35. Deploying a domain model: the deployment template🔗

A model document says what a boundary is. A deployment document says what deploying one adds, and the two are different enough that a single document doing both does neither well. The model's reader wants to know what is proved and at which carrier; the deployment's reader wants to know what will run, on what, against which contract, and what would have to fail for the result to be rejected.

The separation is not editorial tidiness. Almost everything the deployment adds is unproved by construction: an image is built, not derived; a shard size is measured, not theorem-backed; a queue is chosen. Mixing that material into the model document lets the model's green nodes lend it an assurance it does not have. Keeping it separate forces the deployment to carry its own evidence, which is what this template enumerates.

The template has 17 rubrics: 9 discharged by a section that states the answer, 2 by a view generated from the compiled environment, 3 by a kernel-checked declaration, and 3 by a labeled measurement.

1. 35.1. The template
2. 35.2. What is deployed
3. 35.3. The contracts
4. 35.4. Sizing and knobs
5. 35.5. The platform
6. 35.6. Acceptance
7. 35.7. Reproducibility and limits
8. 35.8. What the machine can hold here