I would like to confirm that it is ok to run 3 simultaneous instances of kratos attached to 3 replicated instances of cockroachDB in an active/active configuration. I think this should all "just work" and kratos should not care. the locking is all done in the database and kratos understands that there can be asynchronous updates to the the database tables by other kratos instances.... Or have I got this completely wrong?

If this is for a "business critical" use case I would recommend you get a support agreement with Ory - this sort of case is beyond the scope of community support. You also have the option for an Ory Enterprise License for Ory Kratos which additionally supports multi-region failover with regulatory compliance around private data (for example GDPR), database sharding for high scalability and availability, and zero-downtime migrations. I wanted to follow up on your most recent email on exactly this topic, apologies for not responding there...