amadan
carlos run spec: as built after zero-downtime deploys (§4, §5.3, §5.4)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+5
−0
docs/superpowers/specs/2026-10-08-carlos-run-design.md+5 −0
CI passed — run details
diff --git a/docs/superpowers/specs/2026-10-08-carlos-run-design.md b/docs/superpowers/specs/2026-10-08-carlos-run-design.md| index 6cc22fa02..68c37de92 100644 |
| --- a/docs/superpowers/specs/2026-10-08-carlos-run-design.md |
| +++ b/docs/superpowers/specs/2026-10-08-carlos-run-design.md |
| @@ -5,6 +5,11 @@ Rev 2 answers Astra's round 1 (`CODEX-FINDINGS-RUN-AND-SEEDED-R1.md`; |
| findings 1 to 7 are this spec's). Each change is marked **(codex N)**, and |
| §11 lists the dispositions. |
| +**As built, after zero-downtime deploys (2026-10-10).** Main's zero-downtime deploys (zdd-1 to zdd-5) were merged into the build, and Astra reviewed the merge. Three statements below now read differently in the code (carlos-run db2ccdd3..4cb605c5): |
| +- §5.3: a run whose stop cannot be proven no longer leaves only the stop "unproven". The instance keeps its replication, lease and entry until the run's termination is proven, through main's termination proof and its pending-stop retries. |
| +- §5.4: the cmd template differs from the seed template in seven named lines, not six. The extra line is the command's own executable mount source (`<ExeRoot>/<iid>/cmd-app`), so that instance or sidecar starts never overwrite the build a command binds. |
| +- §4 (Environment): `cmdVars` starts from the environment the serving generation was launched with, saved on its process handle, not from the delivered files. Each command is bound to the generation it was admitted against. A swap or restart that retires that generation interrupts the run (exit 125). |
| + |
| **Discussion:** amadan carlos/platform #259. Companion spec: |
| `2026-10-08-seeded-instances-design.md` (#260, #261). |