43425497

By: Michael Lynch <git@mtlynch.io>

Document the shutdown budget contract in DESIGN.md

Adds the shutdown budget contract to the Fly.io hosting rationale:
kill_timeout must exceed drain-timeout plus shutdown-sync-timeout, and
the app must exit 0 on every signal path, or Litestream skips its final
sync and discards unreplicated writes. This constraint now lives in the
design doc rather than only in commit messages and code comments, per
the project's convention of not burying critical maintenance
constraints where they'll be missed.

Depends on split/litestream-shutdown-budget (raises shutdown-sync-timeout
and kill_timeout) and split/litestream-graceful-shutdown (makes exit 0 on
every signal path true) both landing on master first -- this paragraph
describes their combined behavior and is not accurate before either
lands.

Co-Authored-By: Claude <noreply@anthropic.com>

Timeline