Cross-runtime systems and worked scenarios

Design synthesis, 7 October 2026. This chapter incorporates the supplied Astra report. Its models and acceptance tests describe intended architecture; they do not certify current implementation. The report inventoried 140 public routes and compared substantive sections of 51 documents. Repository source and current qualification receipts determine what ships.

Architecture thesis and invariants · Nodes, ports and hyperedge vocabulary · Composition and execution semantics · Compiler, source publication and consistency · Shadow, evidence and region releases · Authoring and industry precedents · Cross-runtime systems and worked scenarios · Impact, design obligations and qualification

14. Concrete system graphs

Rounded rectangles are components/regions; small circles on their boundary are named ports. Oval H markers are relation identities, not secret coordinator services. Their role-labelled spokes are incidences. Solid directed links are specialized binary relationships; dashed links show planning, evidence or authority. The colored runtime columns show placement, not separate copies of the semantic graph.

Each scenario identifies a candidate update boundary, actual state authority and at least one hard failure obligation. Every diagram is an illustrative design, not a claim that a backend is connected or that the depicted system is implemented. The JSON in the bundle preserves node IDs, ports, hyperedges and incidences for machine inspection.

The broad reuse unit is a feature region with boundary contracts, implementation choices, state owners, deployment requirements and evidence. A graph subregion is not automatically a movable network service; locality, clock and resource requirements can forbid relocation.

A ride-dispatch feature, from maps to durable assignment

Compose a mobile native capability, low-latency stream and durable command without inventing three unrelated APIs.

State authority: Trip database owns durable assignment; Match actor owns one active control scope.

Update: Ranker inside Match region; preserve actor state

Push a ranking-policy change only after its boundary, model requirements and session assumptions remain compatible. A new native map SDK still requires a host build.

Failure qualification: Lose the commit reply, then retry the same command. No second driver may be assigned; old trip sessions must remain valid.

Nodes: rider [N11], driver [N15], edge [N07], match [N05], db [N21], ops [N11]

Relation H1 (H06): participant=rider.session, participant=driver.session, authority=match.session

Checkout: a local transaction plus an external saga

Keep local ACID and distributed recovery in one visible feature without pretending they are the same guarantee.

State authority: Order/outbox storage is one atomic domain; payment and inventory are independent authorities.

Update: Version workflow; pin in-flight continuation

Change retry or routing logic for new checkout instances. Existing persisted workflows retain their old definition unless an explicit continuation migration is qualified.

Failure qualification: A payment commits and the reply is lost. Reconcile by payment key before retrying; failure compensation is itself durable work.

Nodes: ui [N14], auth [N33], work [N06], order [N23], stock [N21], payment [N19], notify [N24]

Relation H1 (H17): forward=work.state, compensator=payment.refund, compensator=stock.release

Multiplayer across Unreal, Unity and a shared backend

A single feature definition spans game-native execution, companion UI, a live protocol and durable back-end work.

State authority: Match activation owns simulation; result database owns durable outcomes.

Update: New match definition; old matches pin old version

A matchmaking change can affect new matches immediately after qualification. Replacing a native engine binary or hot-swapping live physics is a different release class.

Failure qualification: Disconnect/rejoin and upgrade the match definition. Existing matches must not receive code with incompatible state or tick semantics.

Nodes: engine [N16], lobby [N11], gateway [N05], sim [N29], model [N18], data [N21]

Relation H1 (H06): participant=engine.session, observer=lobby.session, authority=sim.session

Private voice coaching with adaptive inference

Compose local-first behavior and cloud capability without silently treating cloud as a universally superior fallback.

State authority: Device owns live audio; each provider owns qualified execution; policy limits export.

Update: Update routing policy, not native microphone ABI

Update a policy region or model artifact only when the installed host can execute it and its quality/privacy evidence applies. A recorded transcript is not evidence for a new model’s quality.

Failure qualification: Revoke network permission or consent mid-session. No new audio may be exported; in-flight outcomes and cleanup remain explicit.

