Reaktor Product Atlas — Original Source Review — Fable 5

:::info Merged into the canonical guide This exhaustive source review has been combined, corrected, and rewritten for implementation use in Reaktor Product Atlas — Canonical Review and Revamp — 5.6 Ultra. Read the canonical guide first. This page remains public so its measurements, full board inventories, and original reasoning can be audited. :::

Date: 2026-08-27 Subject: /Users/ovd/dev/bestbuds/modules/reaktor.pen — 104 boards, 1,457 component instances, 96 reusable components Author: Claude (Fable 5), with nine parallel analysts Companions: Verified Foundations · Stable Foundations 5.6 Ultra · Reaktor Essays

Evidence basis

Every board was exported from the live .pen file and read in full as text — 191,505 characters across 104 boards. Nine analysts each took a section cluster and answered the same six questions per board: what is actually on it, which part of the Reaktor vision it embodies, where it sits in a real development workflow, what an AI agent does with it, how it maps to Unreal's Blueprint toolchain, and what existing tools it replaces or absorbs. Each then proposed concrete improvements and a verdict.

The source audit reports measurements from the .pen file. Its counts and conclusions belong to that dated source snapshot. The measurement basis excludes the stale pen-truth.json. Where an automated pass produced a false positive, that is recorded with its scope.

Judgements are made against two fixed references: the Reaktor essays for what the framework is trying to be, and the foundation audit for what the code actually does today. A board depicting a subsystem the audit found to be a skeleton is judged on that basis.

The atlas in one page

The file is a product atlas for Reaktor System Studio: a workbench in which a developer maps a whole system, traces any consequence through it, validates claims about it, and acts on it through governed plans. Its entry board states a constitution — the Symphony Contract — promising that workspace, revision, environment, selection, time, principal, and evidence all survive every movement, and that human and agent changes share one path from patch to plan to receipt.

Structurally it is organised twice over. The stated organising principle is a matrix of four movements (Map, Trace, Validate, Act) against eight instruments (Interface, Source, State, Identity, Intelligence, Runtime, Delivery, Product). The actual organising principle is thirteen numbered sections running from North Star through Create, Govern, Graph Substrate, Interface System, Inner Loop, Ship, Agent Operations, State and Trust, Observe, Learn, AI Engineering, and Runtime and Extensibility. Twenty further boards depict states of two flows — a five-step Composer wizard with five provisioning outcomes, and five deployment states — plus five shell breakpoints.

The craft is real. Eighty-four of eighty-nine product boards carry a complete identity chain — workspace, revision, environment, principal — and the V2 band grammar has genuinely landed file-wide. This is a more coherent design system than most shipped products have.

The diagnosis

Nine findings, in order of severity. Each is measured, and each is developed in the section-by-section review that follows.

1. The fixture data contradicts itself, which disproves the atlas's own thesis

Reaktor's central claim is that the diagram of the system and the system are the same object, so the diagram cannot lie. This atlas is a diagram that lies, and it can be proven from the boards alone without reference to any code:

• The rollback dialog offers a known-bad release as the healthy restore point. STATE · Deploy · Rollback Confirmation proposes restoring rc-810 as verified · healthy · 100% traffic. Five other boards — 07.04 and four deploy states — record that same release, same sha 4f81dc0, as rolled back · 1d ago. This is the most irreversible screen in the product.
• One release candidate has three test denominators. rc-812 shows Maestro · 14/14 on three boards, Maestro · 12/14 on another, and Maestro flows 21/22 on 07.02; unit tests are 1,284 on four boards and 142 on 07.02. There is no continuous integration behind any of them.
• The same figure is both a daily and a monthly cost. 11.04 labels $118.00 as BY RESOURCE · JUL MTD; 12.02 labels the same $118 as cost / day and 11.05 as AI cost/day. That is a thirty-fold discrepancy, and 11.05 prints "numbers always match" directly beneath its copy.
• One trace has two durations. Trace abc4f1e2 appears on both 06.04 and 10.01 with different totals.
• One subsystem is routed four ways on one revision. Moderation runs on llama-3.3-70b, llama-guard-3-8b, haiku, and workers-ai depending on which board you open — all under revision 8f41c2.
• Retention data is provably authored. 11.02's W1 column reads 68, 70, 71, 72, 74, 75, 77 — strictly monotone with zero reversals across seven cohorts. Real retention never looks like this, and the board's own AI answer then claims a cohort is an outlier against a table in which no outlier is possible.

A design file is allowed to use sample data. It is not allowed to use sample data that contradicts itself, because the moment a reader notices one contradiction, every number in the atlas becomes unreliable. For a product whose thesis is that the picture cannot lie, this is not a cosmetic problem — it is the thesis failing on its own artefact.

2. The evidence block is a constant

The evidence grammar is not underused so much as un-bound. Where it appears, it appears as copy-pasted chrome carrying identical values about unrelated subjects.

Seventeen boards — a design system, an AI trace viewer, a knowledge atlas, a visitor lab, a primitive catalogue, an FFI switchboard — each claim exactly twelve findings of which three block, exactly fourteen tests across three deploy targets, and confidence of exactly 1.0.

Every one of those seventeen contradicts itself. All state Runtime observation is not wired in the findings block, and eighteen lines below, Observed — runtime · 3s with Confidence — 1.0 / exact. On 03.04 the words Truth UNKNOWN · not wired sit nine lines above Confidence 1.0 / exact on the same card.

This includes 13.03 · FFI Switchboard, otherwise the best board in the file. Its structure is the correct template; its values are the same constant as everywhere else. The template is right and nothing has ever been filled in.

3. The evidence discipline reaches the periphery and stops at the core

Across all ten boards of Section 04 — the graph substrate, the most important cluster in the atlas and the one closest to Reaktor's central claim — the fields Effect, Permission, Origin, Confidence, and Revision appear zero times, and Truth appears once as a plain row label. Across the other eighty product boards, Permission and Truth appear on thirty each, Revision on twenty-eight, Owner on twenty, and Effect, Origin, and Confidence on seventeen each.

Meanwhile 04.01 alone carries 54 unit-bearing numeric assertions with no provenance — roughly one in twelve of the entire atlas's total — including throughput figures for a Google Pub/Sub island on a plane the audit found has no queues at all.

4. Time is the invariant that broke

Of the seven things the Symphony Contract promises survive every movement, six hold up well and one does not.

Three quarters of the atlas shows data with no as-of, no TTL, and no staleness, in a product built to answer whether what you are looking at is still true.

5. The atlas depicts Reaktor's structure and not its semantics

Counted across all 104 boards: ports and wires appear on 54, actors on 36, scopes on 31, capabilities on 19, adapters on 14. Against that — visitors on 4, one of the four pillars of the vision; graph code push on 4; backpressure and credits on 3; conformance on 3; FlexBuffers on 2, the data plane the entire polyglot claim rests on; invariants on 2; idempotency on 1. Choreography, saga, and session types: zero. Eigenvector, spanning, and redundancy — the framework's own stated principle for choosing primitives: zero.

A developer could learn the shape of a Reaktor system from this atlas and would learn nothing about what makes one correct.

6. There is no assurance section

lincheck, property test, model check, fuzz, differential, defect, and counterexample each appear zero times across all 104 boards. invariant appears twice. fingerprint appears twice — for the keystone primitive of the entire verification programme, and neither instance refers to it.

Thirteen sections for activities, none for correctness. This is simultaneously the atlas's largest content gap and the most defensible thing Reaktor could show anyone.

7. Governance forks into four mechanisms where the contract promises one

The Symphony Contract states that human and agent changes share one path from patch to plan to receipt. In practice:

• 07.04 governs a bundle — Bundle #1042 · 7 commands under PlanApproved · plan_8dd4 · actor alice · approver bob · independent · expires 9m · sha256:…· one use. This is the contract drawn correctly, once.
• Section 08 governs a command — approved cmd #14, BLOCKED cmd #11, 12 commands proposed · 0 applied.
• 12.05 invents a third path, PromoteChain, gated by continuous integration that does not exist.
• 12.02, 12.04, and 12.06 use a fourth — bare buttons acting directly on production, including an ask cell drafting SetProperty(matching.threshold, 0.68).

Approving twelve commands individually has different atomicity and different rollback behaviour than approving one sealed plan. These are two transaction models sharing a word. Not one board in Section 08 or 12 shows a plan id, a receipt, a hash, or an approver distinct from the requester — and the receipt chain that 07.04 establishes vanishes on the four deploy states that follow it, none of which say which receipt authorised the act they are performing.

8. Provenance is mis-encoded rather than missing — and this is the cheap fix

Thirty-five boards do mark provenance, in strings like session adapter not connected, FIXTURE · no geo adapter, masked by policy, DESIGN FIXTURE, and adapter not wired. These marks are legible to a human and invisible to a query, because they live in V2 band labels as text rather than in the TruthMark component.

That means the atlas is not 2.5% honest and 97.5% silent. It is roughly 40% honest in a form nothing can enforce. Making the V2 band label a slot that renders a TruthMark component would move all thirty-five boards into the queryable, gate-able set without redesigning any of them — the single highest-leverage change available.

9. Substantial redundancy above healthy chrome

Shared chrome is 27.6% of all text, which is the shell doing its job correctly. Above that: 04.06 and its two states overlap at 0.84–0.87; 02.01 is a string-for-string duplicate of Composer · 3 of 5, making eleven Composer boards where there is one; the five provisioning states share a byte-identical five-row ledger, so Complete claims 5 / 5 verified above three rows still marked blocked. In total 191 board pairs share more than 30% of their unique content, and sixteen boards are chrome with a label — including 05.03 · Command Palette, the single most important surface humans and agents share, at 48 unique lines.

One apparent case of redundancy is not one, and the correction is worth stating because it shows the limit of text-only measurement. The three Expanded-1600 shell states are textually identical, which a text comparison flags as triplication. Reading their fills shows they are honest theme forks — dark on #9EABC1 and #6F8FFF, light on #526078, #315BFF and #087A4A, high contrast on #FFFFFF, #00FFFF and #00FF88. They are three legitimate boards maintained by hand. The real defect there is different: the light and high-contrast token values appear nowhere in the design system.

10. The design system has drifted out from under the atlas

The Machine Signal board is a legend for a system nobody draws in any more.

• The documented palette is not the painted palette. All eighteen colour tokens on 05.00 appear between two and eleven times in the entire 18MB export — essentially only inside their own swatch chips. The colours actually painting the atlas are a different set: #9EABC1 with 7,178 uses, #F4F7FB with 3,977, #263349 with 2,842, #6F8FFF with 2,057. Node-kind colours survived a migration; surfaces, text, accent, status and wire colours did not.
• The truth marks collide at the pixel level. #F5B84B1F renders Stale, Partial, Remote Reversible and Approval Required simultaneously. #8DA7FF1F renders Source, Read Only and Local Write. A component that writes and a component that cannot write are the same pill — which breaks the Symphony Contract's own clause that truth, effect and permission stay independent, not by omission but by rendering.
• The shell is 86 hand-copies and has provably drifted. There are 86 layers named Command Bar, 86 Context Spine, 84 Status, 82 Workspace Bar. Eighty-two boards carry a layer named Status / policy loaded · v19; only four still display that string, while seventy-five display policy required. Layer names and rendered text have come apart.
• The agent's contract changes with screen width. At 1600 the agent affordance reads Ask · Propose; at 768 and 390 it reads Ask. The same shell also silently drops 128 Source from its truth mix at 768, so one system reports 149 entities on a laptop and 21 on a tablet.

Every truth-vocabulary instance in the atlas — all nineteen by exact component name — lives on 05.00. So does the only instance of each data-bearing component. Ninety-six other layers have "Metric" in their name and are hand-drawn.

What follows

Part 3 gives the evidence template — the reusable specification reverse-engineered from 13.03, which is the mechanism that fixes findings 1 through 4 and 8 at once. Parts 4 to 12 review every board, section by section. Part 13 collects the new panes the atlas needs. Part 14 proposes the taxonomy after revamp. Part 15 is the seamlessness programme, and Part 16 sequences the work.

Part 3 · The evidence template

13.03 · Extend · FFI Switchboard is not a better-looking board than the other 103. It is the one board with a grammar, and the grammar is what should be lifted. What follows is that grammar written as a specification a designer can apply to any board tomorrow. It is the mechanism that fixes diagnoses 1 through 4 and 8 at once.

13.03 · Extend · FFI Switchboard is not a better-looking board than the other 103. It is a board that has a grammar, and the grammar is what should be lifted. What follows is that grammar written as a specification a designer can apply to any board tomorrow.

The template exists to satisfy one promise the atlas already makes on 00 · START HERE: "Map the whole system, trace any consequence, validate every claim, and act through governed plans — without losing workspace, revision, environment, selection, time, principal, or evidence." Those seven carriers are the template's reason to exist. Every region below either carries one of them or renders the object under study. Nothing else is allowed in.

The regions

R1 — Identity strip (mandatory). The top line carries five of the seven carriers at once: workspace and product path (bestbuds / extend-ffi-switchboard), revision (8f41c2), environment (LOCAL), principal (ovd), and two entry points — the command palette (⌘K, labelled Search · Navigate · Run · Change · Ask) and the agent (Ask · Explain · Propose). This strip must be byte-identical across all 104 boards. Its job is to prove that moving between boards did not silently change who you are, which revision you are reading, or which environment you would write to.

R2 — Movement and instrument selector (mandatory). Map ⌘1 · Trace ⌘2 · Validate ⌘3 · Act ⌘4 and the eight instruments Interface · Source · State · Identity · Intelligence · Runtime · Delivery · Product. Every board is one (movement × instrument) cell and must show which cell it is by selection state, not by its title. A board whose content does not match its declared movement is a defect the selector makes visible — this is exactly how 13.02 fails, below.

R3 — Scope rail (mandatory for any board whose subject is a set; optional for a single-object board). Three stacked parts. A free filter (Filter entities, findings…), a SYSTEM group of structural scopes (Everything · Product islands · Runtime fabric · External boundaries), and a SAVED group of stored queries (Blast radius · Security findings · Changed since main · Unknown evidence). The rail closes with R4.

R4 — Coverage declaration (mandatory, one per board, no exceptions). One sentence, two halves, separated by a middle dot: what is real, then what is not. Kotlin source · foreign targets designed. Desktop source · MCP parity proof pending. This is the single most valuable component on the model board and the one most obviously missing from 13.01 and 13.02.

The rule that makes it honest: it is a bound component, not a text field. The first half must resolve to a module path plus a revision. The second half must resolve to a document anchor. A board that cannot fill both halves from real references may not render the component — it must instead render COVERAGE · UNDECLARED, which is a visible defect, not a blank.

R5 — Board thesis (mandatory). Two lines. A title that names the object in the system's own vocabulary (FFI Switchboard — explicit contracts across runtime boundaries) and a dimension line (ABI · schemas · ownership · cancellation · streaming · conformance). The dimension line is a contract with the reader: every dimension named must resolve to a region on the board or to an explicit gap marker. 13.03 names six dimensions and delivers on roughly one and a half, which is the board's central failure.

R6 — Mode strip (mandatory). SOURCE · MAP · TRACE · VALIDATE · ACT · EXPLORE · EDIT · DEBUG · COMPARE. Nine modes, exactly one active. The rule: a mode must either produce a materially different rendering of the same selection, or render disabled with a one-line reason. Nine always-enabled modes that all show the same plane is worse than three modes that work.

R7 — Query bar (mandatory). Query · kind: owner: truth: path: with / as the focus key. The four typed facets are what turn the truth vocabulary from decoration into an index. truth:unknown must be a runnable query — that single capability is what would let a reviewer find the atlas's own 49 unmarked boards. Facets are extensible per section; kind, owner, truth, path are the floor.

R8 — Revision and layer strip (mandatory). main@8f41c2 (base), Δ5 · DRAFT (uncommitted delta count and draft state), L2 · FEATURE (semantic level), then layer toggles BASE · STRUCTURE / + RUNTIME / + CHANGE / TESTS / +3. Two things are separated here and must stay separated: semantic level (how much of the graph you resolve, L0 to L4) and overlay layers (which evidence planes are composited on top). Boards routinely conflate them.

R9 — Plane header (mandatory). Three bound values: the dual-plane declaration (DESIRED + OBSERVED), liveness (LIVE · 2s), and evidence coverage (EVIDENCE · 94%). All three are computed. The dual-plane declaration is a state, not a label: legal values are DESIRED ONLY, OBSERVED ONLY, DESIRED + OBSERVED, and DESIRED + OBSERVED · CONFLICT. If a board renders DESIRED + OBSERVED while its findings ledger says Runtime observation is not wired, the header must fall back to DESIRED ONLY automatically. 13.03 violates this today.

R10 — The plane (mandatory). Named for what it renders and how it was derived: BOUNDARY PLANE · SOURCE-DERIVED, PROJECTION PLANE · IDENTICAL SNAPSHOT HASH. Immediately below sits the density control, L2 · SCOPE · STANDARD DENSITY, which is three independent settings — level, grouping, density — and should read as three controls, not one string.

The plane holds entity cards. Every card carries exactly four things: a name in system vocabulary (TYPESCRIPT GUEST), a role line naming its concerns (Workers · events · promises · streams), a truth stamp (SOURCE · main, OBSERVED · 3s, UNKNOWN), and an Inspect ↗ affordance that navigates without losing selection. A card with no truth stamp is invalid.

R11 — Findings ledger (mandatory). A counter (12 findings · 3 blocking) and a typed list. 13.03 shows four classes; the full set should be six: Conflict (two claims disagree), Unknown (a claim cannot be made because something is not wired), Stale (an observation exists but is older than its freshness horizon), Impact (what a change here would touch — 14 tests · 3 deploy targets), Policy (what governs a mutation — Approval required before mutation), and Defect (a known D-* or S-* finding scoped to this object). The atlas has no Defect class today, which is why the twelve security findings and the port-identity defect appear nowhere.

Two binding rules. A Conflict must name both operands — Desired and observed claims disagree is a class label masquerading as a finding; the real finding reads desired: TS guest present in HELLO capability table · observed: no HELLO ever exchanged. And the counter must be the length of the list; if the list is truncated, the truncation is shown.

R12 — Selected path (mandatory). The causal chain this board exists to let you walk: Contract → generated boundary → runtime call → trace → conformance receipt. Each hop is a navigation target, and each hop carries its own truth stamp, so a chain that goes dark halfway is visible as such. This is the region that makes selection survival concrete rather than promised.

R13 — Selection inspector (mandatory). Four stacked parts.

1. Subject line, typed: Boundary / chat.realtime. Kind first, then identity.
2. Qualifier line, one sentence of honest nuance: Source contract · native parity not yet proven.
3. The three independent axes, each in its own slot and never merged into a single badge: Truth (UNKNOWN · not wired), Effect (READ ONLY), Permission (APPROVAL REQUIRED). The Symphony Contract names a fourth — Lifecycle — which 13.03 omits and which the template must add, because a boundary that is Draft, Active, Deprecated or Removed behaves differently under every other axis.
4. The evidence block, R14.

R14 — Evidence block (mandatory, five fields on the model board, seven in the template). Origin (source:main), Observed (runtime · 3s), Confidence (1.0 / exact), Revision (spec@8f41c2), Owner (platform). Two fields must be added.

Method — how the observation was made: read, sampled, replayed, computed, asserted. Without it, Confidence 1.0 / exact is unfalsifiable. And Horizon — the age at which this observation becomes Stale, which is what converts Observed · 3s from a timestamp into a judgement.

Field-level rule: Observed and Confidence render as — when Truth is UNKNOWN. It is not possible to have observed something at exact confidence three seconds ago that is simultaneously not wired. This one rule would have caught the model board's own contradiction.

R15 — Commit affordance (mandatory when Effect is not READ ONLY; hidden otherwise). One button, Commit, and it must be the only write path on the board. Every mutation on every board therefore travels the same patch → plan → receipt route the Symphony Contract promises.

R16 — Footer status ledger (mandatory). Five self-reports: working-tree state (main · clean), projection provenance (source projection · designed), selection state (selection synced), governance state (policy required), and measurement state (performance · unmeasured). The last one is the atlas's best habit and should never be dropped: a board that has not measured itself says so in its own footer.

