Hosting answers a cid miss, cid mismatch, missing manifest, storage outage or updating marker with a deliberate no-store 503, and none of them were logged: caddy showed bursts of hundreds of 503s with nothing to say which site or why. Each returned 503 now carries its reason and revalidate outcome, and a windowed aggregator logs one "[FailClosed] 503 summary" line per (did/rkey, reason) every 60 s with the count, first/last time and enqueued/deduped counts. Distinct sites are capped at 500 per window, the rest count under "other"; the timer is unref'd and the partial window flushes on shutdown. No paths, query strings or client addresses are logged.