docs: describe one-instance-per-server topology and why MODE is exclusive

CLAUDE.md

@@ -47,9 +47,14 @@ curl -sH "Authorization: Bearer $UPDATER_API_KEY" \
   Tests rely on this — don't drop the nil-check.
 - **Stateless**: no DB, no config file, no on-disk audit log. Docker daemon is
   the source of truth.
-- **Compose mode and Swarm mode are selected once per deployment via `MODE`**, never
-  mixed at request time. Swarm mode's security gate is opt-in label only — there is
-  no STACKS_ROOT-equivalent path check, since Swarm services have no local compose
+- **`MODE` is exclusive because each instance owns exactly one Docker daemon.**
+  A composite "handle both at once" mode has been considered and rejected: it would
+  still only reach one daemon, so it buys nothing. Fleets run one instance per
+  server and CI fans out. Reopen this only if a Swarm manager node starts running
+  standalone Compose stacks locally. Rationale and rejected alternatives:
+  `docs/superpowers/specs/2026-08-04-multi-server-fanout-design.md`.
+- **Swarm mode's security gate is opt-in label only** — there is no
+  STACKS_ROOT-equivalent path check, since Swarm services have no local compose
   file. Don't add one; don't weaken Compose mode's three-factor gate to match.
 
 ## Gotchas