Mandatory versus optional

Mandatory on every board: R1, R2, R4, R5, R6, R7, R8, R9, R10, R11, R13, R14, R16. That is thirteen of sixteen regions.

Conditional: R3 (scope rail) only when the subject is a set; R12 (selected path) only when the board has a causal chain to offer, which for a Map-movement board it may not; R15 (commit) only when effect is not read-only.

Optional and section-specific: extra planes below R10 — 13.01's operations catalog and run ledger, 13.02's inventory table. These are free-form but inherit the card rules from R10: name, role, truth stamp, inspect.

The four validity rules

V1 — Independence. Truth, Effect, Permission and Lifecycle occupy four separate slots and never collapse into one status chip. This is a direct restatement of the Symphony Contract's second clause and it is the rule the atlas breaks most often, because a single coloured badge is easier to draw.

V2 — No orphan numerals. No numeral may render without a truth stamp inside the same component. 12 findings, 94%, 14 tests, 3 deploy targets, Δ5 are all currently orphans. The honest alternatives are a stamped number, or the number's absence with a stated reason. Section 1 of the brief already gives the doctrine: "NotWiredYet that states what is missing is a better answer than an invented number."

V3 — Conflicts name operands. See R11.

V4 — Coverage bounds the plane. No card may claim a truth class stronger than the board's coverage line permits. If coverage says Kotlin source · foreign targets designed, then the C++ GUEST card cannot read SOURCE · main; the strongest legal stamp for it is DESIGNED. This one rule, mechanically enforced, would remove most of the atlas's dishonesty in a single pass.

How a board declares its coverage honestly

Four steps, in order.

1. Name the artefact that makes the real half true — a module path, a test name, a run id. If you cannot name one, the real half is empty and the coverage line reads NOTHING WIRED · <subject> designed.
2. Name the anchor that makes the designed half true — a spec section, a roadmap phase. 13.03's designed half should read foreign targets designed · spec §8 trunk matrix · P2–P4.
3. Set the plane header (R9) from the coverage line, not by hand. Designed-only coverage forces DESIRED ONLY.
4. Push the coverage class down to every card via V4, and let the cards that fall back to DESIGNED be visibly different from the ones that do not. A board where three of four cards read DESIGNED is not an embarrassing board; it is an accurate one, and it tells a planner exactly where the work is.

Applying the template to a new board tomorrow

Take the target board. Write its coverage line first, before drawing anything — it decides the ceiling for everything else. Write the thesis dimension line second, and treat it as a checklist of regions you now owe. Draw R1, R2, R6, R7, R8, R16 as fixed chrome copied verbatim. Choose the plane's derivation label and put every entity on a card with the four required parts. Enumerate findings by class and let the counter compute itself. Write the selected path as the chain a reader actually needs to walk, and mark the hop where it currently goes dark. Then fill one selection inspector for the most interesting entity, with all four axes and all seven evidence fields, and delete any field you cannot source rather than inventing it.

The finished board is correct when a stranger can answer three questions from it without asking: what part of this is real, what would happen if I changed it, and who has to say yes.

Part 4 · Section 00–01 — Entry and North Star

Boards covered: 20 (00 START HERE, 01.01–01.05, the REFERENCE LIBRARY board, and the thirteen SECTION banners as one grouped entry).

00 · START HERE — Reaktor Product Atlas

On the board. This is a poster, not a surface. It carries a masthead ("REAKTOR · SYSTEM STUDIO / One system. / Four movements. / Every instrument."), a one-sentence thesis promising to "Map the whole system, trace any consequence, validate every claim, and act through governed plans—without losing workspace, revision, environment, selection, time, principal, or evidence", a four-line THE SYMPHONY CONTRACT block, an EIGHT INSTRUMENTS list (Interface, Source, State, Identity, Intelligence, Runtime, Delivery, Product), a single truth chip reading "SOURCE / Design contract · implementation proof varies by surface", and four movement cards. Each movement card has the identical internal anatomy: a title and subtitle, a "COMPOSE WITH ANY INSTRUMENT" list of four entries, a "CORE MOVEMENT" list of three verbs, and a one-line "OUTPUT". Map outputs "GraphLink · findings · draft patch"; Trace outputs "Causal path · evidence bundle · explanation"; Validate outputs "Findings · gate verdict · approval prerequisites"; Act outputs "Sealed plan · run events · immutable receipt".

The movements, judged as a taxonomy. The four movements are the strongest single idea in the atlas and they should survive any revamp untouched. Map, Trace, Validate, Act is an epistemic loop — what is the system, why did it do that, is the claim true, change it — and it is precisely the loop that only a live runtime graph can close. In a system where the graph is compiled away, Trace is a stack of log lines and Validate is a CI badge; in Reaktor's thesis they are queries against a resident object. The movements are also correctly typed by their outputs: every movement ends in an artifact that the next movement can consume, and "Act" ends in an "immutable receipt" rather than a deploy. That is a genuine design commitment and the boards downstream mostly honour it.

Two problems. First, the movements are declared as a partition but function as an ordering, and the atlas never says whether a board may sit in two movements at once — yet eleven boards name two (04.08 · Act + Source, 06.05 · Validate + Delivery, 09.04 · Map + State). If a movement is a phase, a board cannot be in two; if it is a facet, the four cards should not read as a sequence. The board never decides.

Second and much more serious: Validate is hollow. Its four composable entries are "Tests & Gates", "Identity Policy", "AI Evals", "Accessibility & Performance". Not one of those is a correctness proof. Three of the four are policy checks — did a rule pass, did a person approve — and the fourth is a benchmark. The core-movement verbs confirm it: "Generate impacted verification sets", "Expose stale / partial / unknown truth", "Block unsafe effects before approval". Those describe an approval workflow, not an assurance program. Against §2, where the credibility of the entire product rests on the L0–L5 ladder and the one-fingerprint keystone, this is the atlas's defining gap. The word "invariant" appears twice in 104 boards; "lincheck", "property test", "model check", "differential", "counterexample" appear zero times. The movement that is supposed to make "the diagram cannot lie" true has been staffed with a release checklist. And "Tests & Gates" is itself unbacked, because §2 establishes that no CI exists — the only framework workflow file is fully commented out.

The instruments, judged as a taxonomy. The eight instruments are not an eigenbasis, and this is why the matrix does not work. They mix three incompatible kinds of thing. Interface, Source, State, Runtime and Delivery are layers or lifecycle stages of a system. Identity is a cross-cutting concern that applies to all five of them — it is, in §1's own language, a visitor: "auth wraps a boundary". Intelligence is a technology class, not a peer of State. Product is an audience view — outcomes, retention, cost — that sits above all the others rather than beside them. A matrix column axis must be a partition; this one is not. That failure is measurable in two ways.

The first measurement is cell coverage. Of the 4 × 8 = 32 cells, exactly 10 are populated: Map × State (09.04), Map × Intelligence (12.03), Map × Runtime (13.01), Trace × Interface (06.01), Trace × Runtime (10.01 and 13.02), Trace × Product (11.01), Validate × Delivery (06.05), Validate × Identity (09.01), Act × Source (04.08), Act × Delivery (07.04). Twenty-two cells are empty. The Validate row has six of eight columns empty; Act has six of eight empty. There is no Validate × Runtime board (deterministic simulation, chaos, the L5 tier), no Validate × Source board (property tests, lincheck, differential conformance, the L2 tier), and no Validate × State board (data invariants). The three empty cells that matter most are exactly the three tiers of §2's verification program.

The second measurement is adoption. §3 records the constitution's claim that "Every board is a (movement × instrument) cell". Only 15 of the 69 numbered boards name a movement at all, and only 11 name an instrument alongside it. The other 54 use a parallel vocabulary of legacy verbs — Graph, Interface, Inner Loop, Ship, Trust, Observe, Learn, Optimize, AI, Create, Govern, Extend, Scale, North Star. The atlas has two taxonomies stacked on one another and has never reconciled them. That is the deepest structural fact about this document, and it is visible from the entry board alone.

Where the instruments under-serve §1. Four of the vision's load-bearing ideas have no instrument to live in. Adapter and capability — the central platform abstraction of a KMP framework, where "product code branches on capability, never on platform" — has no axis; capability tiers surface only as a wizard step (STATE · Composer · 3 of 5 · Targets & Capabilities) and a node badge on 01.01 ("MediaUploader / CAPABILITY"). Polyglot on one data plane has no axis; the FFI, which the audit calls a skeleton whose Transport is four TODO()s, is smuggled into "Runtime" and parked in section 13. Visitors have no axis, which is ironic because Identity — an instrument — is a visitor, and treating it as a column is what breaks orthogonality. Graph code push has no axis and, as far as the manifest shows, no board anywhere in the atlas.

Where the instruments over-serve. Intelligence gets two whole sections (08 Agent Operations, 5 boards; 12 AI Engineering, 7 boards) for twelve boards total, which is 17% of the numbered atlas devoted to one instrument, while Delivery gets four and the entire assurance program gets zero. Product likewise gets a five-board section (11) built on retention, experiments and cost — legitimate, but it is the instrument furthest from anything the audit says exists.

Vision tie. This board embodies the thesis of §1 but not its mechanics. "Selection survives every movement" and "Truth · effect · permission · lifecycle stay independent" are precise, testable, framework-shaped commitments and they are the right constitution. But nothing here mentions typed ports, nesting graphs, eigenvector primitives, adapters, or the live-at-runtime choice that is the product's actual bet. A reader who saw only this board would think Reaktor was an IDE shell, not a runtime graph substrate. The single most load-bearing sentence in §1 — "the diagram of the system and the system are the same object, so the diagram cannot lie" — does not appear.

Workflow tie. Nobody opens this board in a working week. It is a first-day orientation poster and a pitch slide. That is a legitimate job, but it means the constitution lives on a surface no engineer ever returns to, so its rules are never enforced at the moment of use.

Agentic tie. An agent reads a taxonomy here and nothing else. There is no machine-readable statement of which cells exist, which boards implement them, what a GraphLink is, or what a "sealed plan" contains. An agent cannot use this board to navigate the atlas because the board does not enumerate the atlas. This is the board most in need of being a node rather than a picture.

Blueprint tie. This is the Unreal documentation landing page, not any editor. The closer analogy is the Unreal Editor's mode switcher — Select / Landscape / Foliage / Modeling — which is a real, always-present control, whereas Map/Trace/Validate/Act appear here as poster cards and only become real on 01.01 as "⌘1 ⌘2 ⌘3 ⌘4".

Replaces / augments. As a document it displaces the architecture-decision README and the onboarding Notion page. As a promise it stakes claims on Datadog (Trace), Sentry (Trace), LaunchDarkly and Spinnaker (Act), Backstage (Map), and — on paper only — the assurance tools it never names.

Improvements.

1. Add a Cell Coverage pane to the board: a 4 × 8 grid where each cell shows the board ID that implements it or the string NotWiredYet. Twenty-two cells would read NotWiredYet today, which is the honest state and immediately makes the missing Validate row visible.
2. Replace the lone "SOURCE / Design contract · implementation proof varies by surface" chip with a Wiring Ledger strip carrying three counts and a FreshnessStamp: surfaces designed, surfaces wired, surfaces proven. Per §2 that reads "69 designed · 30 wired · 0 proven", and it converts the atlas's biggest liability into its most credible statement.
3. Rewrite Validate's "COMPOSE WITH ANY INSTRUMENT" list from "Tests & Gates / Identity Policy / AI Evals / Accessibility & Performance" to the assurance ladder: "L0 Hygiene & CI / L1 Invariants & Defects / L2 Property, Lincheck & Differential / L3 Model Checking / L4 Proofs / L5 Deterministic Simulation", each entry linking to a board in the new Assurance section.
4. Give the board the shell every other board has — the ⌘K bar, the breadcrumb, the revision chip, and the ⌘J evidence drawer. The constitution board is currently the one board that does not obey the contract it declares, which undercuts the contract more than any missing feature.
5. Add a Fingerprint entry to the instrument rail or a dedicated strip. §2 names one fingerprint system unifying port type identity, codec layout identity and FFI method identity as the keystone primitive; the word appears twice in 104 boards. If it is the keystone it belongs on the constitution.
6. Add a fifth contract line stating the movement composition rule explicitly: whether a board may occupy two cells, and if so what the pair means. Eleven boards already do this and the rule is unwritten.

Verdict. Rebuild. The four movements survive; the eight instruments and the "every board is a cell" claim do not.

01.01 · North Star · Mission Control

On the board. This is the atlas's densest board and its most complete shell. The top chrome carries the product mark, a breadcrumb "bestbuds / mission-control / harden-auth", a revision chip "8f41c2", an environment chip "LOCAL", a ⌘K command bar labelled "Search · Navigate · Run · Change · Ask", an "Ask · Delegate" affordance, and a principal chip "ovd". Below sit the four movement tabs with "⌘1"–"⌘4" and an instrument rail. The left rail groups navigation under MAP (Mission Control, System Map, Interface, Source, State, Identity), TRACE (Runtime, Delivery, Product, Intelligence) and "VALIDATE · ACT" (Findings, Plans & Runs, Evidence, Extensions), then a CONNECT SYSTEM card ("Connect brownfield code or start a governed GraphSpec. / Open composer"). The body carries an ACTIVE MISSION card ("bestbuds / media-upload · owner platform · success: zero unauthorized writes / 3 blockers"), a four-node port-graph strip (PhotoAttachment EVENT → MediaUploader CAPABILITY → media-service EDGE → R2 media BLOB, each with "▶ exec / result ▶ / input / output" and edge labels "tap → upload", "auth + key", "POST /media", "owned object"), a lifecycle ribbon ("Intent / Graph patch / Code / Tests / Preview / Release / Observe" with "Builder implementing · Critic reviewing · 18 passed / 3 unknown"), a "Runtime fabric / OBSERVED · 3 SOURCES · 8s" metric block (Targets 14, Build gates 3, Tests 248 at 96.8% pass, Truth drift 6), an evidence timeline, a truth ledger with four rows (Runtime LIVE, Source SOURCE, Tests PARTIAL, Docs STALE), an "Open findings · release gate" list of three, a "Verified context pack" card ("main@8f41c2 · 38 entities · 12 source slices · 21 tests · evidence-linked") with "Inspect" and "Drive with Codex", and a ⌘J evidence drawer. The status bar reads "main · clean / mission r82 · source+live / selection synced · 5 surfaces / policy v19 · loaded / resume ready".

Vision tie. This is the best single expression of §1 in the atlas. The mission strip is a typed port graph with real port kinds (EVENT, CAPABILITY, EDGE, BLOB) rather than boxes-and-arrows, so the eigenvector-primitive idea is visible as a first-class visual grammar. The "Truth ledger" and its rule — "Every claim exposes truth, origin and freshness. Partial, stale and unknown evidence can never render as live green or unlock an effect" — is the evidence discipline of §1 stated as a UI invariant, which is the correct place to state it. Agents-as-operators is present through "Builder implementing · Critic reviewing" and "Drive with Codex". What is absent is nesting: the mission graph is four flat nodes with no subgraph, so the "a feature is a subgraph of an app, an app is a node in a product" claim is asserted nowhere on the home board.

Workflow tie. This is the tab an engineer leaves open all day and the screen a lead opens at standup. The mission framing — one named objective carrying "the same scope, revision, evidence, findings, plan and run across Map, Trace, Validate and Act" — replaces the daily reconstruction of context across Linear, GitHub, Datadog and Slack. Today the same person opens five tabs and rebuilds the mental link between a ticket, a branch, a dashboard and an incident by hand.

Agentic tie. An agent reads a mission with an explicit success criterion ("zero unauthorized writes"), a blocker count, a typed graph patch ("Graph patch #82 / 4 typed commands · blast radius 7 targets"), and a pre-assembled context pack with entity, slice and test counts. That is unusually good agent input: blast radius is exactly the number an agent needs to decide whether to propose or escalate. Governance is present through the critic and "policy v19 · loaded". The weakness is that "Drive with Codex" and "Ask · Delegate" imply an agent may act, while the sibling boards 01.02–01.05 all say "Ask · Propose" and gate every effect behind "APPROVAL REQUIRED". The atlas has two different agent-authority models one board apart and never explains the difference.

Blueprint tie. This is not a Blueprint surface at all — it is the Unreal Project Launcher plus the Session Frontend, the place you pick what you are working on and see health. The port-graph strip is a Blueprint fragment embedded in a dashboard. The analogy breaks in a way that flatters Reaktor: Unreal has no notion of a mission carrying evidence across tools.

Replaces / augments. Linear or Jira (mission, blockers, owner), Backstage (service catalog and ownership), Datadog and Grafana (the runtime fabric tile), Sentry (open findings), GitHub's PR page (graph patch and review), and the Copilot Workspace / Codex task pane.

Improvements.

1. Reconcile the three test counts. The board says "Tests 248 / 96.8% pass", "Tests 18/21 · 3 unknown", and "Worker auth suite 39/39 passed · 4m ago" with no relationship between them. Make the tile a single Test Ledger with columns for scope, run reference, passed, unknown and freshness, and give the 96.8% a RunRef or delete it.
2. Attach a TruthMark and SourceRef to every number in the fabric tile individually rather than the one shared "OBSERVED · 3 SOURCES · 8s" header. Four counters currently inherit one provenance chip, which is the exact pattern §3 flags across 49 boards.
3. Add a Blocker row type to the ACTIVE MISSION card that names each of the "3 blockers" with its finding ID, owner and the effect it blocks. The count is on the board; the items are not, so the primary call to action ("Continue mission") has no target.
4. Fix the instrument rail: it reads "Mission / Source / State / Identity / Intelligence / Runtime / Delivery / Product", silently substituting Mission for Interface. Either the constitution's eight instruments are wrong or this rail is. Restore Interface and move Mission to the breadcrumb where it belongs.
5. Make the port-graph strip expandable in place. Add a disclosure control on MediaUploader that reveals its subgraph, so the home board demonstrates nesting — the one §1 idea it currently omits.
6. Add a Capability tier chip to the MediaUploader node showing which tier is available on the current target. The node is already labelled CAPABILITY; showing the tier is what makes "branch on capability, never on platform" legible.

Verdict. Strengthen. This is the atlas's anchor board and it earns its density; the fixes are provenance and one taxonomy error, not structure.

01.02 · North Star · Auth System Slice

On the board. A four-quadrant slice of the identity plane inside the full System Studio shell. The header adds "surface: Auth System Slice / projection: designed / Inspect evidence". A SCOPES & QUERIES rail offers SYSTEM scopes ("Everything / Product islands / Runtime fabric / External boundaries") and SAVED queries ("Blast radius / Security findings / Changed since main / Unknown evidence") plus a COVERAGE line, here "Source finding · negative authorization tests required". The canvas header reads "Auth System Slice — identity, policy, sessions and resource decisions / UI · auth kernel · session store · Workers · membership · audit evidence" with a truth chip "FAILED · run_7f2a", and a control strip carrying MAP/TRACE/VALIDATE/ACT, EXPLORE/EDIT/DEBUG/COMPARE, a typed query field ("kind: owner: truth: path:"), "Δ5 · DRAFT", "L2 · FEATURE", layer toggles "BASE · STRUCTURE / + RUNTIME / + CHANGE / TESTS / +3", "DESIRED + OBSERVED", "LIVE · 2s" and "EVIDENCE · 94%". The four quadrants are EXPERIENCE ("login · account · session device · step-up", SOURCE · main), AUTH KERNEL ("principals · PAT · grants · delegation · authorization", OBSERVED · 3s), RESOURCE POLICY ("chat membership · profile views · tenant boundaries", SOURCE · main) and AUDIT + RECOVERY ("sessions · revocation · receipts · incident evidence", SOURCE · main). Right rail: EVIDENCE & FINDINGS ("12 findings · 3 blocking", Conflict / Unknown / Impact / Policy rows), SELECTED PATH ("Principal → token → resource decision → repository → audit evidence"), and a SELECTION INSPECTOR on "Finding / chat.membership — Source-proven authorization gap · production mutation blocked" with Truth "FAILED · run_7f2a", Effect "READ ONLY", Permission "PERMISSION DENIED · scope hidden", and an evidence block (Origin source

Vision tie. Two ideas land well. The typed query grammar "kind: owner: truth: path:" is the visitor idea made into a control — a saved query named "Blast radius" is a traversal, not a search box, and "Unknown evidence" as a saved query is exactly the §1 claim that unreachable or unproven things are found by query rather than by reading files. The truth/effect/permission triple in the inspector, kept independent as the Symphony Contract requires, is the cleanest instance of that rule outside 13.03. Nesting is again absent: "L2 · FEATURE" implies levels L0–L4 but nothing on the board lets you descend.