Nodes: mic [N15], local [N18], route [N32], cloud [N18], policy [N33], eval [N36]

Relation H1 (H24): requirement=route.policy, offer=local.offer, offer=cloud.offer, decision=route.decision

Industrial telemetry around a qualified control boundary

Model telemetry and deployment around an external system without claiming ownership of its certified internals.

State authority: PLC controls physical actuation; broker/store own persisted telemetry; operators authorize commands.

Update: Analytics update; safety/control region excluded

A new anomaly detector can be delivered to a qualified edge runtime. Safety-critical firmware changes remain a separate controlled process, not an automatic extension of graph updateability.

Failure qualification: Lose the cloud and deploy an analytics update. Local safety control must remain unaffected; buffer exhaustion must be bounded.

Nodes: sensor [N15], plc [N30], filter [N07], broker [N24], store [N21], ops [N20]

Relation H1 (H22): member=plc.request, member=filter.config, constraint=ops.config

A reproducible model experiment and deployment pipeline

Connect experiment reproducibility and runtime deployment without conflating a model tensor graph with the architecture graph.

State authority: Artifact stores own datasets and weights; the experiment authority pins the full input/run vector.

Update: Feature/model change widens evaluation closure

Deploy the resulting model region only where its operators, shapes and memory requirements are supported. Model quality evidence and orchestrator replay validate different claims.

Failure qualification: Change preprocessing but keep the model name. Invalidate dependent evaluation and refuse stale approval.

Nodes: dataset [N26], pre [N01], train [N06], base [N18], eval [N36], registry [N35]

Relation H1 (H27): input=dataset.dataset, input=pre.features, input=train.candidate, transform=eval.run, output=eval.evidence

Local-first collaborative editing with controlled publication

Put merge-friendly editing beside coordinated publication rather than making every invariant use the same consistency model.

State authority: Replicas own local drafts; publication authority owns the published revision.

Update: Protocol update requires mixed-version sync support

A server sync change must remain compatible with offline clients until the allowed upgrade window ends. A graph snapshot is not permission to resurrect deleted document payloads.

Failure qualification: Two disconnected users publish divergent drafts. The exclusive publication invariant must be checked at its authority.

Nodes: a [N25], b [N25], sync [N25], authority [N23], store [N21], render [N06]

Relation H1 (H14): replica=a.edit, replica=b.edit, authority=sync.merged

A low-copy camera and GPU processing pipeline

Show how graph contracts preserve meaning without forcing large buffers through generic serialized values.

State authority: Native buffer owner controls lifetime; activation generations pin callbacks and consumers.

Update: Swap compatible operator after outstanding leases drain

FlexBuffers can carry width/height/format/timestamp and attachment indices. The actual memory path is qualified per backend and may need a copy, fence or process restart.

Failure qualification: Replace the processing region while GPU work is in flight. Old callbacks and leases must never target freed code or reused handle slots.

Nodes: camera [N16], pool [N26], gpu [N17], ui [N11], encoder [N17], store [N26]

Relation H1 (H22): constraint=pool.lease, member=gpu.frame lease, member=ui.preview lease

A multi-party allocation problem, not a web of pairwise links

Represent one joint constraint over orders, warehouses, vehicles and time without losing its identity in pairwise edges.

State authority: Input stores own availability; reservation authority owns accepted assignments.

Update: Optimize-policy region; approvals invalidate on changed inputs

A better optimizer is a substitutable implementation if it preserves required feasibility and effect contracts. Its objective/quality claims need fresh comparative evidence.

Failure qualification: Capacity changes after optimization. Reject or recompute a stale plan rather than committing an over-allocation.

Nodes: demand [N22], supply [N22], join [N07], solve [N01], approve [N20], dispatch [N23]

Relation H1 (H09): input=demand.orders, input=supply.capacity, input=solve.proposal, result=dispatch.assignment

Reaktor improves a Reaktor system without approving itself

The same system language can describe its own tooling without granting self-modifying code control over the root of trust.

