amadan
Box labels collide: 1,600 possible labels, and colliding boxes overwrite each other's edges file and status snapshot open
status.Label (internal/status/snapshot.go) maps a machine id to one of 40 names x 40 actions = 1,600 labels. Box object keys use the label: control/edges/<label>.json and status/boxes/<label>.json. Two boxes with the same label overwrite each other's objects.
Birthday odds: about 0.4% for a 4-box fleet (flagship), about 1% for 6 (Tito), about 6% for 20. Astra found a concrete pair: machine ids 00000000000000000000000000000018 and 0000000000000000000000000000003c both give edsger-knitting.
Effects when it happens:
- edgesfile.EdgeIPs sees one box's EIP and loses the other's, so a live box's address can drop out of the edge set.
- The fleet status page shows one box where there are two.
- The nearest-region branch's automatic eligibility (design-nearest-region, internal/console/instancesplacement.go) joins edges files to status snapshots by label. A keyed box overwriting a keyless sibling's edges file makes the region look fully eligible. That branch merges with CONSOLEAPPREGIONS off, and this is one of the reasons it stays off.
The edges writer's unchanged-file gate (internal/host/edgesfile.go) can leave the wrong box's version in place indefinitely.
Fix sketch: keep the public label for display, but key the objects by a collision-resistant id (a longer digest of the machine id, still non-reversible), carry it inside both objects, and reject a duplicate as incomplete evidence. A migration has to read both key shapes for one release.
Found by Astra (codex) in the nearest-region final review, round 3: .superpowers/sdd/2026-10-02-nearest-region-default/final-rereview-r3.md on the design-nearest-region worktree.