Workflow tie. A platform engineer opens this the morning after a security review, or a reviewer opens it when a PR touches auth. Today that person reads the RBAC middleware, greps for the policy check, opens the Supabase policy list, and forms a private opinion with no artifact at the end. Here the artifact is a finding with an owner and a blocked effect.

Agentic tie. This is the most agent-legible board in my cluster. An agent reads a named finding (chat.membership), a truth class, a permission denial with a stated reason ("scope hidden"), a blast radius, and a selected path it can walk. It can propose a patch against "negative authorization tests required" and cannot execute one, because Effect is READ ONLY and Permission is denied. The governance model is visible in the data rather than described in prose, which is the right shape.

Blueprint tie. This is the Unreal asset validator combined with the reference viewer: a scoped subgraph with rule violations attached to specific nodes. It is not the debugger, because nothing here is stepping through execution.

Replaces / augments. Auth0 and Okta dashboards, AWS IAM Access Analyzer, Supabase RLS policy editor, Snyk and Semgrep findings triage, and the security-review spreadsheet.

Improvements.

1. Split the "12 findings · 3 blocking" summary into a real finding list with severity, owner, first-seen and blocked-effect columns. Twelve findings behind one number is the atlas's most repeated compression, and this board is the right place to break the habit because it has a named finding already.
2. Add a negative-test coverage column to the quadrants. The COVERAGE line asks for "negative authorization tests required" and no quadrant shows whether one exists. Per §2 the real answer for chat membership is zero, and showing that zero is more valuable than the finding.
3. Make "EVIDENCE · 94%" clickable to a denominator. Ninety-four percent of what, measured when, over which entities — as written it is the exact kind of unmarked assertion the truth ledger on 01.01 forbids.
4. Add the audit's own security findings as a saved query. The rail already has "Security findings"; wire it to S-1…S-12 so the board shows twelve real defects instead of twelve invented ones.
5. Replace "Confidence 1.0 / exact" with a confidence that can vary. A constant 1.0 across every North Star board makes the field decorative.

Verdict. Strengthen. This is the template the other three slices should have been differentiated from, and its headline finding is one of the few in the atlas that matches the audit.

01.03 · North Star · System Fabric

On the board. Structurally identical to 01.02 — a byte-for-byte match on 106 of its 134 lines. The differences are the breadcrumb ("bestbuds / runtime / System Fabric"), the COVERAGE line ("Partial coverage · provider reconciliation required"), the canvas title ("System Fabric — desired, observed and historical infrastructure / Workers · Kubernetes · servers · databases · messaging · storage · delivery"), a canvas truth chip "PARTIAL · 3 unknown", the plane label "DESIRED + OBSERVED · CURRENT REVISION", four quadrants — WORKERS + ROUTES ("Cloudflare Workers · Pages · ingress · bindings", PARTIAL · 3 unknown), KUBERNETES + SERVERS ("k3s · workloads · pods · services · hosts · processes", SOURCE), STATE + DATA FABRIC ("Postgres · ClickHouse · Memgraph · D1 · DO · ObjectDatabase", PARTIAL · 3 unknown), DELIVERY + RECOVERY ("artifacts · policies · rollout · backup · restore evidence", UNKNOWN · not wired) — a SELECTED PATH ("Worker → binding → service → database → telemetry → release receipt"), and an inspector on "k3s / main-prod — Configured source topology · live health not yet proven" with Truth "PARTIAL · 3 unknown" and Permission "APPROVAL REQUIRED".

Vision tie. This is the opinionated-stack idea, and it is the only board in my cluster that varies its truth chips per quadrant rather than inheriting them from a template. "DELIVERY + RECOVERY / UNKNOWN · not wired" is a real NotWiredYet in §1's sense — it states what is missing instead of inventing a number — and "Configured source topology · live health not yet proven" is an honest sentence. The board is a desired-versus-observed reconciliation surface, which is the correct shape for infrastructure and matches the DESIRED + OBSERVED dual plane that §3 identifies as the model pattern on 13.03.

Workflow tie. The platform on-call opens this at the start of a shift or during an incident to answer "what is actually running". Today that is the Cloudflare dashboard in one tab, kubectl get pods in a terminal, and the Postgres console in a third, with the desired state living in Pulumi files nobody diffs against reality.

Agentic tie. Good input, weak governance detail. An agent can read that three things are unknown and that delivery is unwired, which is enough to refuse a confident answer. But there is no per-quadrant reconciler identity — nothing says which provider API produced the observed side, so an agent cannot tell whether "3 unknown" means the API failed, the resource is absent, or nobody has wired the collector. Add that and this becomes a strong agent surface.

Blueprint tie. The Unreal level outliner for infrastructure, with a device-profile overlay: a hierarchical inventory of what exists in the world, annotated by what each target supports. It is not the profiler; no timing appears here.

Replaces / augments. Cloudflare dashboard, Lens or k9s, Pulumi and Terraform state inspection, Backstage's resource catalog, and AWS Config style drift detection.

Improvements.

1. Add a Reconciler column per quadrant naming the source of the observed side and its last successful poll, so "PARTIAL · 3 unknown" resolves into which collector is missing.
2. Add an explicit Drift row that lists desired-versus-observed disagreements as items rather than as the generic "Conflict / Desired and observed claims disagree" chip repeated on all four North Star boards.
3. Fix the internal contradiction: the footer says "source projection · designed" and the inspector says "Observed runtime · 3s". A designed projection cannot carry a three-second-old observation. Either suppress the Observed field when the projection is designed, or show it as NotWiredYet.
4. Add a queue entity to STATE + DATA FABRIC and mark it UNKNOWN · not wired. Per §2 the distributed plane has no queues at all and every pipeline is waitUntil fire-and-forget; a fabric board that does not show the absence of queues is hiding the platform's largest structural risk.
5. Give DELIVERY + RECOVERY a restore-drill timestamp field, permanently empty until one runs. Backup without a proven restore is the quadrant's whole point.

Verdict. Strengthen. Structurally the most honest of the four slices; it needs reconciler provenance and one contradiction removed.

01.04 · North Star · Agent OS

On the board. The same shell and the same 106 shared lines again. The breadcrumb is "bestbuds / intelligence / Agent OS", the COVERAGE line is "Designed agent workflow · mutation remains blocked", the canvas reads "Agent OS — human intent conducted through typed, reviewable work / Ask · explain · propose · delegate · critic · approval · run · receipt" under a bare "SOURCE" chip, and the plane is labelled "PROPOSAL PLANE · HUMAN AUTHORITY". The four quadrants are HUMAN ("intent · constraints · target · authority · approval"), AGENT ("investigation · typed patch · plan · evidence collection"), CRITIC ("challenge assumptions · validate proof · never self-approve") and EXECUTION ("sealed plan · governed run · verification · receipt"). SELECTED PATH is "Intent → proposal → critic → independent approval → run → evidence". The inspector shows "Proposal / auth-membership-fix — Agent-authored · exact plan pending human and policy review" with Truth "UNKNOWN · not wired", Effect "READ ONLY", Permission "APPROVAL REQUIRED", and the shared evidence block including "Confidence 1.0 / exact".

Vision tie. This is §1's agents-as-first-class-operators idea and it is the clearest statement of it anywhere in the atlas. "never self-approve" is a governance invariant expressed in four words, and the separation of HUMAN, AGENT, CRITIC and EXECUTION into distinct planes with a one-way path through independent approval is a real architectural position, not a diagram. What the board does not show is the §1 differentiator — that the agent reads the floor plan, a typed introspectable graph, rather than a tool list. Nothing here distinguishes Reaktor's agent from an MCP client.

Workflow tie. An engineering lead opens this when deciding how much autonomy to grant, and a reviewer opens it when an agent-authored patch arrives. Today the equivalent is a CODEOWNERS file plus a private convention about which bot PRs may auto-merge.

Agentic tie. The board is about agents but is not itself agent-legible: the quadrants are prose lists of nouns, not typed structures. An agent reading this cannot determine what a "sealed plan" contains, what a critic's rejection looks like as data, or which scopes an approval grants. This is the board where a schema matters most and there is none.

Blueprint tie. The Unreal build and cook pipeline with a submit gate: a proposal is compiled, validated, and only then permitted to produce artifacts. The analogy breaks because Unreal has no critic and no notion of an author whose authority differs from the approver's.

Improvements.

1. Add a Proposal schema pane showing the actual fields of a sealed plan — typed commands, blast radius, expiry, principal, revision, required approvals — so an agent can construct one. 01.01 already asserts "4 typed commands · blast radius 7 targets"; put the type behind it here.
2. Add a Critic verdict state set with real states (accepted, challenged with counterexample, insufficient evidence, out of scope) and show what each blocks. "validate proof" is currently an aspiration with no artifact.
3. Add an Authority matrix sub-pane mapping principal to permitted effects, and reconcile "Ask · Propose" here with "Ask · Delegate" on 01.01. Two agent-authority models one board apart is a governance defect, not a copy inconsistency.
4. Delete "Confidence 1.0 / exact" from this board or set it to unknown. A board whose own Truth chip reads "UNKNOWN · not wired" cannot carry exact confidence in the same inspector, and this contradiction is on-screen twice.
5. Add a Receipt exemplar showing one immutable receipt's fields. Act's output on the constitution board is "immutable receipt" and no board in the atlas shows one.

Verdict. Strengthen, and give it the schema it is missing. The governance model is right; the board is currently prose.

01.05 · North Star · Knowledge Atlas

On the board. The same template a fourth time, differing from 01.04 in twenty lines. Breadcrumb "bestbuds / intelligence / Knowledge Atlas", COVERAGE "Mixed source coverage · unknown remains explicit", canvas "Knowledge Atlas — every claim connected to its proof / Code · documents · tests · runtime observations · decisions · receipts", plane "SOURCE + EVIDENCE · CURRENT REVISION". Quadrants: SOURCE KNOWLEDGE ("symbols · contracts · call paths · ownership"), DOCUMENT KNOWLEDGE ("decisions · invariants · runbooks · architecture"), RUNTIME KNOWLEDGE ("traces · values · incidents · deployment evidence"), PROOF KNOWLEDGE ("tests · findings · approvals · immutable receipts"). SELECTED PATH is "Question → semantic query → evidence set → explanation → GraphLink". The inspector is on "Fact / EvidenceRecord — Origin, revision, observedAt, authority and freshness stay attached" with Truth "SOURCE".

Vision tie. This is §1's evidence idea and it names the actual type — Fact / EvidenceRecord with "Origin, revision, observedAt, authority and freshness" — which is more concrete than any other North Star board manages. It is also the only board in my cluster that names "invariants" (inside DOCUMENT KNOWLEDGE), which is a thin thread to the verification program but a real one. The board is the atlas's answer to "how does the diagram avoid lying", and it is placed correctly as a North Star rather than a feature.

Workflow tie. Anyone answering "why do we believe this" opens this — a new joiner tracing a decision, an engineer writing a postmortem, an auditor asking for the evidence behind a compliance claim. Today that means grep, a stale ADR folder, a Confluence page, and asking whoever has been here longest.

Agentic tie. Potentially the highest-value board in the atlas for an agent, because "Question → semantic query → evidence set → explanation → GraphLink" is a retrieval contract with a citable output. But it is unusable today: there is no query pane, no result list, no evidence set rendered, and no GraphLink shown. The board describes a capability rather than demonstrating one, which for the board whose subject is proof is a self-defeating choice.

Blueprint tie. The Unreal content browser plus reference viewer — an indexed store of every asset with backward and forward references. The analogy is unusually good, and the gap is that Unreal's reference viewer actually shows edges while this shows four labelled boxes.

Replaces / augments. Backstage TechDocs, Confluence and Notion architecture pages, Sourcegraph, ADR repositories, and the evidence-collection step of a SOC 2 audit.

Improvements.

1. Add a working Question pane with one worked example: a question, the semantic query it compiled to, the evidence set returned with per-item truth marks, and the GraphLink produced. One end-to-end example is worth all four quadrants.
2. Make the quadrant truth chips vary. All four inherit the template's positional pattern — SOURCE, OBSERVED · 3s, SOURCE, SOURCE — so DOCUMENT KNOWLEDGE claims a three-second-old runtime observation of a documentation corpus. Truth marks that are template artifacts are worse than no truth marks.
3. Add a Conflict class to PROOF KNOWLEDGE for claims where document and runtime disagree, and wire it to 01.01's "Truth drift 6 / docs + fixtures". Two boards already gesture at the same phenomenon with different names.
4. Add an Invariant entity type as a first-class row under DOCUMENT KNOWLEDGE, listing INV-* identifiers with their proof status. §2's L1 tier is written invariants; this is the one board where they already almost live.
5. Add a Staleness control that lets the reader filter the whole atlas to claims older than a chosen TTL, mirroring 01.01's "fresh · 2s / ttl 30s".

Verdict. Strengthen. Right subject, right placement, but it must demonstrate one query rather than describe four categories.

SECTION 01–13 banners (thirteen boards, grouped)

On the board. Thirteen near-identical dividers. Each carries a "+" glyph, a two-digit number, a title, a one-line description, a surface count, and a "READ →" control. The descriptions are the only real content: 01 "Begin with the product thesis and its complete system model", 02 "Turn intent, primitives, and product capabilities into features", 03 "Operate safely across languages, legacy systems, and placement constraints", 04 "Zoom from the whole distributed system into ports, wires, and edits", 05 "The UI grammar, command surface, drawers, and visual verification", 06 "Preview, storyboard, record, trace, and test without losing causality", 07 "Validate targets, execute pipelines, release, and pass deployment gates", 08 "Move from a bounded session through orchestration, context, and audit", 09 "Identity, policy, data shape, migrations, and durable history", 10 "Trace, measure, profile, classify, and route signals into action", 11 "Connect product outcomes to experiments, cost, and decisions", 12 "Compose models, retrieval, prompts, evaluation, notebooks, and traces", 13 "Inspect cloud cells and project the graph across languages and tools". Section 05 uniquely reads "LIBRARY ↗ + 4 SURFACES" rather than a plain count.

Is the taxonomy right? No, in four specific ways.

The counts are wrong. Section 04 declares "6 SURFACES" and contains ten boards (04.01, 04.02, 04.03, 04.04, 04.05, 04.06, 04.06A, 04.06B, 04.07, 04.08) — eight even if the A/B variants are excluded. Twelve of the thirteen counts are correct and one is stale, which is exactly the failure mode the atlas exists to prevent: a hand-maintained number that drifted from the thing it counts. This is a one-line, undeniable proof that the atlas needs the truth vocabulary applied to itself.

Twenty boards belong to no section. The atlas has 104 boards: thirteen banners, START HERE, the reference library board, and 69 numbered surfaces — leaving 20 STATE boards (ten Composer states, five Deploy states, five System Studio Shell states) with no section number and no banner. That is 19% of the atlas outside the taxonomy entirely. They are not junk; the Composer set is a complete five-step wizard with five provisioning outcomes including Failed, Retry and Rollback, which is more state coverage than most sections have. They are simply unfiled.

The sections use a different vocabulary from the constitution. Section titles are legacy verbs and domains — Ship, Observe, Learn, Trust, AI Engineering — while the constitution declares Map, Trace, Validate and Act. Section 10 OBSERVE is Trace. Sections 07 and 08 are Act. Section 04 is Map. No banner names a movement. A reader who internalises the constitution cannot use the sections, and a reader who navigates by section never encounters the constitution again.

Three sections are miscategorised. Section 03 GOVERN / EXTEND / SCALE is a grab-bag whose title needs three slashes and whose four boards belong in three different places: Visitor Lab is graph substrate, Polyglot Boundary Studio belongs with the FFI Switchboard, Brownfield Atlas belongs with the Composer, and Constraint Optimizer belongs with placement and deployment. Section 05 INTERFACE SYSTEM is the atlas's own design-system reference library — its banner admits this with "LIBRARY ↗" — and does not belong in the numbered product spine. Sections 08 and 12 split one instrument across two sections, with overlapping content (08.04 MCP & Memory against 12.04 RAG; 12.07 AI Traces against 10.01 Spans).

Vision tie. The banners embody nothing from §1. They are navigational furniture. The one place they could have carried the vision — a per-section statement of which load-bearing idea it serves — is unused.

Workflow tie. Nobody opens a banner deliberately; they are scroll landmarks in a canvas. That is fine, but it means the surface counts are read only in passing, which is how one of them drifted.

Agentic tie. These are the atlas's only index structure and they are hostile to an agent: a count with no list, a title with no ID range, a "READ →" with no target. An agent cannot enumerate the atlas from them.

Blueprint tie. Content-browser folders. Nothing more.

Improvements.

1. Replace the hand-typed surface count with a computed count plus a FreshnessStamp, and show the wiring split beside it — for example "10 surfaces · 4 wired · 6 designed". Section 04's wrong "6" is the proof this is needed.
2. List the board IDs on each banner. A section divider that names its members is an index; one that names a number is decoration.
3. Add a movement badge to each banner mapping the section onto Map, Trace, Validate or Act, which forces the two taxonomies into one place and makes the missing Validate section visible.
4. Dock the twenty orphan STATE boards under their parent surface with an explicit "states" strip on the parent's banner, so 02.01 shows "10 states" and 07.04 shows "5 states".
5. Add a per-section owner field. Every North Star inspector carries "Owner / platform"; sections carry none.

Verdict. Rebuild. Keep the banner as an object; replace the taxonomy it expresses.

REFERENCE LIBRARY · MACHINE SIGNAL

On the board. The smallest board in the atlas at 172 characters. It carries a "+", the title "MACHINE SIGNAL LIBRARY", the line "Tokens · primitives · shell · graph chrome · system states", and the reference "05.00 · REFERENCE". It is a pointer to the 14,507-character 05.00 · Interface System — Machine Signal Design System board.

Vision tie. Indirectly, the eigenvector-primitive idea applied to the UI rather than the system: one token set and one component grammar spanning every surface. The five categories named — tokens, primitives, shell, graph chrome, system states — are a reasonable decomposition, and "graph chrome" as a distinct category is the right recognition that a graph editor needs its own visual vocabulary.

Workflow tie. A designer opens 05.00 when adding a surface; nobody opens this stub, which exists only so the canvas has a labelled entrance to the library.

Agentic tie. As a pointer it is inert. Its useful form would be a token manifest an agent can read to generate a compliant surface, which is exactly what the desktop implementation needs given §2's finding that roughly 30 of 74 panes are genuinely wired.

Blueprint tie. The Unreal engine content folder — the shared material and widget library every project draws from.

Replaces / augments. A Figma library page, Storybook's docs index, a design-tokens repository.

Improvements.

1. Give it a coverage counter: how many of the atlas's 1,457 component instances come from the library versus are one-off. That single number tells the designer whether the design system is real.
2. Add a truth-vocabulary usage row. §3 establishes that the truth components are used 36 times atlas-wide, 20 of them on the catalog board, with four components at zero uses. The library entrance is where that fact should be visible to the person who can fix it.
3. Merge this stub into the section 05 banner. Two navigational objects pointing at the same board is redundant chrome, and the section 05 banner already says "LIBRARY ↗".

Verdict. Merge into SECTION 05 banner.

Cluster findings

Missing panes.