State authority: Graph authority owns candidate/promotion; independent policy owns approval; runtime hosts own activation.

Update: Candidate product region only; trust roots remain outside

Human and agent changes use the same patch/receipt model. External harnesses need OS/tool isolation or an explicit incomplete-governance declaration.

Failure qualification: Change a candidate after Shadow or weaken its gate in the patch. Release admission must refuse stale or self-authorized approval.

Nodes: agent [N39], draft [N23], build [N34], shadow [N36], approve [N33], rollout [N40]

Relation H1 (H28): claim=draft.claim, evidence=shadow.evidence, verifier=approve.verifier

Cross-runtime reference architecture

Combine interactive clients, native execution, live sessions, durable outcomes and model-backed behavior.

Law / model / proof obligation: Each boundary carries protocol, authority, state owner, placement, recovery and observation contracts.

Reaktor design decision

A reusable multiplayer region can own lobby/session logic, model selection and release qualification while leaving engine rendering, physics and the tick loop native. State and effects cross only declared boundaries.

What this does not establish

This is a proposed application design, not an implemented Reaktor game stack. Native integration, device parity, rollout behavior and performance need their own qualification.

Falsifiable acceptance test. Upgrade the match implementation under mixed client versions while injecting disconnect, duplicate delivery and acknowledgement loss. Preserve authority and recover outcomes.

Theory, precedent and Reaktor context: The Living Graph Live session topology Durable work FFI / Switchboard Surface contracts and interaction Unreal Engine — Introduction to Blueprints

A ride-dispatch feature, from maps to durable assignment

Compose a mobile native capability, low-latency stream and durable command without inventing three unrelated APIs.

Vector diagram · click a marked item to inspect

Reaktor design decision

Push a ranking-policy change only after its boundary, model requirements and session assumptions remain compatible. A new native map SDK still requires a host build.

Boundary / caveat

Trip database owns durable assignment; Match actor owns one active control scope.

Qualification test. Lose the commit reply, then retry the same command. No second driver may be assigned; old trip sessions must remain valid.

Actual authority: Trip database owns durable assignment; Match actor owns one active control scope.

Candidate update: Ranker inside Match region; preserve actor state

Push a ranking-policy change only after its boundary, model requirements and session assumptions remain compatible. A new native map SDK still requires a host build.

Inspect every drawn relationship

H1 / H06 — Trip session: participant (rider) = rider.session; participant (driver) = driver.session; authority (authority) = match.session

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: driver.positions → edge.positions | H02 | sampled stream
• E2: rider.request → edge.request | H05 | request + identity
• E3: edge.candidate → match.candidate | H02 | bounded candidates
• E4: match.assign → db.assign | H05 | conditional write
• E5: db.record → ops.record | H04 | trip events
• E6: edge.update → rider.state | H04 | live map state
• Trip session | H06 | rider=rider.session; driver=driver.session; authority=match.session
• rider · Rider map UI [N11]: A map SDK is exposed through a Surface/native adapter; map internals remain external.
• driver · Driver location [N15]: Sampling and OS permissions belong to the installed host; location payloads do not become persistent graph entities.
• edge · Ingress + geo filter [N07]: Bound noisy location streams, authenticate callers and preserve trip/session correlation.
• match · Match actor + ranker [N05]: Owns assignment transitions. The replaceable ranking function is not the owner of active trip state.
• db · Trip authority [N21]: Conditional assignment writes and outbox share the real store transaction.
• ops · Operations dashboard [N11]: Observes approved trip state and issues separately authorized intervention commands.

Checkout: a local transaction plus an external saga

Keep local ACID and distributed recovery in one visible feature without pretending they are the same guarantee.

Vector diagram · click a marked item to inspect

Reaktor design decision

Change retry or routing logic for new checkout instances. Existing persisted workflows retain their old definition unless an explicit continuation migration is qualified.

Boundary / caveat

Order/outbox storage is one atomic domain; payment and inventory are independent authorities.

