Safety

It writes production configuration and reloads a live master, so correctness and fail-safety matter more than anything else it does. Two things to read:

• How it fails safe: the guarantees around every write: sandbox validation, atomic replacement, graceful reload, rollback, and crash recovery.
• The trust boundary: what it trusts, what one tenant on a shared host can and cannot make it do to another, and what bounds it.