• 01.06 · North Star · Assurance. There is no North Star for correctness. Four of five North Stars are about knowing the system and one is about agents; none is about proving anything. §2's L0–L5 ladder and the one-fingerprint keystone are the product's entire credibility argument and have no entry point in the atlas.
• Section 07 · Assurance (a whole missing section). Boards for L0 CI & Hygiene, L1 Invariants & Defect Burn-down (INV-*, D-*), L2 Property, Lincheck & Differential Conformance, L3 Model Checking (TLA+/Quint), L4 Proofs (Lean 4), and L5 Deterministic Simulation. Justified by §2: the verification program is agreed and the atlas depicts none of it.
• Fingerprint Registry. One board showing the single fingerprint unifying port type identity, codec layout identity and FFI method identity, with the D-6 unsoundness rendered as a live defect — Type being (String, KClass?) where the string path connects mismatched classes. §2 names this the keystone primitive; it appears twice in 104 boards.
• Defect Board (D-*) and Security Findings Board (S-1…S-12). 01.02 shows one invented finding while twelve real ones exist, including "any authenticated user can join any chat room" and moderation failing open. The atlas has a saved query named "Security findings" pointing at nothing real.
• Graph Code Push. §1 lists marked subgraphs updating and rewiring at runtime, delivered as Kotlin/JS through Hermes with typed boundaries, as a load-bearing idea. No board in the 104 depicts it.
• Capability & Adapter Matrix. Targets down one axis, capability tiers across, with designed degradation per cell. §1's "product code branches on capability, never on platform" currently exists as one wizard step and one node badge.
• Saga / Choreography. Cross-system flows as saga graphs executed by visitors, with session-typed wires. §1 names it; sections 08 and 12 cover agent task DAGs instead, which is a different thing.
• Queue & Backpressure. §2 says the distributed plane has no queues at all and every pipeline is waitUntil fire-and-forget, with no idempotency in notifications. This is the largest single runtime risk in the audit and no board shows it, not even as absent.
• Atlas Self-Map. A board that indexes the atlas — every surface with its section, movement, instrument, wiring state and freshness. The section-04 count being wrong proves the index is currently maintained by hand.

Seams.

• Two taxonomies, never reconciled. The constitution declares movements and instruments; the thirteen sections use legacy domain verbs. Only 15 of 69 numbered boards name a movement, and only 11 name an instrument. The claim that every board is a cell is false by the atlas's own naming.
• Twenty unfiled boards. The Composer, Deploy and Shell state sets have no section, no banner and no parent link, so 19% of the atlas is reachable only by scrolling.
• The instrument rail disagrees with the constitution. 01.01 lists "Mission" where the constitution lists "Interface". The first board a reader opens after the constitution contradicts it.
• Two agent-authority models. 01.01 offers "Ask · Delegate"; 01.02–01.05 offer "Ask · Propose" and gate everything behind "APPROVAL REQUIRED". The difference is never explained and is a governance question, not a label.
• The constitution is outside the system it governs. START HERE has no shell, no ⌘K, no breadcrumb, no revision chip, no ⌘J drawer and no selection. It cannot demonstrate "selection survives every movement" because it has no selection.
• Template inheritance masquerading as evidence. 01.02, 01.04 and 01.05 carry the identical positional truth pattern — SOURCE · main, OBSERVED · 3s, SOURCE · main, SOURCE · main — across entirely different subject matter. Only 01.03 varied its chips. The one vocabulary the atlas says can never be faked is being inherited from a layout.
• Selection does not visibly survive. All four slice boards say "selection synced" in the footer, but no two boards share a selectable entity, so the promise is asserted five times and demonstrated zero times.
• Section 05 has two entrances. The section banner and the REFERENCE LIBRARY stub both point at 05.00.

Honesty audit.

01.01 Mission Control is the worst offender in the cluster, with roughly 61 numeric tokens and one shared provenance chip. "Tests 248 / 96.8% pass" is invented — §2 establishes that no CI exists, that 12 of 30 framework modules have zero tests, and that a green build proves three modules' JVM tests plus about fifteen source-text conventions. The board also asserts "18/21 · 3 unknown" and "39/39 passed · 4m ago" for the same subject without reconciliation, and "policy v19 · loaded" implies a versioned policy engine the audit does not support. The honest version keeps the layout and shows "Tests · 3 modules covered · 18 of 30 modules untested · no CI run · NotWiredYet", with the build-gate tile reading "Gates · 0 automated · 1 manual dispatch".

01.02 Auth System Slice tells a true story with an invented citation. The finding "chat.membership — Source-proven authorization gap" matches §2's real defect that any authenticated user can join any chat room, which is to the board's credit. But "FAILED · run_7f2a" cites a run that cannot exist, "EVIDENCE · 94%" has no denominator, and "Confidence 1.0 / exact" is asserted for a claim with no run behind it. The honest version replaces the run reference with SourceRef to the policy file and the missing negative test, and sets confidence to reflect a source-only claim.

01.03 System Fabric is the most honest board in the cluster and still contradicts itself: the footer declares "source projection · designed" while the inspector reports "Observed / runtime · 3s". Its "PARTIAL · 3 unknown" and "UNKNOWN · not wired" chips are good practice. The honest version drops the Observed field wherever the projection is designed, and adds a queue entity marked absent.

01.04 Agent OS carries the sharpest single contradiction in the cluster: Truth reads "UNKNOWN · not wired" and, six lines later in the same inspector, Confidence reads "1.0 / exact". Exact confidence in an unwired claim is the precise failure the truth ledger on 01.01 forbids. The honest version sets confidence to unknown and marks EXECUTION as NotWiredYet, since no sealed-plan schema, critic verdict type or receipt exists in code.

01.05 Knowledge Atlas asserts "OBSERVED · 3s" over DOCUMENT KNOWLEDGE, claiming a three-second-old runtime observation of a documentation corpus, purely because that is the second quadrant's inherited chip. The honest version marks documents STALE with a real age, matching 01.01's own "Docs / 6 conflicts · 2h".

00 START HERE asserts little numerically — seven numeric tokens, the lowest in the cluster — but its one disclosure, "implementation proof varies by surface", is the atlas's entire credibility problem compressed into six unquantified words. The honest version is a counter: 69 surfaces designed, roughly 30 wired, 0 proven.

The section banners assert thirteen surface counts, one of which is wrong: section 04 claims six and holds ten.

Atlas taxonomy verdict

Should the atlas keep 13 sections? No. The right answer is eleven numbered sections plus two lettered appendices — but the count is a side effect, not the point. The count changes because three of the thirteen sections are miscategorised, one section that must exist is missing, and twenty boards belong to no section at all.

The four reasons to change are all evidenced above. Section 03 is a grab-bag whose title needs three slashes and whose four boards belong in three other sections. Section 05 is the atlas's own design-system library sitting in the numbered product spine, which its own banner admits with "LIBRARY ↗". Sections 08 and 12 split one instrument across two sections with duplicated content. And there is no section for assurance, which per §2 is the product's entire credibility argument — the L0–L5 ladder and the one-fingerprint keystone appear nowhere in 104 boards, while the words "lincheck", "property test", "model check", "differential" and "counterexample" appear zero times each.

The section list after a revamp:

Justification against the vision and the audit. Section 05 Assurance is non-negotiable: §1's thesis is that "the diagram cannot lie", and a diagram with no proof apparatus is a diagram that merely has not been caught lying yet. §2 makes the stakes concrete — port type identity is unsound, lifecycle fires effects on rejected transitions, actors can double-start, FlexBuffers has no bounds checks on the read path — and every one of those is a board in section 05 today rendered as a live defect with an owner. Section 11 Boundary & Extensibility gathers the polyglot data plane into one place because §1 treats it as a single idea and §3 identifies 13.03 as the atlas's model board; splitting its neighbours across sections 03 and 13 wastes the best pattern in the document. Merging 08 and 12 removes the atlas's largest duplication and stops one instrument consuming 17% of the numbered spine. Demoting the design system to an appendix is a statement about what the atlas is for: it is a product atlas, and its own UI kit is a tool, not a product surface.

Finally, whatever section count survives, the banners must stop hand-typing their counts. One of the thirteen is already wrong.

Part 5 · Section 02–03 — Create, Govern, Extend, Scale

Eight boards: 02.01, 02.02, 02.03, 02.04, 03.01, 03.02, 03.03, 03.04. Extended treatment for 02.03 Primitive Atlas and 03.01 Visitor Lab. Explicit ruling on 03.02 versus 13.03.

A structural fact governs everything below, so it is stated once here rather than repeated eight times. Seven of my eight boards — every board except 02.01 — are the same artboard with roughly twelve lines changed. They share, verbatim, the scope rail (Everything, Product islands, Runtime fabric, External boundaries, Blast radius, Security findings, Changed since main, Unknown evidence), the lens strip (Δ5 · DRAFT, L2 · FEATURE, DESIRED + OBSERVED, LIVE · 2s, EVIDENCE · 94%), the entire EVIDENCE & FINDINGS block (12 findings · 3 blocking, Conflict — Desired and observed claims disagree, Unknown — Runtime observation is not wired, Impact — 14 tests · 3 deploy targets, Policy — Approval required before mutation), the evidence stamp (Origin source:main, Observed runtime · 3s, Confidence 1.0 / exact, Revision spec@8f41c2, Owner platform), and the footer (policy required, performance · unmeasured). What actually varies per board is the coverage line, the title and subtitle, one plane label, four card headings with a subtitle each, one SELECTED PATH string, and one two-line SELECTION INSPECTOR. Across the atlas, 12 findings · 3 blocking appears on 17 boards, EVIDENCE · 94% on 20, and Runtime observation is not wired and 1.0 / exact on 17 each. This is not a stylistic observation. It means the finding count, the evidence percentage and the confidence rating are chrome rather than data, and it is the root cause of most of the honesty problems recorded at the end.

02.01 · Create · New System Composer

On the board. This is the one board in my set with its own layout. A left rail titled SYSTEM COMPOSER lists five steps — 1 Product intent, 2 Product graph, 3 Targets & capabilities, 4 Policies & gates, 5 Bootstrap review — above a TARGETS list of Android · iOS · Web, Workers · JVM server, Postgres · D1 · ClickHouse, Memgraph · R2 · Pub/Sub. The centre holds GENERATED SYSTEM GRAPH · PROPOSED as four quadrants each with an Open in Graph ↗ affordance (Interface — 3 apps · 18 routes, Runtime — 7 services · 12 workers, State — 6 engines · 42 schemas, Delivery — 8 targets · 14 gates) and below it EXACT BOOTSTRAP PLAN — 0 / 5 executed with five numbered rows (01 Validate contracts · ready, 02 Generate GraphSpec + source · ready, 03 Dry-run providers · blocked, 04 Apply approved plan · blocked, 05 Verify + issue receipt · blocked). The right column is GOVERNANCE & EVIDENCE with Truth SOURCE, Maximum effect LOCAL WRITE, Permission APPROVAL REQUIRED, then PENDING DECISIONS · 2 (Data residency · asia-south1, Rollback window · 15 minutes) and a RECEIPT PREVIEW reading Plan not sealed, Actor local human, Revision spec@8f41c2, Target workspace only, Rollback not applicable. Ten companion STATE boards exist for the same surface: steps 1, 2, 3, 4 and 5, plus Provisioning · Running, Complete, Failed, Retry and Rollback.

Vision tie. This is the composition thesis made operable: "Every decision becomes a semantic graph delta, generated artifact, validation finding, and sealed plan." Building a system by choosing targets and capability packs rather than by writing scaffolding is exactly the eigenvector-primitive claim applied at product scale, and the opinionated stack from §1 is present by name in the TARGETS list. It is the strongest embodiment in my cluster.

Workflow tie. Opened once at the start of a new product or a new major surface, by a tech lead or a founding engineer, in the hour where today they run create-next-app or a Spring Initializr, hand-write a Terraform root module, copy a wrangler.toml from the last project, and then spend two weeks discovering which capability the chosen targets do not have. The composer replaces that fortnight with a reviewable plan.

Agentic tie. Excellent shape for an agent. The five steps are a state machine, the plan is five discrete typed operations, and the receipt preview binds actor and revision, so an agent can propose a full bootstrap and a human approves one sealed artifact. The governing controls are already right: Maximum effect LOCAL WRITE, APPROVAL REQUIRED, and the honest closing line Targets proposed · provider access not exercised. What is missing for agents is a machine-readable diff of what step 3 would change if a target were added or removed.

Blueprint tie. Not the Blueprint graph editor. This is the project-creation wizard plus the project settings and the cook/package target list — the screen where you choose which platforms you are shipping to and the engine tells you what each platform costs you. The analogy holds well, with one Reaktor advantage: Unreal's target settings never produce a plan you approve.

Replaces / augments. Terraform and Pulumi plan/apply, Crossplane, AWS CDK diff, Backstage software templates and the scaffolder, Spring Initializr, create-next-app, and the "new service" checklist that lives in a Confluence page at most companies.

Improvements.

1. Fix the bootstrap plan state machine. Across all ten STATE boards the five step rows never change: Provisioning · Complete says 5 / 5 verified in the header while rows 03, 04 and 05 still read blocked. Each row needs its own state (ready, running, verified, failed, skipped, rolled back) driven by the board state, with a timestamp and a run id per row.
2. Make RECEIPT PREVIEW react. It reads Plan not sealed / Target workspace only / Rollback not applicable even on the board captioned VERIFIED · RECEIPT ISSUED whose own footer says receipt_0182 · verified · rollback window 15m, and on the board captioned ROLLING BACK · VERIFIED STEPS. Bind the five preview fields to the run.
3. Add a CAPABILITY GAPS pane to step 3. The STATE copy of this board already carries the string 8 targets · 4 capability gaps in its footer and the product board threw it away. Promote it to a real pane listing each gap, the target that lacks it, and the designed degradation.
4. Escalate the environment chip with the effect chip. Provisioning · Running claims APPLYING · NON-PROD WRITE and Maximum effect REMOTE REVERSIBLE while the top-bar environment still reads LOCAL; only Rollback flips to PROD. The environment chip must move when the effect does, or the effect ladder is decorative.
5. Label the four quadrant numbers as proposed. 3 apps · 18 routes and 42 schemas describe a system that does not exist yet; prefix the block with PROPOSED — or attach the same TruthMark the governance column uses.
6. Give step 3 a Diff targets control that shows, before commit, which of the five plan steps change if a target is added or dropped.

Verdict. Keep. It is the best board in the cluster and the only one whose companion states exist at all. Its defects are wiring defects, not conception defects.

02.02 · Create · Design System Graph

On the board. Template board. Its four cards are TOKENS — themes · typography · spacing · geometry · motion, COMPONENTS — atoms · molecules · organisms · variants · semantics, TEMPLATES — shell · graph · query · compare · plan · responsive and PARITY — Pencil refs · Compose symbols · tests · usage evidence, under the plane label SOURCE PLANE · CODE ↔ PENCIL. Coverage reads Source + designed system · parity test required, the selected path is Token → component → screen usage → code symbol → visual test, and the inspector shows Component / TruthMark — Pencil and Compose parity link · implementation evidence partial.

Vision tie. It gestures at "the diagram of the system and the system are the same object" in the narrowest place it is actually true today — the design file and the Compose code — but it embodies the idea only as a caption. The one genuinely Reaktor-specific claim here is the PARITY card, and it is four words.

Workflow tie. A design-systems engineer opens this on the Monday after a token change, to find out which screens moved. Today that is a Figma library-update dialog, a git grep for the token name, and a Chromatic run.

Agentic tie. The selected path Token → component → screen usage → code symbol → visual test is a genuinely good agent query — it is a five-hop join an agent could execute and act on. Nothing on the board exposes it as a query; it is printed as a sentence.

Blueprint tie. The content browser filtered to materials and material instances. The analogy breaks because Unreal's content browser shows you the actual asset thumbnails and their reference counts; this board shows category names.

Replaces / augments. Storybook, Chromatic, Figma library analytics, Supernova, Zeroheight, Style Dictionary.

Improvements.

1. Merge the content of 05.01 Interface · Atomic Catalog into this board or delete this board in its favour. 05.01 already shows real tokens with real values and usage counts (color.accent.brand · #4B7BFF · 14 uses · ⚠ drift, space.16 · 16dp · 54 uses), real variant rows with pass and FAIL states, real renderer parity rows (Tactile · physics skins — designed · not built) and three named accessibility findings. This board shows the same six categories as nouns.
2. If it survives, make PARITY the entire board and the only board. The unique asset is the Pencil-to-Compose link; give it a two-column ledger with one row per component, the Pencil node id, the Compose symbol, the last parity run, and a drift state. 05.01 has the drift concept but not the link.
3. Add an UNUSED and an UNDECLARED bucket. A design-system graph earns its name by answering which tokens nothing consumes and which hard-coded values have no token — neither appears.
4. Turn the selected path into a runnable query in the Query · kind: owner: truth: path: field and show the result count.
5. Replace 12 findings · 3 blocking with the design-system's own findings; 05.01 already has three real ones (tap target 38×38 < 44dp, contrast 3.1:1 · needs 4.5:1, missing semantic label).

Verdict. Merge into 05.01 Interface · Atomic Catalog, keeping only the Pencil-to-Compose parity ledger as a new sub-pane there.

02.03 · Create · Primitive Atlas

This is where the eigenvector-primitive claim must live or die, so it gets the hard reading.

On the board. Template board. Four cards under the plane SOURCE PLANE · CURRENT REVISION: CORE PRIMITIVES — Graph · Node · Port · Edge · Facet · Capability, RUNTIME PRIMITIVES — Actor · Service · Lifecycle · Ownership · Events, ADAPTER PRIMITIVES — Source · Inspector · Compiler · Materializer · Observer, and TARGET PRIMITIVES — Kotlin · TypeScript · C++ · cloud · devices. The subtitle is the semantic kernel beneath every system over Stable identities · typed contracts · capabilities · visitors · deltas. Coverage reads Source-derived · implementation proof required. The selected path is Contract → graph projection → compiler pass → runtime evidence and the inspector reads Port / ContractDescriptor — Canonical contract identity with schema compatibility evidence with Confidence 1.0 / exact.

Vision tie. It names the idea and does not demonstrate it. The board's entire content is twenty-one nouns arranged in four boxes. That is a taxonomy poster, not an atlas, and it fails the claim in four specific ways.

First, there is no basis test anywhere. A minimal non-redundant basis is a claim with two halves — that the primitives span the space, and that none is derivable from the others — and the board tests neither. The word eigen appears zero times in all 104 boards, and redundan appears zero times. The most important assertion in the framework is made nowhere in the artifact that exists to make it.

Second, the fourth card is a category error that a redundancy analysis would have caught immediately. Kotlin, TypeScript, C++, cloud and devices are not primitives of the same kind as Port and Edge. They are values along a target dimension, and a target is something a Capability already ranges over. Listing them as a fourth peer class of primitive is precisely the kind of category invention the vision says wiring primitives is supposed to replace. In the same vein, Service sits beside Actor, Lifecycle and Events in the runtime card without the board ever saying whether a Service is a primitive or an Actor with a lifecycle and typed ports — which is the exact question a basis has to answer.

Third, the board asserts exactness at the one point the audit says the code is unsound. The inspector selects Port / ContractDescriptor and describes it as Canonical contract identity with schema compatibility evidence, stamped Confidence 1.0 / exact. Audit finding D-6 says port type identity is (String, KClass?), that every string-built port — meaning every ServiceNode endpoint and every JS caller — carries null, that same-named ports on different paths refuse to connect, and that different classes on the string path connect happily. Canonical contract identity is the single thing this primitive does not have. The board is at its most confident exactly where the framework is at its most broken.

Fourth, and most costly, there is no negative space. The most valuable pane in a genuine primitive atlas is the one that says what cannot yet be expressed. Nothing here shows an unrepresentable system, a primitive under consideration, or a workaround that indicates a missing primitive.

What a genuine primitive atlas would show, concretely: a spanning matrix with primitives down one axis and system kinds across the other (mobile screen, edge worker, durable object, batch job, native library, agent tool) where each cell is filled, partial or empty, and the empty cells are the product's roadmap; a derivation graph showing which primitives are expressible in terms of others, with an explicit rule that anything derivable is demoted out of the basis; a usage census counting how many real nodes in the BestBuds and framework codebases instantiate each primitive, which immediately exposes primitives nothing uses; an expressivity gap ledger naming systems the current basis cannot describe (credit-based backpressure has no primitive here, and neither does a queue, which is notable given audit §2's finding that the distributed plane has no queues at all); a fingerprint column per primitive, since §2 names one unified fingerprint system as the keystone; and a proposed primitive queue with the burden of proof for admitting a twenty-second noun.