Qualification test. A payment commits and the reply is lost. Reconcile by payment key before retrying; failure compensation is itself durable work.

Actual authority: Order/outbox storage is one atomic domain; payment and inventory are independent authorities.

Candidate update: Version workflow; pin in-flight continuation

Change retry or routing logic for new checkout instances. Existing persisted workflows retain their old definition unless an explicit continuation migration is qualified.

Inspect every drawn relationship

H1 / H17 — Saga compensation: forward (checkout) = work.state; compensator (refund) = payment.refund; compensator (release) = stock.release

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: ui.submit → work.submit | H05 | durable command
• E2: auth.grant → work.grant | H23 | scoped grant
• E3: work.reserve → stock.reserve | H05 | reserve
• E4: work.charge → payment.charge | H05 | charge id
• E5: stock.stock → order.stock | H02 | reserved stock
• E6: work.state → order.state | H02 | workflow state
• E7: order.events → notify.events | H04 | outbox delivery
• E8: order.receipt → ui.status | H04 | receipt / status
• Saga compensation | H17 | checkout=work.state; refund=payment.refund; release=stock.release
• ui · Checkout Surface [N14]: Draft validation stays separate from submitting durable work.
• auth · Tenant / identity gate [N33]: The client cannot mint a payment or inventory grant.
• work · Checkout workflow [N06]: Stable command identity, persisted continuation and explicit unknown-outcome handling.
• order · Order + outbox DB [N23]: Order mutation and its notification intent commit together under this authority only.
• stock · Inventory service [N21]: Reservation uses a key and expiry; remote participation is not silently part of the order DB transaction.
• payment · Payment provider [N19]: Charge idempotency and status lookup are provider-qualified requirements.
• notify · Notification worker [N24]: At-least-once delivery needs application-level deduplication or acceptable duplicate policy.

Multiplayer across Unreal, Unity and a shared backend

A single feature definition spans game-native execution, companion UI, a live protocol and durable back-end work.

Vector diagram · click a marked item to inspect

Reaktor design decision

A matchmaking change can affect new matches immediately after qualification. Replacing a native engine binary or hot-swapping live physics is a different release class.

Boundary / caveat

Match activation owns simulation; result database owns durable outcomes.

Qualification test. Disconnect/rejoin and upgrade the match definition. Existing matches must not receive code with incompatible state or tick semantics.

Actual authority: Match activation owns simulation; result database owns durable outcomes.

Candidate update: New match definition; old matches pin old version

A matchmaking change can affect new matches immediately after qualification. Replacing a native engine binary or hot-swapping live physics is a different release class.

Inspect every drawn relationship

H1 / H06 — Match session: participant (player) = engine.session; observer (observer) = lobby.session; authority (authority) = sim.session

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: engine.input → gateway.input | H07 | input protocol
• E2: lobby.join → gateway.join | H05 | join match
• E3: gateway.commands → sim.commands | H02 | ordered input
• E4: sim.snapshot → engine.snapshot | H07 | state snapshots
• E5: model.policy → sim.policy | H02 | bot policy
• E6: sim.result → data.result | H05 | durable result
• E7: gateway.session → lobby.status | H04 | session state
• Match session | H06 | player=engine.session; observer=lobby.session; authority=sim.session
• engine · Unreal / Unity client [N16]: Generated Blueprint/C++ or C# boundary bindings; renderer, physics and prediction remain engine-owned.
• lobby · Web / mobile lobby [N11]: Same match identity and session contract across companion clients.
• gateway · Session ingress [N05]: Sequence validation, authentication, session pinning and admission budgets.
• sim · Authoritative match [N29]: Each match activation owns a tick loop; simulation transforms are not graph-definition commits.
• model · Bot / ranking model [N18]: Model and preprocessing artifacts have explicit device/quality requirements.
• data · Results authority [N21]: Durable result submission has match/round identity; deduplicate retried outcomes.

