carlos / platform Public

docs: the lifetimes cutover forbids an older box after the marker and names the roll window (final review F4)

Two paragraphs in the rollout section: boxes roll before the console,
and until the console rolls an older console may rewrite a record
without record_seq, which is today's exposure and ends at the console
roll; and an older box (no lifetimes-1) must never be started, restarted
or rolled back into the fleet once control/lifetimes-cutover.json
exists.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 2 days ago fc499519a1d05da5ee77f39c014d382e610edac6 parent 0316ce6

1 file changed, +4 −0

docs/site/cli.md +4 −0

diff --git a/docs/site/cli.md b/docs/site/cli.md

index 5a98d467d..2e6b8c443 100644

--- a/docs/site/cli.md

+++ b/docs/site/cli.md

@@ -2330,6 +2330,10 @@ carlos system legacy-routes assign --name shop --to bac/shop

carlos system lifetimes cutover switches a console without host claims onto instance lifetimes. It is done once per deployment, and it cannot be undone. Every box must run a release that knows about lifetimes first.

+Roll the boxes before the console. Until the console rolls, an older console may rewrite an instance record without its sequence field, record_seq. That is the exposure the deployment has today, and it ends when the console rolls.

+An older box, one whose release does not publish lifetimes-1, must never be started, restarted or rolled back into the fleet once control/lifetimes-cutover.json exists.

Run it in this order:

1. Stop the old console. An older console must never run beside this one, and must never be started again once the cutover has begun.