Workflow tie. Nobody opens this in a normal week, which is itself the problem. It should be opened at exactly two moments: when an engineer cannot express something and needs to know whether that is their failure or the basis's, and when someone proposes adding a concept to the framework and must show it is not derivable. Neither moment is served by a list of nouns.

Agentic tie. This is the board an agent most needs and can least use. An agent planning a change needs to know the legal vocabulary and the composition rules; it gets twenty-one strings with no arity, no port signature, no legal-neighbour relation, no fingerprint. Meanwhile 04.02 Map · Semantic Graph Editor & Compiler already carries the real thing under PORT & RELATIONSHIP TAXONOMY — CONTRACT + LABEL + SHAPE + COLOR, listing exec — control flow · triangle + arrow · explicit order, Session / domain types — domain contract · named schema + compatibility, Flow<T> / streams — Flow<T> stream · pulse pattern + rate + label, navigation, and containment — dashed boundary + scope identity. The board whose job is the primitive basis is outranked on its own subject by a board about the editor, and does not link to it.

Blueprint tie. The node palette and the content browser combined. The comparison is brutal: Unreal's palette is generated from reflection, every entry is draggable onto a canvas, each shows its exact pin signature, and right-clicking a pin filters the palette to what can legally connect. This board is text you cannot drag, with no pins. 04.02's right-click canvas — palette from registered contracts · type + capability filtered describes the Unreal behaviour correctly, on a different board.

Replaces / augments. The framework reference documentation site, ArchUnit and dependency-rule linters, the "concepts" chapter every framework ships and nobody reads, and — if the spanning matrix were built — Structure101 and architecture-decision-record repositories.

Improvements.

1. Add a COVERAGE MATRIX pane: primitives as rows, system kinds as columns, each cell full, partial or absent, sorted so the absent cells cluster. This is the pane that turns the poster into an atlas.
2. Add a REDUNDANCY pane with a derivation column per primitive — derivable from and admitted because. Start by resolving Service against Actor + Lifecycle + ports and Facet against Capability in public.
3. Delete the TARGET PRIMITIVES card and re-express Kotlin · TypeScript · C++ · cloud · devices as the column headers of the coverage matrix, where they belong.
4. Add a CANNOT EXPRESS YET pane with named entries. Seed it from audit §2: no queue primitive, no credit or backpressure primitive, no idempotency-key primitive.
5. Replace Confidence 1.0 / exact on the Port / ContractDescriptor selection with a Conflict finding citing D-6, and split the inspector into two rows, reified port · class carried and string-built port · class null, showing the count of each in the real codebase.
6. Give every primitive a fingerprint field, and link that column to the fingerprint registry that §2 calls the keystone.

Verdict. Rebuild. The subject is the framework's central claim and the board currently makes no argument for it. The rebuilt board is a matrix and two ledgers, not four cards.

02.04 · Create · BestBuds Feature Graph

On the board. Template board, but with the most concrete card content in the cluster: INTERFACE — ChatScreen · state · actions · accessibility semantics, SERVICE — ChatService · membership policy · realtime contract, STATE — Postgres messages · Durable Object room · Pub/Sub events, and PROOF + DELIVERY — tests · traces · worker version · rollout · product impact, under the plane FEATURE SCOPE · DESIRED + OBSERVED. Uniquely in the Create section it carries the coverage badge PARTIAL · 3 unknown rather than a flat SOURCE, and its coverage line is Source topology · runtime evidence partial. The path is User intent → UI → port → service → state → test → deploy → signal and the inspector reads Feature / realtime-chat — Cross-layer feature slice · authorization finding attached.

Vision tie. This is the vertical-slice proof of the nesting claim from §1 — a feature is a subgraph of an app, an app is a node in a product — and it is the only board in the Create section that names real artifacts from a real product rather than categories. PARTIAL · 3 unknown is also the correct posture given §2.

Workflow tie. Opened during a bug triage or an incident, by whoever owns chat, at the moment the question is "where does this actually break". Today that means five tabs — the repo, the Cloudflare dashboard, Supabase, Sentry and a Grafana board — and a person who has held the mapping in their head for six months.

Agentic tie. Strong. A slice with named endpoints on both ends is a scope an agent can be bounded to, and authorization finding attached is exactly the hook an agent should read before proposing a change. The finding is referenced but never displayed, so the agent gets a flag with no payload.

Blueprint tie. The level. This is an assembled thing with real actors placed in it, as opposed to the palette (02.03) and the content browser (02.02). The analogy holds cleanly.

Replaces / augments. Backstage service catalog entries, Datadog service map, Sentry issue-to-release linking, the hand-drawn architecture diagram in the feature's design doc.

Improvements.

1. Show the authorization finding. The inspector says one is attached; audit S-2 says any authenticated user can join any chat room. Render it inline with its severity, the node it attaches to, and the test that would catch it. This is the highest-value single change in the cluster because it converts a claim into evidence.
2. Name the three unknowns. PARTIAL · 3 unknown is the most honest badge on any of my boards and it is unexplained; each unknown needs an EmptyReason — which layer, and what would resolve it.
3. Make the eight-hop path a spine, not a sentence. Render User intent → UI → port → service → state → test → deploy → signal as eight nodes with per-hop status, so the reader can see which hop is the PARTIAL.
4. Add a second feature selector. A feature graph with exactly one feature (realtime-chat) cannot show what the projection does under variation; add onboarding and notifications as switchable slices, since both exist in the audit findings.
5. Attach the delivery card to real values. worker version and rollout are the two fields where 04.01 System Graph already has concrete data (cf.workers/auth — 88ms · 8.4k · v4.2.1), and there is no link between the boards.

Verdict. Strengthen. This is the template board most worth keeping and the one closest to being genuinely useful.

03.01 · Govern · Visitor Lab

This is where the visitor pattern must become a product surface, so it gets the hard reading too.

On the board. Template board. Four cards under the plane READ-ONLY VISITOR · BOUNDED + AUDITED: PRINCIPAL — agent:codex · role:graph-auditor · session scoped, ALLOWED — inspect graph · query evidence · explain findings, PREVIEW ONLY — draft GraphPatch · calculate impact · request review, and DENIED — apply · deploy · secret access · self-approval. Coverage reads Authority grammar · implementation proof required, the subtitle is inspect and propose without authority confusion, the path is Visit → bounded traversal → finding → proposal → human review, and the inspector reads agent:codex / graph-auditor — inspect + propose · no apply · capability expires with session. This is the only board in my eight whose permission chip reads PERMISSION DENIED · scope hidden rather than APPROVAL REQUIRED.

Vision tie. The board is misnamed, and the mismatch is the finding. §1 defines a visitor as a traversal that carries cross-cutting behaviour: telemetry instruments a subtree, auth wraps a boundary, unreachable routes are found by query. None of those three appears anywhere on this board. What is actually depicted is an access-control card for one agent principal — an ACL rendered as four boxes. Authoring a visitor, running a visitor, and reading a visitor's results are all absent. The word visitor appears in the title and in the phrase READ-ONLY VISITOR, and in both cases it means "an agent with read permission", not "a traversal".

That substitution matters because the ACL half is already done better elsewhere. 08.04 Agents · MCP & Memory shows the same governance with real content: reaktor-graph — graph.query · graph.command · lineage — 42 calls/h — ⛨ every mutation = typed command w/ review gate, reaktor-db — ⛨ writes DENIED · read-only role, github — ⛨ merge blocked · human approves, pencil-design — ⛨ active-editor only · filePath ignored. That is the allow/preview/deny grid with named subjects, live call rates and per-row reasons. And 04.02 Map · Semantic Graph Editor & Compiler states the authority model in one line the Visitor Lab never manages — agents are visitors, Authenticated read plane → snapshot/query/evidence · mutation broker → proposal/plan, and agent/Critic may propose and review, never self-approve or apply. Two other boards own this board's stated content, more concretely, and it links to neither.

There is also a self-inflicted irony worth naming. The one board whose purpose is to explain authority has PERMISSION DENIED · scope hidden in its own selection inspector. The governance surface refuses to explain its own scope.

What a visitor debugger would actually need. Since the board does not depict authoring or running visitors, here is the surface it should be. A visitor registry listing each visitor by name, kind (instrument, guard, query, migration), author, version and fingerprint, with standing visitors separated from one-shot runs. A traversal source pane showing the actual predicate — which node kinds it matches, how deep it descends, whether it crosses subgraph boundaries. A scope preview that runs the match without side effects and reports matched N of M nodes with the unmatched ones grouped by reason, so the author sees the blast radius before running. A dry-run diff listing nodes visited, nodes skipped and why, and every effect that would fire, each carrying an EffectMark — this is the pane that makes "auth wraps a boundary" checkable rather than asserted. A step-through with the traversal frontier visible on the graph and a breakpoint on node match, which 04.02 already half-describes with F9 on node — sandbox breakpoint · capability-gated · never production by default. An overhead readout, because §1's entire wager is that keeping the graph resident costs "a small measured overhead"; the visitor is where that overhead is spent, so per-run cost in wall time and allocations is the measurement that proves or kills the thesis, and today the board's own footer says performance · unmeasured. A conflict view for when two visitors match the same node, showing ordering and whether the pair is commutative. And a findings output, since the path promises finding → proposal → human review but the board shows no findings and no proposals; 08.05 Agents · Runbooks & Audit already shows what one looks like (@claude · critic — BLOCKED — cmd #11 · DropIndex ix_msg_room — still used by chat.query p95 path).

Workflow tie. Two distinct moments, currently conflated. A platform engineer opens the authoring surface on the day they want telemetry on every service node without touching forty files, or want to prove no route is unreachable — today that is an OpenTelemetry auto-instrumentation config, a custom ESLint or Semgrep rule, or a CodeQL query. A security or platform lead opens the ACL surface when onboarding an agent — today that is an OPA policy file and a code review.

Agentic tie. The board describes agent governance correctly and provides an agent nothing to act on. There is no visitor an agent could author, no run it could request, no result it could read. The single most agent-legible thing in the whole cluster would be a visitor an agent writes, dry-runs, and submits as a proposal, and this board is the one that should host it.

Blueprint tie. Named for the Blueprint debugger, functioning as the project's permissions page. The closest true Unreal analogue is the asset validator and the commandlet runner — you author a check, run it across all content, and get a result list. The analogy breaks precisely at the result list: Unreal's validator produces one, this board produces nothing.

Replaces / augments. OPA and the Rego playground, CodeQL, Semgrep and ESLint custom rules, ArchUnit, OpenTelemetry auto-instrumentation configuration, Backstage tech-insights checks, Danger, and the review checklist that enforces cross-cutting rules by human attention.

Improvements.

1. Add a VISITORS list pane as the primary left-hand content, with columns for name, kind, scope predicate, last run, nodes matched, and standing-or-one-shot. Without this the board has no subject.
2. Add a DRY RUN pane producing visited / skipped / would-affect counts and an effect list marked with EffectMark, reachable before any apply.
3. Add a SCOPE PREVIEW control on the predicate that reports matched N of M with the unmatched grouped by reason, and highlights the matched set in the graph.
4. Add a per-run OVERHEAD readout in milliseconds and allocations, and remove performance · unmeasured from this board specifically once it exists. This is the board that owes the framework its central performance claim.
5. Move the PRINCIPAL / ALLOWED / PREVIEW ONLY / DENIED grid into 08.04 MCP & Memory as a per-principal row, rather than maintaining a second, thinner copy of it here.
6. Replace PERMISSION DENIED · scope hidden in the inspector with the actual grant and its expiry. A governance board that hides its own scope teaches the reader the wrong lesson.
7. Seed three named visitors matching §1 exactly: telemetry.instrument(subtree), auth.wrap(boundary), routes.unreachable(). These are the three examples the vision uses and none is on any board.

Verdict. Split into two boards. A new 03.01 Visitor Author & Run carrying the registry, source, scope preview, dry-run diff and overhead — the capability that is currently missing from the entire atlas — and the ACL half folded into 08.04, where the better version already lives.

03.02 · Extend · Polyglot Boundary Studio

On the board. Template board. Four cards under CONTRACT PLANE · SOURCE-DERIVED: KOTLIN — canonical serializers · service handlers · descriptors, TYPESCRIPT — generated bindings · cancellation · streaming · errors, C++ — generated types · ABI boundary · ownership · backpressure, and CONFORMANCE — golden round trips · version negotiation · trace parity. Coverage reads Kotlin implemented · TS/C++ conformance designed, the subtitle is one contract, many native runtimes, the path is ContractDescriptor → codegen → compile → conformance → artifact receipt, and the inspector reads Contract / realtime.chat.v2 — Source-derived descriptor · generated artifacts remain proposals with Truth SOURCE.

Relationship to 13.03 FFI Switchboard — the explicit ruling. These are a split that should be merged, and merged toward 13.03. Side by side, 13.03's four cards are KOTLIN HOST — service kernel · serializers · lifecycle, TYPESCRIPT GUEST — Workers · events · promises · streams, C++ GUEST — native memory · threads · error algebra, CONFORMANCE — ABI digest · round trips · cancellation · backpressure; its coverage is Kotlin source · foreign targets designed; its path is Contract → generated boundary → runtime call → trace → conformance receipt. Same template, same four-column shape, same three languages in the same order, same fourth conformance column, same repeated numbers.

There is a defensible distinction buried in the two paths. 03.02 is design-time — descriptor, codegen, compile, artifact receipt. 13.03 is run-time — generated boundary, runtime call, trace, conformance receipt. That is a real axis. But it is invisible on the boards, because the split was executed as two near-identical four-column layouts rather than as two different surfaces, and a reader landing on either one cannot tell which they are on.

Worse, the two boards disagree about the truth status of the same subsystem, and the disagreement points the wrong way. 13.03 marks Truth UNKNOWN · not wired. 03.02 marks Truth SOURCE and claims Kotlin implemented · TS/C++ conformance designed. Audit §2 says reaktor-ffi is a skeleton: the spec pins a seven-slot frame, nine verbs, a six-function C ABI, credits and an ownership table, and the code has none of it, with Transport being four TODO()s. The board making the stronger claim is the board whose subject — TypeScript and C++ code generation — has the least behind it. Of the two, the one designated atlas-wide as the model of honesty is the one that got its own truth marking right; this one did not.

If the split is kept rather than merged, it must be re-cut on the time axis and labelled: 03.02 becomes Contract & Codegen owning descriptors, generated artifacts, version diffs and compile status, and 13.03 stays Boundary Runtime owning frames, credits, ownership transfer and live calls. Neither board may then show a CONFORMANCE card, because conformance spans both and belongs on its own surface.

Vision tie. Polyglot on one data plane, from §1, and it names the right three languages. It omits the mechanism entirely: FlexBuffers read in place, Kotlin Flow ported as the async model, credit-based backpressure, and frames over JSI, a C ABI, gRPC or browser bridges. The word backpressure appears once as a bare card subtitle; credit appears nowhere in the atlas outside the cost board, where it means dollars.

Workflow tie. Opened by whoever owns the boundary on the day a contract changes and three runtimes must agree — today a .proto or schema file, three code generators, three build systems, and a conformance test suite someone maintains by hand.

Agentic tie. ContractDescriptor is a good agent anchor, and generated artifacts remain proposals is exactly the right governance posture. But there is no artifact list, no version, no diff, so an agent has nothing to propose against.

Blueprint tie. The build and cook pipeline — the machinery that turns one authored asset into per-platform binaries. The analogy is apt and unflattering: Unreal's cook reports per-platform success, failure and size, and this board reports category names.

Replaces / augments. Protobuf and gRPC codegen, Cap'n Proto, FlatBuffers, wasm-bindgen, JNI and cbindgen toolchains, OpenAPI generators, Kotlin/Native cinterop, and the hand-maintained cross-language conformance suite.

Improvements.

1. Adopt 13.03's Truth UNKNOWN · not wired marking, and change the coverage line from Kotlin implemented · TS/C++ conformance designed to something that survives §2 — the generators do not exist.
2. Replace the CONFORMANCE card with a run table: one row per golden case, the three runtimes as columns, and cells that are pass, fail or never run. Today all cells would read never run, which is the honest and useful state.
3. Show the protocol the spec actually pins — the seven-slot frame, the nine verbs, the six-function C ABI, the credit window and the ownership table — as a PROTOCOL pane with an implemented-versus-specified column. This is the board's real subject and none of it is present.
4. Add an ARTIFACTS pane listing each generated binding with its version, its source descriptor revision, and whether it compiles. generated artifacts remain proposals needs a list of proposals.
5. Surface the one piece of genuine evidence the framework has. §2 records that FlexBuffers is the best-tested module with a differential C++ oracle, an adversarial suite and device runs. That is the exact cross-language conformance evidence this board claims to be about, it exists, and it is on no board in the atlas.
6. Name the flow-control mechanism. Change the C++ card's backpressure to credit-based flow control and give it a pane, since it is the mechanism that makes the polyglot data plane work.

Verdict. Merge into 13.03 Extend · FFI Switchboard. If the merge is refused, re-cut both on the design-time versus run-time axis and move conformance to its own board.

03.03 · Scale · Brownfield Atlas

On the board. Template board. Four cards under DISCOVERY PLANE · SOURCE + OBSERVED: OBSERVED — processes · endpoints · traces · runtime topology, SCANNED — symbols · manifests · schemas · tests · dependencies, WRAPPED — declared contracts · typed adapter · governed operations, and NATIVE — Reaktor graph projection · runtime events · full evidence. Coverage reads Scanned source · observed runtime currently partial, the badge is PARTIAL · 3 unknown, the subtitle is reveal a system without pretending to own it over Observed → scanned → wrapped → native, with stable logical identity, the path is Import → correlate identity → trace feature → export verified context, and the inspector reads Feature / realtime-chat — Brownfield identity retained across increasing trust tiers.

Vision tie. Conceptually the strongest board in my cluster and the most commercially important one in the section, because it is the adoption path. A framework whose thesis is that the graph is the system has an obvious objection — nobody rewrites a working system to adopt it — and this board is the answer: four ascending trust tiers with logical identity preserved across them, so a team can start at OBSERVED and climb. The subtitle reveal a system without pretending to own it is the best single line of copy in my eight boards. It also embodies the adapter idea from §1 concretely, since WRAPPED — declared contracts · typed adapter · governed operations is exactly what an adapter is for.

Workflow tie. Opened in week one of adopting Reaktor into an existing codebase, and again every time a legacy service is promoted a tier. Today this is a Backstage catalog someone fills in by hand, a Datadog service map, an afternoon with grep and a whiteboard, and an architecture diagram that is wrong within a month.

Agentic tie. Very high potential and unrealised. Discovery and correlation are exactly what an agent is good at — read the manifests, read the traces, propose the identity mapping — and Import → correlate identity is a task an agent should own end to end, with the human approving the correlation rather than authoring it. Nothing on the board is a work item an agent can pick up, because there are no discovered entities, only category names.

Blueprint tie. Asset import and the migration or conversion tool — bringing foreign content into the engine and progressively making it native. A good fit, and Unreal's version has the thing this board lacks: a per-asset import log with warnings.

Replaces / augments. Backstage catalog and service discovery, Datadog service map, Dynatrace Smartscape, AWS Application Discovery Service, Structure101 and NDepend, and the architecture spreadsheet.

Improvements.

1. Replace the four sibling cards with a TIER LEDGER — one row per discovered entity, columns for logical identity, current tier, evidence backing that tier, and owner. The four tiers are a progression with a per-entity position, and rendering them as four equal boxes destroys the only structure that matters.
2. Add a PROMOTE control per row showing what it costs to move one tier up: which contracts must be declared to go from scanned to wrapped, which operations must be governed to go from wrapped to native. This is the board's product.
3. Fix the internal contradiction. The OBSERVED card claims processes · endpoints · traces · runtime topology and is itself stamped SOURCE · main, on a board whose findings block says Unknown — Runtime observation is not wired. The observation card is not observed. Either wire it or mark it NotWiredYet.
4. Add a CONFLICTS pane for identity correlation. The hard part of brownfield import is that the same logical service appears under three names across traces, manifests and code; the board promises correlate identity and shows no correlation.
5. Name the three unknowns behind PARTIAL · 3 unknown.
6. Add a coverage number that means something — entities discovered versus entities estimated, with the estimate's basis — instead of the inherited EVIDENCE · 94%.