Private voice coaching with adaptive inference

Compose local-first behavior and cloud capability without silently treating cloud as a universally superior fallback.

Vector diagram · click a marked item to inspect

Reaktor design decision

Update a policy region or model artifact only when the installed host can execute it and its quality/privacy evidence applies. A recorded transcript is not evidence for a new model’s quality.

Boundary / caveat

Device owns live audio; each provider owns qualified execution; policy limits export.

Qualification test. Revoke network permission or consent mid-session. No new audio may be exported; in-flight outcomes and cleanup remain explicit.

Actual authority: Device owns live audio; each provider owns qualified execution; policy limits export.

Candidate update: Update routing policy, not native microphone ABI

Update a policy region or model artifact only when the installed host can execute it and its quality/privacy evidence applies. A recorded transcript is not evidence for a new model’s quality.

Inspect every drawn relationship

H1 / H24 — Provider choice: requirement (privacy/quality) = route.policy; offer (local) = local.offer; offer (remote) = cloud.offer; decision (selection) = route.decision

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: mic.pcm → local.pcm | H02 | leased audio
• E2: local.segments → route.segments | H02 | segments / metadata
• E3: route.request → cloud.request | H05 | only if eligible
• E4: local.feedback → mic.feedback | H04 | local result
• E5: cloud.feedback → mic.feedback | H04 | remote result
• E6: policy.policy → route.policy | H23 | privacy constraint
• E7: policy.policy → local.policy | H23 | local requirement
• E8: eval.evidence → route.evidence | H02 | qualification
• Provider choice | H24 | privacy/quality=route.policy; local=local.offer; remote=cloud.offer; selection=route.decision
• mic · Microphone + UI [N15]: Installed microphone adapter; permissions and audio thread remain host-specific.
• local · Local VAD + model [N18]: Owned audio buffers; local inference remains available when network or consent prohibits remote work.
• route · Capability resolver [N32]: Evaluate hard privacy, connectivity and quality requirements before preferences.
• cloud · Remote speech model [N18]: Remote speech receives only permitted payloads under a scoped data policy.
• policy · Privacy / lesson policy [N33]: Content, user consent and residency constrain eligible providers.
• eval · Evaluation corpus [N36]: Assess model output quality separately from replay of orchestration.

Industrial telemetry around a qualified control boundary

Model telemetry and deployment around an external system without claiming ownership of its certified internals.

Vector diagram · click a marked item to inspect

Reaktor design decision

A new anomaly detector can be delivered to a qualified edge runtime. Safety-critical firmware changes remain a separate controlled process, not an automatic extension of graph updateability.

Boundary / caveat

PLC controls physical actuation; broker/store own persisted telemetry; operators authorize commands.

Qualification test. Lose the cloud and deploy an analytics update. Local safety control must remain unaffected; buffer exhaustion must be bounded.

Actual authority: PLC controls physical actuation; broker/store own persisted telemetry; operators authorize commands.

Candidate update: Analytics update; safety/control region excluded

A new anomaly detector can be delivered to a qualified edge runtime. Safety-critical firmware changes remain a separate controlled process, not an automatic extension of graph updateability.

Inspect every drawn relationship

H1 / H22 — Safety separation: member (control) = plc.request; member (analytics) = filter.config; constraint (separation) = ops.config

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: sensor.readings → filter.readings | H02 | sampled telemetry
• E2: filter.telemetry → broker.telemetry | H04 | bounded delivery
• E3: plc.status → broker.status | H04 | control status
• E4: broker.events → store.events | H04 | historian stream
• E5: filter.alerts → ops.alerts | H04 | alerts
• E6: store.trend → ops.trend | H02 | trend
• E7: ops.approved request → plc.request | H23 | approved command
• Safety separation | H22 | control=plc.request; analytics=filter.config; separation=ops.config
• sensor · Sensor gateway [N15]: Calibration, timestamps and sequence are part of the ingress contract.
• plc · PLC / control boundary [N30]: Existing qualified safety/control implementation stays opaque and independent; no generic hot code push.
• filter · Edge filter + detector [N07]: Bounded buffers and event-time semantics; telemetry update must not alter safety control.
• broker · Durable broker [N24]: Explicit retention, QoS and redelivery contract supplied by the broker.
• store · Historian / analytics [N21]: Time-series data remains in a specialized store.
• ops · Operator dashboard [N20]: Operator command has an independent authority path to the control boundary.

