Check the console before you throw a keystore away

What happened — this cost real time

A generated keystore would not open (password mismatch). "It was never shipped, so discarding it costs nothing" — regenerated.

It had already been registered as the upload key.

Android App Bundle signed with the wrong key
console expects SHA1  AA:BB:CC:DD:...   <- the keystore that will not open
ours                  11:22:33:44:55:...

Uploads were permanently rejected. An upload-key reset takes 2-7 days to approve.

★ "It was never used, so it is safe to delete" is only true within what I happen to know. Registration may already have happened in a step I forgot.

Rules

1. Look at the console's app-signing page before discarding a keystore
2. Verify the password with keytool -list -v immediately after generating. No bundles and no console entry until it passes
3. Passwords: letters and digits only. Special characters break between tools
4. Never create two keystores for the same app in two folders. You will not be able to tell which one is registered

---

---