Verdict. Strengthen. Highest leverage board in the cluster to make concrete, because it is the one that answers the adoption objection.

03.04 · Scale · Constraint Optimizer

On the board. Template board. Four cards under COMPARE MODE · PROPOSAL ONLY: OBJECTIVES — latency · cost · reliability · usability · maintainability, CONSTRAINTS — security · contracts · budgets · policy · platform, CANDIDATES — ranked GraphPatches with explicit compromises, and DECISION EVIDENCE — simulations · affected tests · blast radius · confidence. Coverage reads Designed optimizer · measured proof not yet available, the subtitle is explore the best valid system, not a magic answer, the path is Objectives → candidates → validation → human decision → sealed plan, and the inspector reads Candidate / auth-boundary-v3 — Proposal only · no mutation until review, approval and exact revalidation with Truth UNKNOWN · not wired.

Vision tie. It is reaching for something the vision does not actually claim. §1 never promises a solver. The nearest legitimate reading is that a live typed graph makes trade-offs computable, which is genuine, but the board goes further and asserts a ranked candidate generator with simulation-backed evidence. Given §2, simulations is the deepest unbuilt capability in the entire verification program — deterministic simulation testing is L5, the last level, and L0 CI does not exist yet.

Workflow tie. Notionally a quarterly architecture review. Realistically nobody opens this, because the input it needs — quantified objectives with agreed weights — is a thing organisations produce roughly never.

Agentic tie. Superficially the most agent-native board in the cluster and actually the least trustworthy one. An agent generating ranked architectural candidates against unmeasured objectives will produce confident nonsense, and the board's own evidence card offers simulations as the check. The governance framing is right (Proposal only · no mutation until review, approval and exact revalidation) but governance over fabricated rankings is not safety.

Blueprint tie. Closest to the lightmass or build-settings quality slider — trade compute for quality along a known curve. The analogy breaks badly because Unreal's curve is measured, whereas this board's objectives are five nouns with no units.

Replaces / augments. Infracost and cloud cost calculators, capacity planners, the architecture decision record, and the whiteboard session where three options are compared. In practice 11.04 Optimize · Costs already displaces more of these than this board does.

Improvements.

1. Resolve the self-contradiction first. Truth UNKNOWN · not wired sits nine lines above Confidence 1.0 / exact on the same card. This is the sharpest internal contradiction in the cluster and it is a one-line fix.
2. Give objectives units and current values. latency · cost · reliability · usability · maintainability cannot rank anything; p95 latency ms, $/month, error budget % can. Take the values from 11.04 and 04.01, which have real ones.
3. Show one real candidate with real numbers. 11.04 Optimize · Costs already ships exactly this and does it better: route icebreaker drafts to haiku for circles < 4 days old (quality delta 0.02) → saves ~$31/mo · apply as command RouteModel(budbot.icebreaker, haiku, cond: circle.age<4d) — a named change, a measured quality delta, a price, and an executable command. This board names one candidate id and no numbers at all.
4. Show the frontier, not a list. An optimizer's product is the set of non-dominated options and the reason each dominated one lost. Add a two-axis plot with the dominated candidates greyed and a per-candidate compromise string.
5. Add an INFEASIBLE pane explaining which constraints eliminated which candidates — that explanation is more valuable than the ranking and is what makes the board honest.
6. Replace the simulations claim in DECISION EVIDENCE with what actually exists today, which is affected tests and blast radius, and mark simulation as NotWiredYet with the L5 dependency named.

Verdict. Demote to Vision, or merge into 11.04 Optimize · Costs as a what-if tab. It asserts the least-built capability in the framework and is outperformed on its own subject by a board that already ships a priced, executable recommendation.

Cluster findings

Missing panes.

• Capability & Degradation Matrix. §1 says product code branches on capability and never on platform, and that degradation is designed rather than discovered. The word degrad appears zero times in all 104 boards. The composer's step 3 lets you pick "capability packs" and nothing anywhere shows what a target loses. This is half of a load-bearing idea with no surface.
• Visitor Author & Run. §1's visitors are traversals you write. No board in the atlas lets you author, scope, dry-run or read the result of one; 03.01 shows an access-control card instead. This is the single largest gap in the cluster.
• Primitive Redundancy & Coverage. The basis test for the eigenvector claim. eigen and redundan each appear zero times atlas-wide, so the framework's central claim is asserted in prose and demonstrated nowhere.
• Graph Code Push. §1 names it explicitly — marked subgraphs update and rewire at runtime, delivered as Kotlin/JS through Hermes, with typed boundaries governing what a pushed bundle may touch. code push appears zero times and Hermes appears once, inside the design-system reference library rather than as a product surface. This belongs in Section 03 under Extend and has no board.
• Choreography / Saga. §1 names cross-system flows as saga graphs executed by visitors, with session-typed wires for protocol conformance. saga, choreograph and session-typ are all zero atlas-wide. This pane would also confront §2's finding that the distributed plane has no queues at all and every pipeline is waitUntil fire-and-forget.
• Fingerprint Registry. §2 names one unified fingerprint system — port type identity, codec layout identity, FFI method identity — as the keystone primitive. fingerprint appears twice in the atlas: once as Prepare a fingerprint-bound retry on the composer retry state, and once as an adjective in 13.01. Neither is the keystone. The registry belongs adjacent to 02.03 and 03.02, both of which depend on it.
• Migration Cost Ledger for 03.03. Promoting an entity from wrapped to native has a price in contracts declared and operations governed. The trust ladder is shown without its rungs.
• Boundary Conformance Runs. Both 03.02 and 13.03 carry a CONFORMANCE card and neither shows a run. Meanwhile §2 records that FlexBuffers has a differential C++ oracle, an adversarial suite and physical device runs — real cross-language conformance evidence that exists in code and appears on no board in the atlas.

Seams.

One template, seven skins. 02.02, 02.03, 02.04, 03.01, 03.02, 03.03 and 03.04 are identical outside roughly twelve lines, and the identical part includes all the evidence. The Symphony Contract promises that selection, revision, environment, principal, time and evidence survive every movement, but evidence cannot survive a movement between boards that report 12 findings · 3 blocking and EVIDENCE · 94% regardless of subject — moving between them carries nothing, because nothing on either side is about the subject.

02.01 and its own state board are the same artboard. Diffing 02.01 Create · New System Composer against STATE · Composer · 3 of 5 · Targets & Capabilities yields eleven differing lines out of about a hundred and seventeen, all of them chrome. The canonical product board is the degraded copy: the state version carries Source projection · 8 targets · 4 capability gaps · no side effects and policy not evaluated, and the product version replaced both with the generic evidence required · state matrix available and policy required.

The composer's state machine does not advance. Across all ten composer states the five bootstrap rows never change from 01 ready, 02 ready, 03 blocked, 04 blocked, 05 blocked. Provisioning · Complete reads 5 / 5 verified above three rows marked blocked. RECEIPT PREVIEW reads Plan not sealed and Rollback not applicable on the state captioned VERIFIED · RECEIPT ISSUED — whose own footer says receipt_0182 · verified · rollback window 15m — and on the state captioned ROLLING BACK · VERIFIED STEPS. The environment chip stays LOCAL while the effect chip escalates to REMOTE REVERSIBLE; only the rollback board flips to PROD. The state matrix is the atlas's proof that lifecycle is modelled independently of truth and effect, and it is the place the independence visibly fails.

One concept, five names. What 02.03 calls Port / ContractDescriptor is ContractDescriptor in 03.02's path, Contract / realtime.chat.v2 in 03.02's inspector, Boundary / chat.realtime in 13.03's inspector, and domain contract · named schema + compatibility in 04.02's taxonomy. An agent cannot join these.

Two of my boards are outranked on their own subjects by 04.02, which links to neither. 04.02 Map · Semantic Graph Editor & Compiler carries the real port taxonomy that 02.03 owes — exec, Session / domain types, Bool / primitives, String / text, Flow<T> / streams, navigation, containment, each with contract, label, shape and colour — and it states the visitor authority model that 03.01 owes, in the sentence agents are visitors alongside Authenticated read plane → snapshot/query/evidence · mutation broker → proposal/plan. Similarly, 05.01 outranks 02.02 and 11.04 outranks 03.04. The pattern is that the abstract Create/Govern board is consistently the weaker rendering of content another board already holds concretely.

Dead ends. 02.01's four Open in Graph ↗ links are the only cross-board navigation in the cluster. The seven template boards offer a per-card Inspect ↗ and a Commit button, with no route to 04.01 System Graph, 05.01 Atomic Catalog, 08.04 MCP & Memory or 11.04 Costs — precisely the boards holding the concrete versions of their content.

Honesty audit.

The single worst offence is shared by all seven template boards and is a direct self-contradiction, not merely unmarked data. Each board's findings block says Unknown — Runtime observation is not wired, and eighteen lines below, the evidence block says Observed — runtime · 3s and Confidence — 1.0 / exact. A three-second-old observation from an unwired runtime is not stale data, it is invented data, and the board states both facts about itself simultaneously. The honest version reads Observed — NotWiredYet and Confidence — none, with an EmptyReason naming what would have to be wired.

The same seven boards assert 12 findings · 3 blocking, 14 tests · 3 deploy targets, Δ5 · DRAFT and EVIDENCE · 94% with no provenance marker. These cannot be true of seven different subjects at once; identical values across unrelated subjects is the signature of sample data. The honest version strikes the block from six of them and gives each board its own count or an EmptyReason such as "no scan has been run on this scope".

03.04 is the extreme case. Truth — UNKNOWN · not wired and Confidence — 1.0 / exact appear nine lines apart on the same card, on a board whose coverage line already admits measured proof not yet available. It then offers simulations as decision evidence for a framework whose verification program places deterministic simulation testing at L5 and whose L0 CI does not exist.

02.03 claims exactness at the framework's known break. Port / ContractDescriptor — Canonical contract identity with schema compatibility evidence, marked Confidence 1.0 / exact, describes the precise thing audit D-6 says is unsound. The honest version is a Conflict finding citing D-6, with the inspector split into reified port · class carried and string-built port · class null and a real count of each.

03.02 makes the misleading claim its twin got right. Kotlin implemented · TS/C++ conformance designed with Truth SOURCE, for a module whose Transport is four TODO()s and which implements none of the seven-slot frame, nine verbs, six-function C ABI, credits or ownership table. 13.03 marks the same subsystem UNKNOWN · not wired. The honest version adopts 13.03's marking and shows the CONFORMANCE card as zero runs with an EmptyReason rather than listing golden round trips · version negotiation · trace parity as though they exist.

03.03's OBSERVED card is stamped SOURCE · main. The card claiming processes, endpoints, traces and runtime topology is itself not observed, on a board whose findings block says runtime observation is not wired.

02.01 is the honest counter-example and shows the pattern the others should copy: Targets proposed · provider access not exercised, Plan — not sealed, Rollback — not applicable, 0 / 5 executed, PENDING DECISIONS · 2. Its remaining flaw is small and fixable — the four quadrant numbers (3 apps · 18 routes, 7 services · 12 workers, 6 engines · 42 schemas, 8 targets · 14 gates) describe a system that does not exist yet and read as counts, so they need a PROPOSED marking to match the honesty of the rest of the board.

Part 6 · Section 04 — The Graph Substrate

Ten boards: 04.01, 04.02, 04.03, 04.04, 04.05, 04.06, 04.06A, 04.06B, 04.07, 04.08. The section card SECTION 04 · GRAPH SUBSTRATE claims "6 SURFACES". There are ten boards. Either the index is stale or four boards accreted after the section was scoped. My consolidation in §Redundancy lands back on exactly six, which suggests the index is right and the section drifted.

Summary before the detail

Section 04 is the strongest thinking in the atlas and the weakest honesty. Three boards — 04.06/A/B, 04.07, 04.08 — contain the only file-and-line source citations, the only board that says MEASURED, and the only board that admits a current failure in the shipped product. Around them sit four boards that assert 73 unit-bearing numbers with no provenance, contradict each other's node counts under the same revision string, and in one case (04.04) reproduce a neighbouring board with its port rows mass-filled with wrong values.

Three structural facts govern everything below.

The truth vocabulary is completely absent here. Across all ten boards, the components Effect, Permission, Origin, Confidence, Revision, Owner appear zero times, and Truth appears once — as a plain row label on 04.03, not as a marker. Every peripheral board I cross-checked (01.03 System Fabric, 02.04 BestBuds Feature Graph, 13.03 FFI Switchboard, 13.04 Graph Projections) carries the full Truth / Effect / Permission block and the five-field EVIDENCE block. The atlas's evidence discipline reaches the periphery and stops at the core.

There are three chrome generations inside one section. 04.01, 04.02 and 04.03 carry the full mode band (EXPLORE · EDIT · DEBUG · COMPARE), the query facet band and the lens band. 04.04, 04.05, 04.06/A/B carry a reduced shell with the movement nav but no mode band, no query band and no lens band. 04.07 and 04.08 carry no shell at all — they are documentation posters. None of the ten uses the atlas-standard SCOPES & QUERIES rail; 04.03 invents its own.

The mode selector appears only on boards that do not use it. EXPLORE · EDIT · DEBUG · COMPARE is exactly the authoring-versus-runtime switch the section needs. It is printed on the three map boards and absent from 04.06 (which is EDIT), 04.08 (which is DEBUG), and from any board that would be COMPARE. The control exists nowhere near the thing it controls.

04.01 · Graph · System Graph

On the board. A single canvas at zoom 36% · overlay: runtime hosts grouping the whole product into thirteen labelled islands: Android · mobile app, iOS · mobile app, KMP shared, Web · app, App graph · routes · screens · services, Cloudflare Edge Workers, Cloudflare Durable Objects, GCP Compute Engine, Cloudflare D1, Cloudflare R2, Supabase · Postgres, Memgraph · social-graph, GCP PubSub. Every node card carries a kind chip and a metric footer (cf.do/presence · DO · 4ms · 142k subs, sb.pg/messages · PG · 12.4M rows). Cross-island edges are labelled with real verbs: getDO(room), INSERT session, PUT avatar, upsert · audit insert, Cypher, fanout · push deliver, MATCH friends. A summary chip reads 166 nodes / 14 runtime islands, and a prose block states the thesis: No other tool draws this picture: client code, shared KMP, edge workers, durable objects, three databases, queues and the JVM plane — typed, live, and editable as ONE graph.

Vision tie. This is the atlas's clearest picture of one graph spanning devices and cloud, and it is the only board where the KMP shared node visibly renders into three platform apps (renders, renders, shared auth · chat). It embodies the polyglot-on-one-data-plane claim structurally. It does not embody eigenvector primitives at all: nothing on the board shows a port, so the "typed" half of "typed, live, and editable" is asserted in prose and drawn nowhere.

Workflow tie. A staff engineer opens this in the first week on the team, or in the first ten minutes of an incident when the question is "what talks to what". Today that picture is assembled from a stale Miro board, the Cloudflare dashboard, a Terraform graph and someone's memory, and the four disagree.

Agentic tie. An agent reads island membership, kind, and a metric per node — but with no Origin or asOf on any datum it cannot tell a configured value from an observed one, so it cannot safely reason about anything. The chrome offers Ask · Explain · Propose · Delegate with no depicted agent surface. This is the most agent-legible structure in the cluster attached to the least agent-usable evidence.

Blueprint tie. This is the Level, not the Blueprint editor — the world outline showing every actor placed in the map. The analogy breaks in a way that favours Reaktor: Unreal's level contains one process on one machine, and this contains six runtimes across two clouds.

Replaces / augments. Structurizr and C4 diagrams, Backstage's software catalog and system diagrams, the Cloudflare dashboard's resource list, Datadog Service Map, AWS/GCP architecture diagram tools, Lucidchart.

Improvements.

1. Obey 04.07's own contract. At zoom 36% the L1 tier specifies that footers, ports and probes collapse and islands render as scope cards. This board draws a per-node footer with a latency on all fifty cards. Either raise the stated zoom to L2 or strip the footers and replace them with 04.07's specified owner · contract counts · health chips.
2. Reconcile the counters against the canvas. The chip says 166 nodes / 14 runtime islands; the board draws fifty labelled cards in thirteen groups. Make the counter a computed field bound to the rendered set, and show 50 of 166 rendered · 116 collapsed if that is what is meant.
3. Ghost the queue plane. GCP PubSub shows four topics with throughput (notifications · 412k msg/h). Audit §2 states the distributed plane has no queues at all. Render that island in the DESIRED-only style with an EmptyReason: NotWiredYet — pipelines are waitUntil fire-and-forget.
4. Add a per-island identity coverage chip — resolved 41 · nominal 7 · conflict 2 — so the board that claims "typed" shows type soundness at the tier where you first meet the system.
5. Give every metric footer a two-character provenance prefix (S source, O observed, ? unknown) so 73 numbers stop reading as 73 measurements.

Verdict. Strengthen. Retitle as 04.01 · Map · System Landscape (L0/L1) so it reads as a tier of 04.07's contract rather than a competing product.

04.02 · Map · Semantic Graph Editor & Compiler

On the board. Four stacked panels above the standard chrome. A worked canvas titled Auth happy path — keep p95 under 150ms · owned by @auth-squad runs AppleButton.onClick → loginWithApple → AuthService.login → cf.workers/auth → d1.sessions, with ▶ exec / exec ▶ pins, a ⏸ breakpoint on AuthService.login, a WATCH · session popover showing { uid: 9f2e…, provider: apple, ttl: 3600, issued: 12s ago }, and an insert affordance ↵ insert + auto-connect session → input. Below it, PORT & RELATIONSHIP TAXONOMY — CONTRACT + LABEL + SHAPE + COLOR defines seven wire kinds (exec triangle+arrow, domain contract, Bool diamond, String square, Flow<T> pulse pattern with rate, navigation route glyph, containment dashed boundary). Then INTERACTION GRAMMAR — VIEW COMMANDS ≠ SEMANTIC PATCHES maps eight gestures to outcomes. Then SEMANTIC CHANGE — PATCH → COMPILE → PLAN → AUTHORIZE → RUN → VERIFY → RECEIPT with the caveat drift invalidates approval · agent/Critic may propose and review, never self-approve or apply.

Vision tie. The strongest single idea in the cluster is one line here: GraphViewCommand.Move · semantic hash unchanged. Separating view commands from semantic patches is what makes "the diagram and the system are the same object" survivable — you can rearrange the picture without lying about the system. Flow<T> stream · pulse pattern + rate + label is the only place the atlas gives streams a distinct visual identity, which is the polyglot data plane made visible. agents are visitors and Authenticated read plane → snapshot/query/evidence · mutation broker → proposal/plan is the cleanest statement of agent governance anywhere in the section.

Workflow tie. This is not a screen anybody opens on a Tuesday. It is the specification a designer and a graph engineer argue over once, and then implement. Its audience is internal.

Agentic tie. The best agentic board here. It states the read plane, the mutation broker, the prohibition on self-approval, and the drift-invalidates-approval rule. What it lacks is any depicted place where an agent's proposal appears — the Review draft button in chrome has no destination on this board.

Blueprint tie. This is the Blueprint editor's design document, covering pin taxonomy, the graph action menu, breakpoints and watches in one page. The taxonomy exceeds Blueprint: Unreal has exec, data and delegate pins, and no notion of a stream with a rate or a containment relationship.

Replaces / augments. The Blueprint reference documentation itself; Node-RED and n8n's wire model; Retool's binding editor; the design half of a graph IDE spec.

Improvements.

