An upgrade
Tuesday, nine in the morning. A release of Agora is ready: a fix in the participatory budget's vote count display, a new export for the ideas module. Every client runs its own copy, so an upgrade is not one deploy but one per client: Eau de Paris' two instances, then the next ones as they sign. The manifest that describes them all is the same file; the upgrade is a loop over it.
What the client sees: nothing, or a line in the release note they receive. What they do not see, and this is the point, is another client's upgrade. A régie that asked to stay one version behind because its own release window is Thursday stays one version behind. Nobody else's timetable is theirs.
An incident
Tuesday, two in the afternoon. A client's instance is under an unusual load: a participatory budget's vote just opened and the whole town's newsletter went out at once. The instance slows; the monitoring says so; the tunnel keeps serving. The other instances do not know. There is no shared database to lock, no shared process to starve. The client who is voting gets our attention; the client who is not gets their Tuesday.
Had the load been a security incident instead, the blast radius would have been the same: one instance, one database, one client to call. That sentence is the whole answer to the question 'who else is on your server', and it is a sentence we can say in a security questionnaire without a footnote.
A hand-back
Tuesday, end of the day. A contract ends, not this one, but one will. The client receives an SQL export of their database, their media files, and the data dictionary that says what each table and column holds. Nothing has to be extracted from anyone else's rows because there are no rows but theirs. The instance is then erased and a record of the erasure written.
This is the part of the architecture we are most attached to. A public buyer signs for twenty-four months; what they get at the end should be theirs to take elsewhere, readable, complete. Isolation at the start makes the hand-back at the end a copy, not a project.