check blocks, and the assertion that runs after apply

A runbook step that said “confirm the health endpoint returns 200 after applying” is an assertion, and assertions belong in the tool.

check "health" {
  data "http" "app" {
    url = "https://${var.hostname}/health"
  }

  assert {
    condition     = data.http.app.status_code == 200
    error_message = "health endpoint returned ${data.http.app.status_code}"
  }
}

A failing check is a warning rather than an error, which is the design decision that makes it usable — an assertion about something outside the configuration should not block an apply that succeeded. That also means CI has to look for it explicitly, because the exit code is zero. Precondition and postcondition blocks remain the right tool for invariants about the resources themselves.