1. Move the PORT & RELATIONSHIP TAXONOMY onto 04.06, where wiring actually happens. Today 04.06/A/B draw undifferentiated pins and the taxonomy that would explain them lives on a board nobody has open.
2. Resolve the reroute contradiction against 04.06B. Here and on 04.07 reroute is a view-only patch with the spec hash unchanged; on 04.06B it is GraphPatch revision 2 producing 1 node + 2 typed edges. Pick one and correct the other two boards.
3. Add a NOMINAL row to the taxonomy. Seven wire kinds are drawn as if all seven have sound identity; the eighth state — a contract matched by name with an unresolved class — is the one a developer most needs to see.
4. Give the WATCH · session popover the four fields the board itself promises under hover wire: origin, asOf, rate, gaps. The popover shows values with none of them.
5. Add the counterexample lane to the seven-stage pipeline: what a compiled ✗ looks like, and where the finding surfaces. Today the strip only draws the happy path.

Verdict. Split into 04.06 (taxonomy), 04.07 (interaction grammar, which already duplicates it) and 04.08 (the patch pipeline, which already draws the same seven-stage strip). Nothing here needs its own board; everything here needs to be on the board where the gesture happens.

04.03 · Map · Full System + Fabric Studio — Command Density

On the board. The only complete application in the section, and the densest board in the atlas at 296 extracted lines. Left rail: SAVED VIEWS · 8 (Whole system L0, Feature path L2, Change impact Δ5, Production now LIVE), SCOPES · 3, FINDINGS · 3 (Contract conflicts 2, Stale evidence 1, Uncovered ports 3), KINDS · CLICK TO ISOLATE. Canvas: three collapsible scopes with per-node truth footers that actually differ — LIVE · 2 instances · 6.2ms, SOURCE + LIVE · 24k req · 2s, PARTIAL · p95 94ms · source + trace, LIVE · 0 backlog · state rev 1842. A LENS STACK of six overlays (STRUCTURE · BASE, RUNTIME, CHANGES · Δ5, TEST IMPACT, SECURITY, COST + CARBON). A right inspector with six tabs — Summary, Contracts, Runtime, Source, Evidence, History — carrying SEMANTIC IDENTITY · APP + DATA + EVENT + RESOURCE FACETS, PROVIDES · 2 CONTRACTS (auth.login · v3 · request → session | typed errors · 3 consumers), CONSUMES · 1 CONTRACT, CHANGE IMPACT · DRAFT Δ5, and OBSERVED PLANE · LIVE 2s · RESOURCE TTL 10s. A bottom dock with nine counted tabs (Changes 5, Agent 1, Run Timeline 12, Trace 24, Findings 3, Tests 14, Evidence 18, History 36, Console 0). A patch queue with #01 ConnectPorts and #02 ChangeContract · identity.session v2 → v3 · migration adapter · 3 consumers, a semantic diff (+1 edge · 0 materialized) and Approval pending. Footer: policy v19 · proposal only · scale S · unmeasured.

Vision tie. This is the vision at working scale. Per-node truth footers make desired + observed real rather than a chrome band. Desired 128 · Observed 116 · Stale 7 · Unknown 5 · Findings 12 is the single best evidence line in the section: five buckets, summing, with Unknown as a first-class category. ChangeContract · migration adapter · 3 consumers is the only place in the cluster where a contract version bump shows its blast radius. scale S · unmeasured in the footer is an honest admission of exactly the kind §1 asks for.

Workflow tie. This is the daily driver — the pane a feature engineer keeps open while working, in the way an IDE is kept open. It replaces the tab strip of Datadog, GitHub, the Cloudflare dashboard and Linear that engineers currently arrange across two monitors.

Agentic tie. The one board with an agent seat at the table: an Agent · 1 dock tab, a patch queue where a proposal sits next to a human one, Approval pending, and policy v19 · proposal only. An agent can read contracts with versions and consumer counts, propose a ConnectPorts or ChangeContract patch, and be governed by the queue. The gap is that neither queue item shows who authored it.

Blueprint tie. This is the full Unreal editor window: world outliner (left rail), viewport (canvas), details panel (inspector), output log and content drawer (bottom dock). The lens stack has no Unreal equivalent — the closest is view modes on the viewport, and those recolor geometry rather than reproject semantics.

Replaces / augments. Backstage, Datadog APM's service page, Sentry issue detail, Linear's issue panel, GitHub's PR review, Terraform plan output, and the IDE's project view — merged into one selection-preserving surface.

Improvements.

1. Fix the Element ID collision. The inspector header reads element:ui/onboarding/screen and the identity block below it reads ui:onboarding/screen. Two spellings of the same identifier, sixteen lines apart, on the board that defines semantic identity. Pick one grammar and enforce it in the component.
2. Reconcile the counters. 75 nodes · 100 edges sits above a KINDS legend summing to twenty-nine and a canvas drawing seven nodes. Bind the totals to the query result and add showing 7 of 75 · 3 scopes collapsed.
3. Add an author column to the patch queue. #01 and #02 both read compiled · review with no principal. Agent-authored and human-authored patches must be visually distinguishable before approval, not after.
4. Make EVIDENCE · 94% clickable and defined. The number appears in chrome on three boards and is defined nowhere. It should open the Evidence dock tab filtered to the 6% that is missing.
5. Add the identity facet to SEMANTIC IDENTITY · APP + DATA + EVENT + RESOURCE FACETS. Four facets are named; the contract fingerprint is the fifth and the only one that determines whether a wire is legal.
6. Wire the COMPARE mode. It is lit in this board's mode band and has no destination in the section.

Verdict. Keep. Make it the section's canonical studio and the only board carrying the full shell; every other board in section 04 should be framed as a panel of this one or a contract this one obeys.

04.04 · Graph · Launch

On the board. A reduced shell (movement nav and instrument row, no mode band, no query band, no lens band) over a canvas with the same three scope headers as 04.03 — Onboarding L2 · 8 nodes, Chat L2 · 12 nodes, Services · Repositories · Actors L2 · 7 nodes — and the same seven node cards. Chrome states projection: designed and the footer states performance · unmeasured, while the canvas asserts nine latencies (/onboarding · p95 92ms · err 0% · 8.2k, ChatActor · RUNNING · 1.2k msg/m). Counters read 60 nodes / 49 edges / ⚠ 6 warnings. The same KINDS · CLICK TO ISOLATE legend as 04.03, summing to twenty-nine.

Vision tie. None it does not borrow. It is 04.03 with the rail, inspector, dock, lens stack and mode band deleted.

Workflow tie. A launch or landing state — the first thing you see when the studio opens. That is a real need, but it needs the studio's affordances greyed, not removed.

Agentic tie. Agent-hostile. Chrome offers Ask · Propose with no queue, no findings list and no evidence surface. Nothing here is safely readable: every metric on the canvas contradicts the board's own projection: designed.

Blueprint tie. The Unreal project launcher screen, and it fails the same way — showing a thumbnail of the editor rather than the editor.

Replaces / augments. Nothing that 04.03 does not already replace.

Improvements. The board is not repairable as a separate surface, but if it survives: give every node its correct ports; drop the metric footers or change chrome to projection: observed; reconcile 60 nodes with the twenty-nine-item legend; and show the empty rail, inspector and dock in their zero states rather than omitting them, since a launch screen's job is to teach the layout.

Verdict. Cut. This is 04.03 with its data corrupted rather than simplified: every node — including AuthService · SVC, UserRepository · REPO and ChatActor · ACTOR — is given the identical four port rows routeBinding / navBinding / authInteractor / screen. A repository with a navBinding port is not a simplification of 04.03's correct rows (get / objectStore / update / flow); it is a mass-fill that makes the board actively misleading about what a port is. It also asserts a different node and edge count for the same revision 8f41c2. Fold the launch requirement into 04.03 as an empty state.

04.05 · Map · Semantic Depth × Density

On the board. A depth strip (L0 Product, L1 Island, L2 Scope, L3 Component, L4 Evidence) and a lens strip (BASE · STRUCTURE, + RUNTIME, + CHANGE, TESTS, SECURITY) over five GROUP cards — ChatGraph · 12 nodes · 2 subgraphs, OnboardingGraph · 8 nodes · 1 subgraph, CampaignGraph · 9 nodes · 2 subgraphs, EventGraph · 7 nodes · 1 subgraph, Services Core · 7 services · 3 actors — each with ⌥ expand and an inter-group wire bundle count (×6 wires, ×9 wires). A status line reads L2 scope · Standard density · 4 scopes collapsed · MIXED · PRODUCT L2. Below, the thesis: Depth and density are orthogonal. L0–L4 preserve one ElementId while Focus, Standard, and Command layouts change chrome—not truth. Then FOCAL DRILL · ENTER CHATGRAPH · ESC UP showing a breadcrumb BestBuds / Chat / ChatGraph · L2 Scope · Standard density and three cards.

Vision tie. Bundled edges with a count (×6 wires) and collapsed scopes with node counts are the correct rendering of nested graphs — a collapsed subgraph that shows its weight is honest, a blank rectangle is not. The orthogonality claim is the load-bearing idea and it is stated well.

Workflow tie. Nobody opens this board. It is a design rationale, and it duplicates the rationale on 04.07.

Agentic tie. An agent gets group membership and subgraph counts, which is genuinely useful for scoping a query. But projection: designed sits above 12k visits · p95 64ms and RUNNING · 1.2k msg/m, so an agent parsing this board would attribute observed traffic to a designed projection.

Blueprint tie. Unreal has nothing here. Blueprint has one zoom continuum with LOD culling; it does not reproject the graph at each tier, and collapsing a node group does not summarize it. This is where Reaktor most clearly exceeds the analogy, and the board is the wrong place to say so.

Replaces / augments. The zoom behaviour of Figma and Miro; C4's level ladder; nothing operational.

Improvements. All of these apply after the merge below: carry the ×N wires bundle count into 04.07's L1 tier description, which currently says only edges bundled per island pair (×N); add the density axis (Focus / Standard / Command) to 04.07, which today has only the depth axis; fix 4 scopes collapsed against five drawn cards; and either drop the traffic metrics or switch the projection label.

Verdict. Merge into 04.07. Its unique content is one paragraph, one density axis and one focal-drill strip. 04.07 already owns L0–L4 and states the same navigation contract in more detail.

04.06 · Graph · Editing Connections

On the board. The compatibility board, and the most sourced content in the atlas. A canvas headed Edit mode · every gesture emits a typed GraphCommand shows a consumer AuthInteractor · ◉ authService with consumer slot: EMPTY · single-slot against four candidate providers in four distinct states: AuthService · MATCH ✓ · exact type-token match · fan-out 1→N ok; AuthService · staging · KEY ≠ · type ok · key differs — autoWire skips; ChatService · TYPE ✗ · type mismatch — not droppable; UserRepository · REPO · sqlAdapter · unwired · ◌ DI-satisfiable · resolvable via DI · Port:∅:SqlAdapter. A drop preview reads drop → ConnectPorts(AuthInteractor.authService ← AuthService) · contract AuthService · key ∅ · consumer is single-slot · connect.kt:15. Three reference panels follow: COMPATIBILITY WHILE DRAGGING (five states); CONNECTION RULES · REAKTOR-GRAPH with six rules each citing real code (type equality, not subtyping — connect.kt:15, consumer holds ONE edge — Edge.kt:22, provider fans out 1 → N — ProviderPort.edges, autoWire: local-first by key, then DI — Graph.kt:224, qualifier = Port:$key:$type — Port.kt:32, dis/connect emits PortEvent on both owners); a wire context menu (Disconnect, Rewire to…, Insert reroute, Watch value, Open contract · AuthService.kt, Blame · who wired this); and GRAPH-NATIVE ADVANTAGE, an eight-row comparison against Unreal. The commit path reads on drop → ConnectPorts(...) → GraphPatch → dryRun ✓ → queue #12 · drafted → Critic review → apply → PortEvent.Connected on both owners.

Vision tie. This is eigenvector primitives made touchable — one gesture, one typed command, one patch, one event on both owners. It is also the only place in the atlas where a UI claim is backed by a file and a line number, which is precisely what §1's evidence principle asks for.

Workflow tie. This is the moment of work: an engineer adding a dependency. Today they open AuthInteractor.kt, add a constructor parameter, run the build, discover the DI graph does not resolve, and read a stack trace. The board replaces a compile-and-guess loop with a drag whose legality is known before release.

Agentic tie. The best agent-readable spec in the cluster, because six rules with file citations are a machine-checkable contract. And it is the most dangerous, because the rule it teaches is unsound. An agent that internalises exact type-token match will confidently wire two string-constructed ports that share a name and disagree about their payload — which audit D-6 says is exactly what happens today.

Blueprint tie. This is the Blueprint pin-drag interaction, one-for-one, and it is better in three respects: the amber key differs state has no Unreal equivalent, the ◌ DI-satisfiable badge has no Unreal equivalent, and Blame · who wired this has none either. It is worse in one: Unreal will insert a conversion node for you, and this board's model refuses coercion without offering the graph-native substitute (an adapter node), even though 04.03 shows migration adapter exists.

Replaces / augments. Dagger/Hilt error output, Koin's runtime resolution failures, the IDE's "cannot resolve dependency" dialog, Blueprint's pin drag, and the manual reading of a DI module that today answers "what can satisfy this".

Improvements.

1. Add the two missing compatibility states described in §The identity problem: a hatched NOMINAL MATCH (name matches, class unresolved, droppable but generates a finding) and an outlined DIGEST CONFLICT (same name, different content digest, not droppable). Three states become five.
2. Change the qualifier on the rules card from Port:$key:$type to Port:$key:$type#$digest and add a seventh rule: identity is the content digest, not the class token — D-6 open.
3. Put truth marks on GRAPH-NATIVE ADVANTAGE. Two of its eight ticks are false against §2: edit connections ✓ type-checked is what D-6 says is unsound, and live values on wires ✓ (UE: PIE only) is not wired — 13.03 and 13.04 both carry Unknown · Runtime observation is not wired. Replace the ✓ column with SHIPPED / DESIGNED / NOT WIRED and add a ninth row for identity soundness marked DEFECT · D-6.
4. Add Why does this match? to the wire context menu, opening a two-column derivation of both sides' declared shape with the differing field highlighted. This is the affordance that turns an unsound type system's failures from mysterious into teachable.
5. Adopt 04.02's port taxonomy so the pins on this canvas carry shape and colour. Right now the board that teaches wiring draws every pin identically.

Verdict. Strengthen. This is the cluster's keystone board and it needs one axis added, not a rebuild.

04.06A · Graph · Editing Connections — Connected

On the board. Identical to 04.06 except the canvas header (Connected · typed command committed · Undo available), the result card (ConnectPorts(AuthInteractor.authService ← AuthService) ✓ · revision 1 / typed edge committed · both port owners emitted Connected · audit sealed) and the footer path (ConnectPorts(...) → GraphPatch revision 1 ✓ → typed edge materialized → Undo restores Pending). All three reference panels are byte-identical to 04.06.

Vision tie. both port owners emitted Connected is the live graph asserting itself — the edit is not a file write that a rebuild later notices, it is an event on two resident objects. audit sealed and revision 1 carry the governance spine into the smallest possible action.

Workflow tie. This is the second frame of a two-second interaction. Its purpose is a design contract for the commit state, and as a state board that is correct practice.

Agentic tie. revision 1 and audit sealed are precisely what an agent needs to confirm its own patch landed. What is missing is the receipt identifier — the seven-stage pipeline on 04.02 and 04.08 ends in receipt, and this board, which is where a receipt would first exist, does not show one.

Blueprint tie. Blueprint has no equivalent. Connecting a pin in Unreal produces no revision, no event, no audit entry and no undo target beyond the editor's transaction buffer.

Replaces / augments. A git commit of a DI module, plus the CI run that validates it, collapsed into an audited moment.

Improvements.

1. Show the receipt: receipt r1843 · sealed 12:41:08 · principal ovd · policy v19. It is the payoff of the pipeline and it is missing at the only point it exists.
2. Make the wire visually different from the pending state — this is a state board and the only difference an engineer can see in the extracted text is the caption.
3. Show the identity that was committed on the result card: identity #a41c9e2f ⇄ #a41c9e2f · exact.
4. Show what the commit invalidated: if any approval elsewhere was drift-invalidated (04.02's rule), name it here.

Verdict. Keep.

04.06B · Graph · Editing Connections — Rerouted

On the board. Again identical chrome and reference panels; the deltas are the header (Rerouted · two typed wires · Undo returns to Connected), the result card (InsertReroute(authService edge) ✓ · revision 2 / reroute node owns typed input/output · topology rebuilt without identity drift) and the footer (InsertReroute(...) → GraphPatch revision 2 ✓ → 1 node + 2 typed edges → Undo restores Connected).

Vision tie. topology rebuilt without identity drift is the exact right sentence: the picture changed, the identities did not. That is the diagram-cannot-lie thesis at the scale of one node.

Workflow tie. Reroute is a readability edit. Its whole value depends on being free — if straightening a wire costs a review cycle, nobody does it and the graph becomes unreadable.

Agentic tie. An agent doing layout hygiene across a large graph is an obvious and safe use — but only if reroute is a view command. As drawn it is GraphPatch revision 2, which means an agent tidying two hundred wires would generate two hundred governed patches.

Blueprint tie. Unreal's reroute node, exactly. Unreal's is purely cosmetic and does not affect compilation.

Replaces / augments. Blueprint reroute nodes; the manual node-nudging in any diagram tool.

Improvements.

1. Resolve the classification, which is the sharpest contradiction in the section. This board makes reroute a semantic patch producing a new revision. 04.07 says double-click wire · InsertReroute · view patch only · spec hash unchanged and 04.08 labels the same thing reroute · view patch. The correct answer is that a reroute node is a rendering artefact and must not bump the revision; change this board to InsertReroute ✓ · view patch · spec hash 8f41c2 unchanged and keep Undo restores Connected.
2. If reroute genuinely materialises a node, show what the compiler does with it — a reroute that survives into the bundle is a runtime hop, and 04.08's determinism claim depends on knowing whether it does.
3. Add a Straighten all in scope bulk action, since Q · align and straighten on 04.07 and 04.08 implies one and no board offers it.

Verdict. Strengthen — specifically, correct the patch classification.

04.07 · Map · Zoom & Level of Detail

On the board. No app chrome; a four-tier specification. Header: one graph · four render contracts · the same ElementIds survive every tier, and beneath it the only MEASURED claim in the section — MEASURED · workbench Code level draws 172 n · 153 e · 72 disconnected ports. Four tier cards, each with RENDERS, COLLAPSES, BUDGET, PRIMARY ACTION and a one-line principle: L0 · LANDSCAPE · zoom ≤ 25% (budget ≤ 5 s cold overview at 50k / 150k · registry query p95 ≤ 250 ms, principle Fit shows the whole system. It never claims 6 px labels are readable.); L1 · ISLAND · 25 – 50% (A collapsed scope is a summary, never a blank rectangle.); L2 · STANDARD · 50 – 100% (≤ 250 rich cards · pan / zoom frame p95 ≤ 16.7 ms, The default working tier.); L3 · DETAIL · ≥ 100% (collapses nothing — this is the floor, primary action watch · breakpoint · step). Then NAVIGATION CONTRACT — DEPTH IS A QUERY, NOT A ZOOM SETTING with six bindings, BLUEPRINT-GRADE GESTURE GRAMMAR — EVERY GESTURE EMITS A TYPED GRAPHCOMMAND with eight, and WHY LEVEL OF DETAIL IS SEMANTIC closing with the section's most honest sentence: Today the workbench renders one tier at every zoom. Fit produces 172 uniform cards and 153 same-coloured wires with no direction to read. LOD is the fix.

Vision tie. "Depth is a query, not a zoom setting" is the deepest idea in the cluster. It is what separates a live semantic graph from a picture of one: at each tier the system runs a different query against the same snapshot and renders a different projection, while ElementId — and with it selection, lens, truth plane, time window and revision — survives. That is the Symphony Contract stated more precisely than 00 · START HERE states it.

Workflow tie. This is a performance and interaction contract that a rendering engineer implements against and a reviewer tests against. Its budgets are the acceptance criteria.

Agentic tie. Indirectly excellent. ⌘F · find across scopes without expanding them and the depth-as-query framing mean an agent can request a tier rather than simulating zoom — an agent should never need a camera. But no board shows the query language that would express give me L1 for island X.

