amadan
docs: record that the T7 egress ruling landed (2026-08-24)
Part 3's implementation-status paragraph said egress attribution for backhauled bytes was an open ruling. It is closed: a dated amendment, appended rather than rewriting the sentence, states both halves — the sender-side per-home-box in-flight cap (CARLOS_BACKHAUL_MAX_INFLIGHT, default 64, 503 + Retry-After: 2) and the home-box hop annotation (EdgeRow hop_requests/hop_bytes_out, subset semantics) — plus the pricing decision deferred with "absorbed" as the shipped default, and the roll-before-arming ordering the two halves imply.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+45
−0
docs/superpowers/specs/2026-08-20-multi-region-ingress-design.md+45 −0
diff --git a/docs/superpowers/specs/2026-08-20-multi-region-ingress-design.md b/docs/superpowers/specs/2026-08-20-multi-region-ingress-design.md| index a3e830387..f44461f39 100644 |
| --- a/docs/superpowers/specs/2026-08-20-multi-region-ingress-design.md |
| +++ b/docs/superpowers/specs/2026-08-20-multi-region-ingress-design.md |
| @@ -216,6 +216,51 @@ rollout notes). Egress attribution for backhauled bytes is an open |
| ruling, not a defect: see the plan's rollout notes, T7 egress ruling |
| request. |
| +**Amendment (2026-08-24): the T7 egress ruling landed — backhaul is |
| +contained and hops are attributed.** The open ruling above is closed in |
| +two halves, both dormant on a single-box deployment. |
| + |
| +*Containment, on the SENDING edge.* At most |
| +`CARLOS_BACKHAUL_MAX_INFLIGHT` (default **64**; unset, unparseable or |
| +≤ 0 all mean the default, and there is deliberately no "off" value) |
| +backhauled requests may be in flight toward any ONE home box. At the |
| +limit the sender answers **503 + `Retry-After: 2`** itself — no dial, no |
| +cross-region bytes — and logs on the throttled per-home-box key |
| +`"backhaul-saturated "+box`. A concurrency bound rather than a rate, |
| +because cross-region egress is (concurrent streams × per-stream |
| +bandwidth): short requests flow at full rate forever and only sustained |
| +streams pile into the cap. A slot is held for the LIFE of the hop's |
| +response, streams and upgrades included — that IS the sustained egress |
| +being bounded. Sender-side because every backhauled byte crosses both |
| +legs, so one cap bounds both boxes at once; the home box needs no twin. |
| + |
| +*Attribution, on the HOME box.* The single existing meter site keeps |
| +counting every hop-served exchange exactly once, and on a verified hop it |
| +additionally records the same request and the same wire bytes into two |
| +new additive, `omitempty` fields on `usage.EdgeRow` — `hop_requests` / |
| +`hop_bytes_out`. They are a **subset annotation inside** `requests` / |
| +`bytes_out`, never an addition to them: a consumer that sums `bytes_out` |
| +has already counted every backhauled byte and must never add the hop |
| +fields on top. `EdgeDay.V` stays 1 (old objects parse, old binaries |
| +ignore the new keys, single-region objects stay byte-identical). The |
| +sending edge stays meterless by design — it has no route row for the |
| +host, so no account or app to attribute to. |
| + |
| +*Pricing stays with Paul.* The counters ship dormant: `backhaul_gb` is |
| +reserved in the meter vocabulary and wired into nothing — no rate-card |
| +line, no statement — so bills are byte-identical to before and the |
| +decision (price backhauled bytes, or absorb them as a platform cost of |
| +any-edge serving) can be made later on real data. Default taken tonight: |
| +**absorbed**. |
| + |
| +*Rollout.* Must be rolled to every box of a deployment BEFORE that |
| +deployment arms a second edge — the home box needs the new binary to |
| +annotate hops, the senders need the cap. It slots ahead of the steering |
| +plan's arming checklist step 0. Mixed versions are safe in both |
| +directions: an old-binary home box writes rows without hop fields |
| +(under-annotated, never wrong), and an old-binary sender is simply |
| +uncapped until rolled, which is today's behaviour. |
| + |
| | Class | Kinds | Behaviour on a non-home edge | |
| |---|---|---| |
| | Everywhere | static, bake-served | adopt and serve locally from converged artifacts — zero backhaul | |