"Nine is where the roll starts. It is not a number the code is allowed to believe in."
A starting count, not a shape
The fleet begins at nine Macs. That nine is inventory — a fact about today — not cardinality, a constant baked into the design. The moment a line of code assumes there are nine, a tenth machine becomes a bug instead of an enrollment. Seed numbers belong in the data; they must never leak into the schema.
Membership is dynamic by construction
The roll grows and shrinks through explicit transitions — add, suspend, retire, restore, replace. Crucially, the tenth Mac enrolls through the exact same contract that seeded the first nine. There's no special initial fleet path and a separate add one later path; there's one way in, used from the very first machine, so the hundredth is no more special than the second.
Replace: the role outlives the box
Hardware dies and gets swapped. replace_host_device deliberately moves a logical role onto new hardware while keeping both sides of the binding history — the old machine, the new one, and the fact that one took over from the other. The role (the always-on server) is durable; the physical box under it is replaceable. Confusing the two is how you lose a machine's history the day its logic board fails.
Roles are assigned, never inferred
A machine's role is policy you wrote, not a guess from behavior. Always-on server is a promise you made about that host — not whichever Mac happened to post the best uptime this month. Infer topology from who answered today, and your fleet's shape quietly rearranges itself every time the network hiccups.