Down for maintenance is a routing change, not an app state

The migration takes eleven minutes and the API can't serve during it. The usual answer is a maintenance mode inside the app, which means the app has to be up to say it's down.

Instead: PATCH /api/v1/proxy/aliases/{id} with {"program": "exec", "index": 2}. The alias now routes to hoody-exec instance 2, where a catch-all script answers every path with a 503, a Retry-After, and one line of status. The API process is free to be stopped, migrated, and restarted with nothing in front of it. Eleven minutes later, another PATCH: {"program": "http", "port": 3000}. Same hostname, same certificate, same CNAME throughout.

Which program answers a hostname is a field, and you can change it while the program it used to point at is down.