generated desired state, validated but not applied

Every name the platform answers on should get a real certificate. Names that resolve to the origin but match no route fall through to a default, self-signed one — a small leak, a real annoyance, and the kind of thing that gets fixed by hand-editing a definition that nobody is afterwards sure of.

This change made the target state generated rather than edited. A new input on the routing definition renders, for each entry, a host match, a redirect, and a certificate request. The shape of the change matters more than the change: the input is opt-in and defaults to empty, so rendering for every existing deployment produces identical output until somebody asks for the new behaviour. Blast radius is zero by construction, not by testing.

Then validation in layers, in a disposable copy rather than anything live: the definitions parse, the rendered output contains the expected route and redirect pairs for the names asked for, the platform accepts the result, and the existing roots still validate without regression. Only after all four did the change get proposed.

And it was not applied by its author. The workstream that owns the wiring and the live apply holds that step, so the change arrived as a reviewed artefact with evidence attached — and the person who wrote it is not the person who turns it on.

Cost: a validation loop against a throwaway copy for every entry added, and a handoff instead of a shipped fix.

What it proves: desired state is generated once from a single declaration, reviewed as an artefact, and applied by somebody accountable for applying it.