Today a box with no CARLOSSECRETSKEY, or the wrong key, still admits and wakes socket-backed shared-pool instances in its region. Its config sync loop is disabled, and instanceEnv (internal/activator/backend_exec.go) treats a missing <host>.config.env as optional, so the instance starts without its secrets or store config. kpmg's 1h54m outage on 2026-10-01 was this failure: the UK box had no key.
The nearest-region branch (design-nearest-region) tried to keep automatic placement away from such boxes from the console side. Its eligibility requires every live box in a region to publish a matching secretskeyfp. Four Astra rounds each found another way for what boxes publish to diverge from what reconcile admits:
- partial reads;
- unmatched objects;
- label collisions (separate discussion);
- a live box whose status writes fail and so reads as retired;
- a stale published
serves_shared_pool: false. The console cannot prove what reconcile will admit. The invariant belongs at admission.
Proposal: a box takes an instance's lease, or mints its record, only if it can provide that instance's config:
- it has a parseable CARLOSSECRETSKEY;
- the app/instance has sealed config in the store that this key opens, or it has none. Otherwise it refuses, logs once per host, and publishes the refusal (e.g. in the status snapshot), so a keyed sibling takes the lease and the operator sees why.
A deployment with no sealed config anywhere (dev) is unaffected. Instances whose config this box cannot open stay down rather than starting without secrets, which is the correct failure.
This gates turning CONSOLEAPPREGIONS on, alongside the host-lifecycle claim (#199, for the leftover-data rail). The nearest-region branch merges with the switch off. Ledger: .superpowers/sdd/2026-10-02-nearest-region-default/progress.md, "Ruling (adjudication, breaker)".
amadan