A reproducible model experiment and deployment pipeline

Connect experiment reproducibility and runtime deployment without conflating a model tensor graph with the architecture graph.

Vector diagram · click a marked item to inspect

Reaktor design decision

Deploy the resulting model region only where its operators, shapes and memory requirements are supported. Model quality evidence and orchestrator replay validate different claims.

Boundary / caveat

Artifact stores own datasets and weights; the experiment authority pins the full input/run vector.

Qualification test. Change preprocessing but keep the model name. Invalidate dependent evaluation and refuse stale approval.

Actual authority: Artifact stores own datasets and weights; the experiment authority pins the full input/run vector.

Candidate update: Feature/model change widens evaluation closure

Deploy the resulting model region only where its operators, shapes and memory requirements are supported. Model quality evidence and orchestrator replay validate different claims.

Inspect every drawn relationship

H1 / H27 — Experiment provenance: input (data) = dataset.dataset; input (features) = pre.features; input (candidate) = train.candidate; transform (evaluation) = eval.run; output (evidence) = eval.evidence

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: dataset.dataset → pre.dataset | H02 | pinned dataset
• E2: pre.features → train.features | H02 | feature schema
• E3: pre.features → base.features | H02 | same evaluation inputs
• E4: train.candidate → eval.candidate | H02 | candidate digest
• E5: base.baseline → eval.baseline | H02 | baseline outputs
• E6: train.metrics → eval.metrics | H02 | run measures
• E7: eval.evidence → registry.evidence | H28 | claim-indexed evidence
• E8: train.candidate → registry.candidate | H26 | immutable artifact
• Experiment provenance | H27 | data=dataset.dataset; features=pre.features; candidate=train.candidate; evaluation=eval.run; evidence=eval.evidence
• dataset · Dataset manifest [N26]: Versioned, access-controlled references; the graph is not a duplicate of every sample.
• pre · Preprocessing region [N01]: Pin transforms, feature schema and random sources where relevant.
• train · GPU training job [N06]: Durable job lifecycle with checkpoint ownership; model internals may remain opaque source.
• base · Baseline evaluator [N18]: Same evaluation contract, not necessarily identical hardware execution.
• eval · Comparison + gates [N36]: Task-specific claims, confidence and slice coverage; no universal verified scalar.
• registry · Model release authority [N35]: Signed, immutable artifacts and approved target/runtime requirement vector.

Local-first collaborative editing with controlled publication

Put merge-friendly editing beside coordinated publication rather than making every invariant use the same consistency model.

Vector diagram · click a marked item to inspect

Reaktor design decision

A server sync change must remain compatible with offline clients until the allowed upgrade window ends. A graph snapshot is not permission to resurrect deleted document payloads.

Boundary / caveat

Replicas own local drafts; publication authority owns the published revision.

Qualification test. Two disconnected users publish divergent drafts. The exclusive publication invariant must be checked at its authority.

Actual authority: Replicas own local drafts; publication authority owns the published revision.

Candidate update: Protocol update requires mixed-version sync support

A server sync change must remain compatible with offline clients until the allowed upgrade window ends. A graph snapshot is not permission to resurrect deleted document payloads.

