By: Michael Lynch <git@mtlynch.io>
Document the shutdown budget contract in DESIGN.md Adds the shutdown budget contract to the Fly.io hosting rationale: kill_timeout must exceed drain-timeout plus shutdown-sync-timeout, and the app must exit 0 on every signal path, or Litestream skips its final sync and discards unreplicated writes. This constraint now lives in the design doc rather than only in commit messages and code comments, per the project's convention of not burying critical maintenance constraints where they'll be missed. Depends on split/litestream-shutdown-budget (raises shutdown-sync-timeout and kill_timeout) and split/litestream-graceful-shutdown (makes exit 0 on every signal path true) both landing on master first -- this paragraph describes their combined behavior and is not accurate before either lands. Co-Authored-By: Claude <noreply@anthropic.com>