comparing serials on disk and on the wire is a simple, concrete test, and the point about certbot dry runs not executing deploy hooks unless you add --run-deploy-hooks is the kind of detail that is easy to miss until it bites you. With certificate lifetimes shrinking toward 47 days, the margin for a silent failure like that is only getting smaller. Thanks for laying out the checks with what each one does and does not prove.