# Pipeline Update Design

## Goal

This document describes the pipeline update behavior introduced around the TiDB-X refactor.

The key principle is:

- product semantics may change by service plan
- pipeline updates must remain operationally safe

## Update Drivers in This Refactor

Pipeline updates now need to carry more than the old Dedicated-only config model.

Important new inputs include:

- `ServicePlan`
- service-plan-aware datasource routing
- NextGen output semantics
- runtime safety configuration such as bounded backfill

## Design Intent

### 1. Config-Driven Behavior

Pipeline behavior should be selected by rendered config and runtime metadata, not by ad-hoc branch-specific manual procedures.

### 2. Dedicated Compatibility

Updating the pipeline for TiDB-X must not break Dedicated paths.

### 3. Safer Runtime Changes

The refactor should avoid turning every scale or config change into unnecessarily large runtime disruption.

That is why the surrounding design work includes:

- bounded backfill
- cleaner separation between control-plane metadata rendering and pipeline runtime behavior
- follow-up design direction toward safer update and hot-update behavior where appropriate

## What Reviewers Should Check

- pipeline config changes are minimal but sufficient
- service-plan fields are actually consumed by runtime logic
- updates do not accidentally push Dedicated traffic into TiDB-X logic
- rollout-related runtime safety options are enabled intentionally