While prepping the implementation plan, found that slowapi 0.1.9
already ships exactly the fail-degraded behaviour we'd designed:
Limiter(in_memory_fallback_enabled=True) routes to a per-process
MemoryStorage when the primary raises, logs once per outage, and
re-probes with exponential backoff (better than the fixed 30s window
we'd specified). Custom _FailDegradedStorage class is no longer
needed — drops a new module and four unit tests' worth of code we'd
have to maintain.

Spec sections 4.2, 4.3, 5, 6, 7, and 10 updated to reflect the
library-feature approach. Architecture and operator-visible behaviour
are unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Step-by-step TDD plan for issue #68 against the simplified spec at
docs/superpowers/specs/2026-05-01-multi-worker-uvicorn-design.md.

Seven tasks: Settings + validator, redis dep (ordered before the
limiter test that exercises it), limiter module extraction, Dockerfile,
README, CHANGELOG, final verification.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

New Pydantic model validator hard-fails startup if PC2NUTS_WORKERS > 1
without PC2NUTS_RATE_LIMIT_STORAGE_URI configured, so the per-IP rate
limit can never silently loosen under multi-worker.

Defaults preserve current behaviour: workers=1, storage URI unset.

Pulls in redis-py at the version limits 5.8.0 expects, used only when
PC2NUTS_RATE_LIMIT_STORAGE_URI is set. Single-host deployers who never
configure shared storage pay the install-size cost but no runtime cost
(redis is imported eagerly by limits.storage.RedisStorage at Limiter
construction, but only when the storage URI is configured).

Without this, regenerating requirements.lock via the documented
'pip install -r requirements.txt && pip freeze > requirements.lock'
flow would drop the redis pin added in dc56d8c. Using slowapi's
[redis] extra (rather than pinning redis directly) keeps the
declaration aligned with our actual dependency and lets slowapi's
constraint chain choose the right transitive version of redis-py.

When PC2NUTS_RATE_LIMIT_STORAGE_URI is set, construct the Limiter with
that storage URI and in_memory_fallback_enabled=True so transient
backend outages fall back to per-process MemoryStorage. When unset,
construction is byte-for-byte the previous inline call.

slowapi's built-in fallback handles outage detection, once-per-outage
WARNING logging, and exponential-backoff recovery probes.

One-line whitespace fix flagged by ruff format --check on Task 3's
new test file. CI runs format --check, so this would have broken the
lint job.

Switches CMD from exec-form to shell-form with 'exec uvicorn …' so
${PC2NUTS_WORKERS:-1} expands at container start while uvicorn remains
the foreground PID-1 process for proper SIGTERM handling.

Default of 1 preserves current single-worker behaviour. Multi-worker
mode also requires PC2NUTS_RATE_LIMIT_STORAGE_URI; the Settings
validator (added in feat(config)) refuses to start otherwise.

New 'Multi-worker deployment' subsection covers both env vars, the
startup-validation guard for the unsafe combination, and the slowapi
fail-degraded behaviour during a backend outage.

….txt (#68)

Reviewer caught that slowapi 0.1.9's [redis] extra pins
'redis>=3.4.1,<4.0.0' — a stale 6-year-old constraint that contradicts
the redis==7.4.0 lock pin. Any operator running the documented
'pip install -r requirements.txt && pip freeze > requirements.lock'
regeneration flow would silently downgrade to redis 3.5.3.

limits[redis] exposes the modern constraint
'redis!=4.5.2,!=4.5.3,<8.0.0,>3' which matches the lock pin and is what
we actually want. The slowapi -> limits dependency chain still pulls
slowapi in transitively, so we don't lose any functionality by dropping
the slowapi[redis] extra in favour of limits[redis].

Verified: pip install --dry-run -r requirements.txt now resolves redis
to 7.4.0 cleanly, matching requirements.lock.