The monotone lifecycle
Entries are write-once, and every state change moves an entry closer to destruction, never further. Read budgets only decrement. Claims only resolve. Expiry only arrives. Nothing can argue an entry back from the brink, because an entry that can be extended is a retention liability, not a stash.
What this rules out
There is no touch(), no TTL extension, no metadata update. Mutable expiry is the right call for a cache -- cache entries are hints -- and the wrong call here, where an entry's terms are a promise made at push time. New terms mean a new push. The rule also decides future features on sight: anything that would let an entry outlive its terms is rejected.
Rejection over eviction
The same posture governs capacity. A cache evicts the oldest entry to make room; a stash that did so would turn a push flood into an attack on other people's data. When full, push fails loudly with StashFull -- the rejection is the feature, because stash entries are promises, not hints.