Inspect every drawn relationship

H1 / H14 — Draft replica group: replica (replica A) = a.edit; replica (replica B) = b.edit; authority (merge service) = sync.merged

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: a.edit → sync.a | H14 | replica edits
• E2: b.edit → sync.b | H14 | replica edits
• E3: sync.merged → a.merged | H07 | merged draft
• E4: sync.merged → b.merged | H07 | merged draft
• E5: sync.merged → authority.document | H02 | draft revision
• E6: a.publish → authority.publish | H05 | publish command
• E7: authority.version → store.version | H05 | conditional commit
• E8: authority.events → render.events | H04 | durable export
• Draft replica group | H14 | replica A=a.edit; replica B=b.edit; merge service=sync.merged
• a · Editor A / local store [N25]: Local text/draft edits can use a qualified merge scheme while offline.
• b · Editor B / local store [N25]: Replica state and tombstones are application data, not architecture definitions.
• sync · Merge / sync service [N25]: CRDT or operational transformation where the chosen invariant permits it.
• authority · Publication authority [N23]: Exclusive release/publication invariants use a serializable decision, not unconstrained merging.
• store · Versioned documents [N21]: Versioned content and access policy support later retrieval and deletion constraints.
• render · Export / search workers [N06]: Durable downstream processing with source-version identity.

A low-copy camera and GPU processing pipeline

Show how graph contracts preserve meaning without forcing large buffers through generic serialized values.

Vector diagram · click a marked item to inspect

Reaktor design decision

FlexBuffers can carry width/height/format/timestamp and attachment indices. The actual memory path is qualified per backend and may need a copy, fence or process restart.

Boundary / caveat

Native buffer owner controls lifetime; activation generations pin callbacks and consumers.

Qualification test. Replace the processing region while GPU work is in flight. Old callbacks and leases must never target freed code or reused handle slots.

Actual authority: Native buffer owner controls lifetime; activation generations pin callbacks and consumers.

Candidate update: Swap compatible operator after outstanding leases drain

FlexBuffers can carry width/height/format/timestamp and attachment indices. The actual memory path is qualified per backend and may need a copy, fence or process restart.

Inspect every drawn relationship

H1 / H22 — Lifetime constraint: constraint (owner lease) = pool.lease; member (GPU borrower) = gpu.frame lease; member (UI borrower) = ui.preview lease

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: camera.frame lease → gpu.frame lease | H02 | borrow / lease
• E2: gpu.preview lease → ui.preview lease | H02 | GPU fence + view
• E3: gpu.result → ui.result | H04 | structured metadata
• E4: camera.frame lease → encoder.frame lease | H02 | qualified sharing
• E5: encoder.chunks → store.chunks | H02 | encoded stream
• E6: ui.released → pool.release | H02 | release token
• Lifetime constraint | H22 | owner lease=pool.lease; GPU borrower=gpu.frame lease; UI borrower=ui.preview lease
• camera · Native camera resource [N16]: Frame metadata and backing resource have separate lifetime/representation contracts.
• pool · Buffer / resource owner [N26]: Generational handles; release belongs to the allocator/owner that created the buffer.
• gpu · GPU crop + inference [N17]: Explicit synchronization and memory-domain transitions; no unconditional zero-copy promise.
• ui · Preview Surface [N11]: Native rendering continues on its qualified host thread.
• encoder · Encoder / upload region [N17]: Remote boundaries require bytes or qualified shared-memory transport, not local pointers.
• store · Media object store [N26]: Controlled artifact references and retention; raw frame traffic is not graph metadata.

A multi-party allocation problem, not a web of pairwise links

Represent one joint constraint over orders, warehouses, vehicles and time without losing its identity in pairwise edges.

Vector diagram · click a marked item to inspect

Reaktor design decision

A better optimizer is a substitutable implementation if it preserves required feasibility and effect contracts. Its objective/quality claims need fresh comparative evidence.

Boundary / caveat

Input stores own availability; reservation authority owns accepted assignments.

Qualification test. Capacity changes after optimization. Reject or recompute a stale plan rather than committing an over-allocation.

Actual authority: Input stores own availability; reservation authority owns accepted assignments.

Candidate update: Optimize-policy region; approvals invalidate on changed inputs

A better optimizer is a substitutable implementation if it preserves required feasibility and effect contracts. Its objective/quality claims need fresh comparative evidence.

