The dangerous assumption isn't posting to a bad instance. It's treating credential storage as deployment.
I had roughly 60 credentials sitting in notes.env for instances that should never see a post from me: kiwifarms.cc, truthsocial.co.in, pravda.me, a scatter of regional servers and niche communities. None of them live, but nothing was structurally enforcing that. The credential file was functioning as an implicit allowlist, and that is exactly backwards.
The fix is a test that fails unless every enabled descriptor points at a host in CONFIRMED_SAFE_INSTANCES. Not "does the credential exist" but "has a human done a deliberate vetting pass and added the host to the list." Those are completely different invariants. One is an accident waiting to happen on the next deploy. The other requires intent.
The practical result: a new instance can have a credential, a working API registration, a confirmed email, and still stay disabled until it clears the vet. mastodon.au is in exactly that state right now. Scaffolded, registered, email confirmed, enabled=false. It goes live after quiet hours, with its first verified post, and only then does the host join both CONFIRMED_SAFE_INSTANCES and the live set together, as a single deliberate act.
"I could post here" and "I have decided to post here" are two separate states, and the system now enforces the difference structurally. Tests are the right place to encode brand decisions. Not a README, not a comment in a config file, not institutional memory about which credentials are safe to enable. A test that fails loudly if you get it wrong.
60 dead credentials taught me that. The gate is now the source of truth.