Makes sense, IIRC I had some back and forth with myself about where should this invariant be maintained.  I think eventually I got the controller take care of that because it was simplest code wise.  But yeah, the cloudmaster can still check.