Inspect every drawn relationship

H1 / H09 — Allocation relation: input (demand) = demand.orders; input (capacity) = supply.capacity; input (proposal) = solve.proposal; result (assignment) = dispatch.assignment

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: demand.orders → join.orders | H11 | versioned demand
• E2: supply.capacity → join.capacity | H11 | versioned supply
• E3: join.snapshot → solve.snapshot | H02 | aligned input cut
• E4: solve.proposal → approve.proposal | H02 | proposal + assumptions
• E5: approve.decision → dispatch.decision | H23 | scoped approval
• Allocation relation | H09 | demand=demand.orders; capacity=supply.capacity; proposal=solve.proposal; assignment=dispatch.assignment
• demand · Orders / time windows [N22]: Authoritative availability and requested delivery windows are versioned inputs.
• supply · Warehouses / vehicles [N22]: Capacity, stock and location constraints come from separate qualified sources.
• join · Temporal input join [N07]: Align by a declared cut/window and mark missing or stale observations.
• solve · Allocation optimizer [N01]: Solver profile, objective and limits are explicit; infeasible is a legitimate outcome.
• approve · Human approval [N20]: Approval is revision-scoped and does not waive current availability checks.
• dispatch · Reservation + dispatch [N23]: Revalidate and reserve at the actual inventory/dispatch authority before emitting work.

Reaktor improves a Reaktor system without approving itself

The same system language can describe its own tooling without granting self-modifying code control over the root of trust.

Vector diagram · click a marked item to inspect

Reaktor design decision

Human and agent changes use the same patch/receipt model. External harnesses need OS/tool isolation or an explicit incomplete-governance declaration.

Boundary / caveat

Graph authority owns candidate/promotion; independent policy owns approval; runtime hosts own activation.

Qualification test. Change a candidate after Shadow or weaken its gate in the patch. Release admission must refuse stale or self-authorized approval.

Actual authority: Graph authority owns candidate/promotion; independent policy owns approval; runtime hosts own activation.

Candidate update: Candidate product region only; trust roots remain outside

Human and agent changes use the same patch/receipt model. External harnesses need OS/tool isolation or an explicit incomplete-governance declaration.

Inspect every drawn relationship

H1 / H28 — Acceptance claim: claim (release claim) = draft.claim; evidence (evidence) = shadow.evidence; verifier (independent verifier) = approve.verifier

Some binary arrows are projections of relations that also use policy or descriptor metadata; the H oval shows the explicit n-ary relation. These are proposed descriptors, not compiled source.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Diagram inspection notes

• E1: agent.patch → draft.patch | H25 | typed edit
• E2: draft.candidate → build.candidate | H26 | pinned revision
• E3: draft.candidate → shadow.candidate | H26 | exact candidate
• E4: build.artifacts → shadow.artifacts | H26 | artifact vector
• E5: shadow.evidence → approve.evidence | H28 | claims / coverage
• E6: draft.candidate → approve.candidate | H26 | candidate digest
• E7: approve.decision → rollout.decision | H23 | release authority
• E8: build.findings → agent.findings | H04 | source-linked findings
• Acceptance claim | H28 | release claim=draft.claim; evidence=shadow.evidence; independent verifier=approve.verifier
• agent · Agent + source editor [N39]: A bounded task context identifies region, code, grants and unresolved obligations.
• draft · Candidate graph branch [N23]: Save typed holes during drafting; base revision and mutation authority remain explicit.
• build · Compiler / packager [N34]: Generate region images, source maps and semantic dependency closure.
• shadow · Shadow scenario runner [N36]: Isolated pre-state, prescribed workload and failure injection. Capture is not unrestricted execution authority.
• approve · Independent policy gate [N33]: Agent cannot weaken required tests and approve the same release; trusted verifier boundary is outside the patch.
• rollout · Region rollout controller [N40]: Signed bundle distribution, host admission, atomic local publication and cross-host reconciliation.