# Require Private-Only BYOC Management Proof

`cp9 byoc activate` performs a fail-closed network preflight but creates no
dataplane or PrivateLink resources. It resolves the control-plane VPC and subnet
from the remote host, requires the subnet's physical Availability Zone ID to
belong to the BYOC customer handoff, and creates a dedicated session-owned
endpoint security group that admits TCP/443 from the remote host security group.
It does not reuse a broadly accessible host security group as the endpoint
boundary.

The later first-dataplane/cluster product train makes the production DPM
PrivateLink graph a hard gate. It proves all of the following together:

- the customer-account cluster-gateway endpoint service is ready and its only
  allowed principal is the BYOC control-plane DPM role;
- the interface endpoint in the configured control-plane VPC, subnet, and
  endpoint security group is `Available`;
- the regional control plane can reach `/k8s-apiserver` through the interface
  endpoint DNS; and
- the EKS public API endpoint is no longer reachable.

There is no public management-path fallback. Deleting the TiDB cluster leaves
the Empty BYOC dataplane and this private management path intact. Normal
`cp9 destroy` then deletes the dataplane and PrivateLink resources and requires
absence proof in both accounts. DPM may temporarily re-enable the public EKS API
during ordered dataplane teardown, matching its production deletion task, but
that transient recovery path is not an accepted running state.