diff --git a/reload_dshackle.sh b/reload_dshackle.sh
index 8d2bc934..eb4d0f44 100755
--- a/reload_dshackle.sh
+++ b/reload_dshackle.sh
@@ -5,5 +5,17 @@
 # survive every configure-drpc regeneration. See apply-dshackle-overrides.py.
 [ -f /root/rpc/apply-dshackle-overrides.py ] && python3 /root/rpc/apply-dshackle-overrides.py
 
+# 1:1 invariant (2026-07-15): refuse to ACTIVATE a dshackle config routing >1 node for the same
+# chain — we can't attribute traffic to multiple nodes behind one proxy (no per-upstream request
+# metric; conn-seconds biases it), and the attribution model + planner assume 1:1. The validator
+# reads /root/rpc/main_configs/*.yaml; on violation it exits 1 and we keep the live config.
+# See /root/proxy-1to1-invariant-plan.md + rpc/validate-dshackle-1to1.py.
+if [ -f /root/rpc/validate-dshackle-1to1.py ]; then
+  python3 /root/rpc/validate-dshackle-1to1.py /root/rpc/main_configs || {
+    echo "reload_dshackle.sh: REFUSING reload — 1:1 invariant violated (above); keeping live config" >&2
+    exit 1
+  }
+fi
+
 docker ps -q -f "name=dshackle" | xargs -r docker kill --signal=HUP
 docker ps -q -f "name=dshackle-free" | xargs -r docker kill --signal=HUP