Frequently asked questions
Is the model the source of every kind of truth?
Section titled “Is the model the source of every kind of truth?”No. It is authoritative for product intent. Live data, secret values, active infrastructure, release state, and telemetry have separate authorities. The contract prevents overlap between them.
What happens to real customer data when the app regenerates?
Section titled “What happens to real customer data when the app regenerates?”Nothing automatically. Generation produces application and migration artifacts. The release workflow applies explicit, reviewed data evolution. Live rows are never treated as disposable generated code.
Can infrastructure handle all migrations?
Section titled “Can infrastructure handle all migrations?”Infrastructure can plan and execute locks, batches, retries, and credentials. It cannot infer whether a removed and added field represents a rename, replacement, split, or deletion. Semantic evolution belongs in the model/history; execution belongs to infrastructure.
What about a migration that runs for two hours on a live table?
Section titled “What about a migration that runs for two hours on a live table?”Use expand–migrate–contract: add compatible shape, deploy dual-compatible code, backfill in resumable batches, verify, cut over, observe, and remove old shape later. Blue-green application deployment alone does not make a shared-database migration safe.
Do we ever edit generated code?
Section titled “Do we ever edit generated code?”Not as a permanent authoring path. Managed files are inspectable and exportable but replaceable. Product-specific code belongs in declared extensions. A manual edit is divergence and must be folded into the model, generator, or extension—or the output must be declared forked.
What happens during a 2 AM incident?
Section titled “What happens during a 2 AM incident?”Classify the authority and stabilize through compatible rollback, traffic, configuration, capacity, queue control, repair, replay, restore, or provider operations. If behavior must change, use the fastest model → generate → verify → promote path. The platform must make that path operationally fast.
What if a third-party API changes or goes down?
Section titled “What if a third-party API changes or goes down?”Endpoint or key changes use runtime configuration. Temporary unavailability uses timeout, retry, circuit, queue, or degradation policy. A changed contract requires an integration-model or adapter update and a new release.
Isn’t scalability an infrastructure concern?
Section titled “Isn’t scalability an infrastructure concern?”Capacity usually is. Algorithmic shape is not. More instances can absorb a traffic spike; they cannot fix an unbounded scan, N+1 query, or migration that takes an exclusive lock on a huge table. Those cases require generator strategy or an explicit workload constraint.
Does determinism guarantee the generated application is correct?
Section titled “Does determinism guarantee the generated application is correct?”No. It guarantees reproducibility for declared inputs. Correctness additionally requires a correct model, target support, semantic validation, tests, release controls, and runtime evidence.
What if the generator has a bug?
Section titled “What if the generator has a bug?”Keep or restore a safe release, fix the shared generator, add a conformance fixture, and regenerate affected applications. This turns one observed defect into a system-wide correction instead of many private patches.
How do we prevent an emergency patch from disappearing later?
Section titled “How do we prevent an emergency patch from disappearing later?”Managed-file hashes detect divergence before overwrite. The next generation must stop or explicitly resolve the edit. Detection is a safety net, not a sanctioned long-term workflow.
Does time since last regeneration prove the paradigm is failing?
Section titled “Does time since last regeneration prove the paradigm is failing?”No. It is a useful adoption signal. Combine it with ungenerated model changes, managed-file divergence, outstanding migration state, and release lead time. A stable unchanged project may regenerate rarely; a divergent project avoiding regeneration has broken the contract.
Can I take the generated application elsewhere?
Section titled “Can I take the generated application elsewhere?”Yes. ZIP and GitHub handoff are explicit portability paths. You may keep using modelARch revisions and generation, or fork the output and make the codebase authoritative under your own workflow.
Is every generator target equally capable?
Section titled “Is every generator target equally capable?”No. The canonical model is shared, but target support differs. Target preflight and current reference documentation determine whether a construct can be delivered safely.
Is managed deployment already fully regenerative for schema changes?
Section titled “Is managed deployment already fully regenerative for schema changes?”Not yet. Current managed redeploy refuses physical schema changes even though the primary generator emits an evolution chain. This prevents unsafe promotion until the managed orchestrator can execute and verify that chain end to end.
What makes the paradigm falsifiable?
Section titled “What makes the paradigm falsifiable?”It fails its own claim if permanent managed behavior cannot be derived from declared inputs, generated divergence is silent, data evolution is unsafe, releases are not traceable, or production recovery depends on hidden edits to generated output.