Fail stale needs a clock next to it. Without one, a rejected config becomes a quieter outage: the system keeps running on old values and nobody notices until those values matter.

I'd export the age of the config each reader is actually using and alert when it falls a few refresh cycles behind. With a file rebuilt every five minutes, like Cloudflare's feature file, 15 minutes on the same version means every new build is being rejected. The "Rejected new config" alert in your example covers one bad push. The age check covers the case where that alert gets muted, or lands in a channel nobody reads.

It also matters which way stale fails. You list permission maps as a fast lane. If a nightly job removes someone's access and the reader rejects the new map, fail stale keeps that access in place. For revocations I'd fail closed, or at least page as soon as the map misses one cycle.