diff --git a/live/secrets/terragrunt.hcl b/live/secrets/terragrunt.hcl
index a3ee983..d86ab38 100644
--- a/live/secrets/terragrunt.hcl
+++ b/live/secrets/terragrunt.hcl
@@ -19,13 +19,44 @@ locals {
   # decrypted ahead of time and the path is passed via INFRA_SECRET_VALUES_FILE;
   # locally we fall back to direct sops decryption. Values reach the module only
   # via inputs (ephemeral), never written to disk.
+  #
+  # No try(...,"")/try(...,{}) on decrypt/parse/env-lookup below on purpose:
+  # swallowing those failures used to collapse silently into secrets = [],
+  # and a terraform plan with 0 declared secrets looks like a normal, boring
+  # "destroy everything" diff - nothing marks it as "decrypt actually failed".
   secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
-  secret_values_raw      = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file("${local.repo_root}/infrastructure-secrets.yaml"), "")
-  secret_values_config   = try(yamldecode(local.secret_values_raw), {})
-  secret_values_env      = try(local.secret_values_config.environments[local.env_name], {})
+  secret_values_raw      = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : sops_decrypt_file("${local.repo_root}/infrastructure-secrets.yaml")
+  secret_values_config   = yamldecode(local.secret_values_raw)
 
+  # file() as a poor man's error(): HCL has no native assert/error function,
+  # this is the standard trick - an intentionally-broken file() call surfaces
+  # the message text inside terraform's own "no such file" error.
+  _fail_on_missing_secret_env = !contains(keys(local.secret_values_config.environments), local.env_name) ? file("INFRA_ENV '${local.env_name}' not found in infrastructure-secrets.yaml environments: [${join(", ", keys(local.secret_values_config.environments))}]") : ""
+
+  secret_values_env = local.secret_values_config.environments[local.env_name]
+
+  # secrets key itself may legitimately be absent for an environment with 0
+  # secrets declared - that one stays a real default, not an error.
   secrets = try(local.secret_values_env.secrets, [])
 
+  # Явная проверка top-level ключей каждой записи secrets: Terraform молча
+  # отбрасывает незнакомые ключи при приведении к типу (например custom_key
+  # вместо custom_keys, depends_ons вместо depends_on) - без этой проверки
+  # опечатка в infrastructure-secrets.yaml тихо теряется, без единой ошибки
+  # в плане, и нужное поле остаётся дефолтным/пустым.
+  allowed_secret_keys = toset([
+    "name", "namespace", "type", "registry_url", "data", "depends_on",
+    "yc_sa_key_names", "custom_keys", "constant_keys", "random_keys",
+    "credential_keys", "labels", "annotations", "lifecycle", "sink", "vault_path",
+  ])
+  secret_key_typos = flatten([
+    for secret in local.secrets : [
+      for k in keys(secret) : "${try(secret.namespace, "?")}/${try(secret.name, "?")}: unknown key '${k}'"
+      if !contains(local.allowed_secret_keys, k)
+    ]
+  ])
+  _fail_on_secret_key_typos = length(local.secret_key_typos) > 0 ? file("Unknown/misspelled key(s) in infrastructure-secrets.yaml secrets: ${join(" | ", local.secret_key_typos)}") : ""
+
   # image-pull-secret (regcred) fan-out. Single source: vault.data.common.regcred.dockerconfigjson
   # (secret values live under vault.data.* - see .sops.yaml encrypted_regex).
   # Rolled as a kubernetes.io/dockerconfigjson secret named `regcred` into every
diff --git a/live/vault-secrets/terragrunt.hcl b/live/vault-secrets/terragrunt.hcl
index 2649a71..7c7e315 100644
--- a/live/vault-secrets/terragrunt.hcl
+++ b/live/vault-secrets/terragrunt.hcl
@@ -10,20 +10,31 @@ locals {
   # В CI файл расшифровывается заранее одним шагом, и путь передаётся через
   # INFRA_SECRET_VALUES_FILE (SOPS_AGE_KEY нужен только этому шагу, не всей
   # джобе). Локально - fallback на прямую расшифровку через sops_decrypt_file.
+  #
+  # Без try(...,"")/try(...,{}) на decrypt/parse ниже намеренно: раньше
+  # провалившаяся расшифровка тихо схлопывалась в secrets_config = {}, дальше
+  # в vault_config = {} и vault_enabled = false - план "ничего не менять в
+  # vault" выглядел бы легитимно, без единой ошибки, хотя причина - сломанный
+  # ключ/файл, а не осознанное отсутствие vault-конфига.
   secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
-  secrets_config_raw     = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file(local.secrets_file), "")
-  secrets_config         = try(yamldecode(local.secrets_config_raw), {})
+  secrets_config_raw     = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : sops_decrypt_file(local.secrets_file)
+  secrets_config         = yamldecode(local.secrets_config_raw)
 
   env_override   = trimspace(get_env("INFRA_ENV", ""))
   env_from_file  = try(trimspace(local.infra_config.current_environment), "")
-  available_envs = sort(keys(try(local.secrets_config.environments, {})))
+  available_envs = sort(keys(local.secrets_config.environments))
   env_fallback   = try(local.available_envs[0], "")
 
   env_name = local.env_override != "" ? local.env_override : (
     local.env_from_file != "" ? local.env_from_file : local.env_fallback
   )
 
-  env_config    = try(local.secrets_config.environments[local.env_name], {})
+  # file() как самодельный error(): в HCL нет нативного assert/error, это
+  # стандартный трюк - заведомо не существующий путь всплывает в тексте
+  # ошибки terraform "no such file".
+  _fail_on_missing_secret_env = !contains(keys(local.secrets_config.environments), local.env_name) ? file("INFRA_ENV '${local.env_name}' not found in infrastructure-secrets.yaml environments: [${join(", ", keys(local.secrets_config.environments))}]") : ""
+
+  env_config    = local.secrets_config.environments[local.env_name]
   vault_config  = try(local.env_config.vault, {})
   vault_enabled = try(local.vault_config.enabled, false)
 }