core: BoxCheckOutdated is *much* simpler, unified logic, tests