## ADDED Requirements

### Requirement: Generated Run identity is distinct from its build target

When Platform generates a Run package for a failed or draft legacy server without `deploymentTargetId`, it SHALL reserve `server-run-<server-instance-id>` as the package endpoint identity and persist the previous endpoint as the deployment target before the distribution build job is queued.

#### Scenario: Failed legacy server generates a new Windows Run

- **GIVEN** a failed legacy server has `runEndpointId=run-local-debug` and no deployment target
- **WHEN** an authorized owner generates a Windows amd64 Run package
- **THEN** the build job targets `run-local-debug`, the server persists `deploymentTargetId=run-local-debug`, and the generated package is assigned `runEndpointId=server-run-<server-id>`

### Requirement: Shared builders reject component Run identity

Platform SHALL reject a component-authenticated Run hello unless its endpoint identity equals the server's dedicated Run endpoint identity.

#### Scenario: Old package tries to claim the builder ID

- **GIVEN** an instance has a dedicated Run endpoint and a separate deployment target
- **WHEN** a Run component uses the instance key to register as the deployment target endpoint
- **THEN** Platform rejects the hello and leaves the build endpoint registration unchanged

### Requirement: Generated Run does not advertise build-only capabilities

A Run configured as a server component SHALL NOT advertise `distribution.build` or `run.self-update`.

#### Scenario: Generated Run registers on the target host

- **WHEN** a package with component kind `run` creates its capability report
- **THEN** lifecycle capabilities remain available and build-only capabilities are absent