Blueprint tie. Unreal has no equivalent and the board knows it — the gesture grammar is titled BLUEPRINT-GRADE, which is a claim of parity on gestures and superiority on projection. Blueprint's zoom is a scale transform with text culling; there is no tier at which a Blueprint graph becomes a set of summary cards with contract counts.

Replaces / augments. Figma and Miro zoom semantics; Google Maps' tile-and-label LOD; the "collapse all" of any IDE — and, more to the point, it replaces the current workbench behaviour it names.

Improvements.

1. Mark each BUDGET as TARGET or MEASURED. ≤ 5 s cold overview at 50k / 150k and pan / zoom frame p95 ≤ 16.7 ms are goals typeset identically to the one number on the board that was actually observed.
2. Add an identity coverage line to each tier's RENDERS list — resolved / nominal / conflict counts per island at L0 and L1, per node at L2, per port at L3 — so type soundness is legible at the distance you are standing.
3. Absorb the density axis from 04.05. The board has depth and no density; 04.05 has Focus, Standard, and Command and the assertion that the two are orthogonal. A four-by-three matrix showing which combinations are legal is one panel.
4. State what happens when an ElementId does not survive a transition. The board promises preservation when the ElementId still exists and never shows the other case, which is the one that happens after a refactor.
5. Add the 72 disconnected ports figure to L0's rendered summary. It is the most alarming fact the section knows and it appears once, in small type, in a header.

Verdict. Keep. This is the best board in the cluster and one of the best in the atlas. It should absorb 04.05 and 04.02's interaction grammar.

04.08 · Act + Source · Authoring, Compile & Debug

On the board. No chrome; five panels forming the full authoring loop. A status strip COMPILE ✗ 2 errors · 1 warning. PALETTE · DRAG FROM PIN · FILTERED BY CONTRACT with a search field (⌕ auth), a context line (drag from AuthInteractor.authService ⟶ ConsumerPort<AuthService>), COMPATIBLE · 3 (AuthService, AuthServiceStub · test double · same contract, AuthService · staging) and — the best idea on the board — EXCLUDED · 4 · REASONS SHOWN, listing four different classes of exclusion: ChatService · type — ChatService ≠ AuthService, SqlAdapter · direction — consumer cannot bind consumer, MediaUploader · capability — requires media:write, AuthService · prod · environment — production not legal from local, closing with Unreal filters silently; Reaktor says why. CANVAS · EDIT MODE shows a comment strip (Auth happy path — keep p95 < 150 ms · owned by @auth-squad [C]), a ◆ breakpoint · hit 3 on AuthInteractor, an ✗ E-CONTRACT-401 on AuthService, a ● watch · 2 values on SessionStore, and Session{uid:9f2e…} · 142 ms. A GESTURES table of seven. COMPILER RESULTS · EVERY FINDING MAPS TO AN ELEMENTID with three coded findings each with → focus, closing Deterministic: same spec + same passes ⇒ byte-identical bundle. Warnings never become silent coercions. DEBUGGER · SANDBOX SESSION with specHash 8f41c2 · backend interpreter · seed 42, transport controls ⏸ ▶ ⤵ into ⤴ over ⏭ run to, WATCHES, and REPLAY CLASSES — Pure · safely recompute, Deterministic local · re-run in pinned sandbox, Recorded · replay captured result, External · barrier — rewind never re-executes production. Footer: the seven-stage pipeline and gestures create drafts only · external undo is a governed rollback.

Vision tie. Two ideas here are genuinely new and neither exists in Unreal. EXCLUDED · 4 · REASONS SHOWN with four exclusion classes turns the palette from a filter into an explanation, and capability — requires media:write is §1's capability tiers appearing at the moment of authoring rather than as documentation. REPLAY CLASSES is the deeper one: it is a formal answer to "what is safe to re-execute", and External · barrier — rewind never re-executes production is the sentence that makes a time-travelling debugger safe to point at a real system. No debugger I know of makes this distinction explicit.

Workflow tie. This is the inner loop — the fifteen-second cycle an engineer runs a hundred times a day. Today that cycle is: edit a file, wait for Gradle, read a stack trace, add a print statement, rebuild. This board proposes: drag from a pin, read the compile findings, set a breakpoint on a port, step, watch.

Agentic tie. The single most machine-actionable artefact in the cluster is COMPILER RESULTS · EVERY FINDING MAPS TO AN ELEMENTID. A coded finding bound to an ElementId is a perfect agent work item — an agent can claim E-CONTRACT-401, propose the ConnectPorts patch that resolves it, and be checked by recompilation. And there is no depicted way for it to do so, because this board has no chrome, no queue, no Propose affordance and no agent lane. The crux board of the section is the one an agent cannot enter.

Blueprint tie. This is the closest board to Unreal's Blueprint editor and it wins on three axes and loses on one. It wins on the palette (reasoned exclusion versus silent filtering), on breakpoints (F9 · breakpoint on node or port — Unreal breaks on nodes only), and on replay classes (Unreal has no concept of what is safe to re-run). It loses on the debugger's scope: SANDBOX SESSION · backend interpreter · seed 42 is Play-In-Editor. 04.06's boast that Unreal has live values on wires ✓ (UE: PIE only) is undercut by this board, where the only debugger drawn is also a PIE.

Replaces / augments. The IDE debugger (IntelliJ, Xcode), rr and time-travel debuggers, the Kotlin compiler's error output, Blueprint's compile button and results panel, and — through replay classes — what teams currently do with VCR cassettes and recorded HTTP fixtures.

Improvements.

1. Give it the chrome. This board carries no revision band, no environment, no principal, no DESIRED + OBSERVED plane, no mode band. It should render with DEBUG lit in the mode band and an explicit env: local · sandbox chip, because its own palette excludes a provider on environment grounds and there is nowhere to read what environment you are in.
2. Add a third diagnostic class for identity. The panel has E-CONTRACT-* (missing provider) and E-PORT-* (key mismatch) and nothing for the defect that actually exists: E-IDENT-207 · nominal match — AuthService (kotlin #a41c9e2f) ⇄ AuthService (ts, class ∅), plus a scope-level W-IDENT-211 · 14 nominal edges in Root scope sitting next to the existing W-WIRE-204 · 72 disconnected ports in Root scope.
3. Give findings a quick fix, not only → focus. E-CONTRACT-401 · consumer authService has no provider in scope has exactly one obvious remedy and the palette already knows the three compatible providers. Offer Fix… that opens the filtered palette pre-scoped to the finding.
4. Mark the determinism claim. Deterministic: same spec + same passes ⇒ byte-identical bundle is unproven — audit §2 records no CI and no differential conformance. Render it as a DESIRED claim with evidence: none · L2 differential conformance not yet run, in the style 13.03 uses for native parity not yet proven.
5. Add a call stack pane to the debugger. ⤵ into and ⤴ over imply a stack and none is drawn; on a graph the stack is the chain of nodes that led here, which is more useful than a source stack and is a genuine differentiator.
6. Add a warning waiver control. W-WIRE-204 · 72 disconnected ports will be present for months; without an owner, a reason and an expiry, it becomes wallpaper and the panel stops being read.

Verdict. Strengthen. It is the most important board in the section and currently the least connected to it.

Blueprint parity table

Status values: Depicted (drawn on a board with concrete affordances), Partial (named or claimed but not fully drawn), Omitted (absent from all ten boards).

Scoring the twenty rows: seven are depicted at or above Blueprint parity, six are partial, three are omitted, one is deliberately refused with a stated rationale, and three are depicted but internally inconsistent or unsound. The authoring and debugging half of Blueprint is well covered. The reuse half — functions, variables, libraries — and the versioning half — diff and merge — are almost entirely absent, and those are the two halves that decide whether a graph tool survives its second year.

The identity problem

Audit D-6 says port type identity is unsound because Type is (String, KClass?) with two non-interoperating construction paths: reified ports carry a real class, string-built ports — every ServiceNode endpoint and every JS caller — carry null. Same-named ports on different paths refuse to connect; differently-classed ports on the string path connect happily. The keystone fix is one content-derived fingerprint unifying port identity, codec layout identity and FFI method identity. The word fingerprint appears twice in the whole atlas, on 13.01 and on a Composer provisioning state board, and never in section 04.

These boards do not merely fail to depict the defect. They depict its cause as a feature. 04.06's compatibility model has exactly two axes — type and key — and its green state is captioned exact type-token match. The type token is the unsound thing. The board teaches a developer, and teaches an agent, that a green glow means the contract matches, when in the string-construction path a green glow means only that two names are spelled the same. Meanwhile the amber state, type ok · key differs — autoWire skips, gives a whole visual state to the less dangerous failure, because a skipped autoWire is loud and a false match is silent.

What the surfaces must show

A fingerprint is the primitive, and it must be visible without opening anything. Every contract gets an eight-character content digest derived from its declared shape — field names, field types, ordering, version — and never from the runtime class token. Render it in the monospace face at the trailing edge of the port row: ◉ authService AuthService #a41c9e2f. The same eight characters must appear in three places: the port row here, the codec layout row on the FlexBuffers and schema surfaces, and the FFI method row on 13.03 · Extend · FFI Switchboard. If a reader can see #a41c9e2f in all three places, the keystone claim is legible without a sentence of prose. That is the cheapest possible way to make §2's keystone primitive real in the atlas.

Every port carries a three-state resolution badge. RESOLVED — reified construction, class present, digest computed from the declared shape; render as a solid filled chip. NOMINAL — string construction, class ∅; the name matched and the shape was never verified; render as a hollow chip with a dotted outline carrying the literal text class ∅. CONFLICT — two ports share a name and disagree on digest; render as a filled warning chip showing both digests. This badge belongs on the port row at L3, on the node card's port summary at L2 (4 ports · 1 nominal), and as an island-level count at L1 and L0.

The drag grammar goes from three states to five. 04.06's COMPATIBILITY WHILE DRAGGING panel currently lists green (exact match), amber (key differs), red (type mismatch), the ◌ DI-satisfiable badge, and occupied-consumer. Add:

• Blue hatched · NOMINAL MATCH — "name matches; one side is string-constructed and its shape is unverified. This will connect at runtime and may be wrong." Droppable, because forbidding it would break every ServiceNode endpoint and every JS caller, but the drop produces a finding rather than a clean commit.
• Red outline · DIGEST CONFLICT — "both sides resolved, same name, different shape: #a41c9e2f versus #7d20b155." Not droppable, and the rejection card offers Insert adapter… rather than a dead end.

The connection card gains an identity line. Today 04.06's drop preview reads contract AuthService · key ∅ · consumer is single-slot · connect.kt:15. It needs a third line: identity #a41c9e2f ⇄ #a41c9e2f · exact, or identity #a41c9e2f ⇄ class ∅ · nominal · will not be re-checked at runtime. The qualifier on the CONNECTION RULES card changes from Port:$key:$type to Port:$key:$type#$digest, and a seventh rule appears: identity is the content digest, not the class token — defect D-6 open. Citing the defect on the rules card is what turns a marketing panel into an engineering one.

The wire itself must carry identity. This is the single highest-value pixel change in the cluster. Today every wire on every board is a solid stroke of equal weight, so every edge looks equally trustworthy. Render nominal edges with a hatched or dashed stroke and conflicted edges with a doubled stroke in the warning colour. A developer scanning a scope at L2 should be able to see, without clicking anything, which of their edges are load-bearing but unverified. At L1 and L0, where 04.07 says edges bundle into (×N) counts, the bundle splits: ×6 wires · 2 nominal.

The context menu gains an explanation. 04.06's wire menu already has Blame · who wired this. Add Why does this match?, opening a two-column derivation showing both sides' declared shape field by field with the differing or unverifiable field highlighted, and a footer stating which construction path each side used. An unsound type system's failures are survivable if they are teachable and fatal if they are mysterious; this menu item is the difference.

The compiler gains a diagnostic class. 04.08 has E-CONTRACT-* for a missing provider and E-PORT-* for a key mismatch. It needs E-IDENT-*: E-IDENT-207 · nominal match across boundary — AuthService (kotlin, #a41c9e2f) ⇄ AuthService (ts, class ∅) with → focus, and a scope-level counter W-IDENT-211 · 14 nominal edges in Root scope standing beside the existing W-WIRE-204 · 72 disconnected ports in Root scope. The two numbers together are the honest health line for the graph substrate, and 72 disconnected ports currently stands alone.

A dedicated validation board is required, described under Missing panes as 04.10. Fingerprints on port rows tell you about the edge in front of you; the burn-down of D-6 needs a scope-wide table.

Editing versus runtime

Section 04 has the vocabulary to separate authoring from observing and does not consistently use it.

The vocabulary is the mode band EXPLORE · EDIT · DEBUG · COMPARE, the plane band DESIRED + OBSERVED, the per-node truth footers on 04.03, the TruthMark values SOURCE / OBSERVED / PARTIAL / UNKNOWN used everywhere else in the atlas, and the seven-stage pipeline draft → compiled → plan sealed → approved → running → verified → receipt. Where these are used the distinction is crisp. 04.03 is the model: OnboardingScreen is LIVE · 2 instances · 6.2ms, /chats/{id} is SOURCE + LIVE · 24k req · 2s, UserRepository is PARTIAL · p95 94ms · source + trace. Three nodes on one canvas with three different epistemic statuses, and the inspector splits into Desired · Screen · contract v3 against Observed · 2 runtime instances · LIVE 2s with Truth · SOURCE desired + OBSERVED runtime · per-property truth. That last phrase — per-property truth — is the correct granularity and it appears once.

Where the vocabulary is not used, the boards contradict themselves outright. 04.04 and 04.05 both declare projection: designed in chrome and performance · unmeasured in the footer, and then paint observed latencies across the canvas: /onboarding · p95 92ms · err 0% · 8.2k, ChatActor · RUNNING · 1.2k msg/m, /chats · 12k visits · p95 64ms. A board cannot be a designed projection and report production traffic. A board cannot say performance · unmeasured in its status bar and assert nine latencies in its body. This is not a nuance; it is the same board asserting and denying the same thing eighty pixels apart, and it is mechanically fixable by binding the metric footer's visibility to the projection selector.

04.06, 04.06A and 04.06B get this right by omission — they are purely structural, they carry performance · unmeasured, and they assert no metrics at all. That is why they are the most honest boards in the section.

04.08 is the crux and it is half right. It draws the correct conceptual apparatus for the transition. REPLAY CLASSES is a real answer to when you may cross from observing into re-executing: Pure · safely recompute, Deterministic local · re-run in pinned sandbox, Recorded · replay captured result, External · barrier — rewind never re-executes production. 04.02 supplies the complementary rule — sandbox breakpoint · capability-gated · never production by default — and the drift rule, drift invalidates approval. Together these are a better safety model than any debugger I know of ships.

But three things break it.

First, the debugger drawn is a sandbox, not a live attach: specHash 8f41c2 · backend interpreter · seed 42. That is Play-In-Editor. The section's differentiator — 04.06's own boast, live values on wires ✓ (UE: PIE only) — is contradicted by the only debugger the section draws. There is no board showing watches on a running production graph with an effect mark of read-only and a capability gate, which is the thing that would make the boast true.

Second, 04.08 has no chrome, so the transition it governs is invisible in it. You cannot read from that board which environment you are in, which revision you are debugging, who you are, or whether the sandbox's specHash 8f41c2 still matches what is deployed. Its own palette excludes a provider with environment — production not legal from local, which proves an environment axis exists and that the board does not display it. Every guarantee 04.02 states about drift and capability is absent from the board where those guarantees are exercised.

Third, and largest: the moment of transition has no board at all. §1's graph code push — marked subgraphs updating and rewiring at runtime, delivered through Hermes, with typed boundaries governing what a pushed bundle may touch — is the whole payoff of keeping the graph resident. Section 04 shows a live map (04.01), an approved patch queue (04.03) and a compile-and-debug loop (04.08), and never the frame where a sealed plan lands on a running graph. The seven-stage pipeline is drawn three times and the stages approved → running → verified → receipt are never depicted, only labelled. That is the section's biggest hole and it is precisely at its thesis.

Redundancy and consolidation

Six map and graph boards were assigned: 04.01, 04.02, 04.03, 04.04, 04.05, 04.07. Honestly counted, there are four distinct things, and two of the four are specifications rather than screens.

1. A whole-system landscape — 04.01. Real and unique: it is the only board showing client, edge, durable objects, three databases, queues and the JVM plane as one graph.
2. The working studio — 04.03. Real and unique: rail, canvas, lens stack, inspector, dock, patch queue. It is the application.
3. A level-of-detail contract — 04.07. A specification, not a screen, and the best one in the atlas.
4. A semantic-editing contract — 04.02. Also a specification: taxonomy, gesture grammar, patch pipeline.

04.04 and 04.05 are not distinct. 04.04 is 04.03 with its chrome deleted and its data corrupted. The two boards share the identical KINDS · CLICK TO ISOLATE legend (Screen 6, Route 6, Group 3, Service 7, Edge 5, Actor 2), the identical three scope headers (Onboarding L2 · 8 nodes, Chat L2 · 12 nodes, Services · Repositories · Actors L2 · 7 nodes), the identical seven-node roster and the identical Product / BestBuds / root footer node. What differs is that 04.03 gives each node its correct ports (AuthService: loginWithApple / session / loginWithGoogle / invoke; UserRepository: get / objectStore / update / flow; ChatActor: mailbox / events / schedule / ask) while 04.04 gives every node the same four rows, routeBinding / navBinding / authInteractor / screen. A repository with a navBinding port and an actor with a screen port are not simplifications; they are a mass-fill. And the totals were retyped rather than recomputed, so the same twenty-nine-item legend backs 75 nodes · 100 edges on one board and 60 nodes / 49 edges on the other, both under revision 8f41c2.

04.05 is 04.07's contract illustrated. Its unique content is one paragraph on orthogonality, one density axis (Focus, Standard, Command), five group cards with ×N wires bundle counts, and one focal-drill strip. 04.07 already owns L0 through L4, already states the navigation contract in more detail, and already mentions edge bundling.

Recommended consolidation

• Cut 04.04. Fold the launch requirement into 04.03 as an empty state showing the rail, inspector and dock in their zero states.
• Merge 04.05 into 04.07. Carry across the density axis, the ×N wires bundle count and the focal-drill breadcrumb as two panels.
• Split 04.02 three ways: the port taxonomy onto 04.06 where wiring happens, the interaction grammar into 04.07 where it is already partially duplicated, and the PATCH → COMPILE → PLAN → AUTHORIZE → RUN → VERIFY → RECEIPT pipeline plus agents are visitors into 04.08, which already draws the same seven-stage strip without the governance rules.
• Retitle 04.01 to 04.01 · Map · System Landscape (L0/L1) and make it obey 04.07's tier contract at its stated zoom.
• Keep 04.03 as the section's only fully-chromed board and frame every other board as either a panel of it or a contract it obeys.

That leaves 04.01, 04.03, 04.06 (with 04.06A and 04.06B as its state boards), 04.07 and 04.08 — five numbered surfaces plus the two states, and room for the compare board the mode band already promises. The section card's own claim of "6 SURFACES" is very close to the right answer; the section grew to ten without the index noticing.

Cluster findings

Missing panes

• 04.09 · Act · Graph Code Push (Hot Swap). §1's marked subgraphs updating and rewiring at runtime through Hermes with typed boundaries is the payoff of keeping the graph resident, and no board depicts the frame where a sealed plan lands on a running graph. The stages approved → running → verified → receipt are labelled three times and drawn zero times.
• 04.10 · Validate · Contract Identity & Fingerprints. §2's keystone primitive — one fingerprint unifying port type identity, codec layout identity and FFI method identity — has no surface anywhere. A scope-wide table of resolved, nominal and conflicting digests with a D-6 burn-down count is the board that turns the atlas's central technical debt from invisible into managed.
• 04.11 · Compare · Graph Revision Diff. COMPARE is lit in the mode band on three of my boards and leads nowhere. Blueprint diffing is Unreal's weakest capability and a graph with stable ElementIds is exactly the substrate that beats it; with no git tags and no API-stability tooling per §2, a semantic diff of two revisions is also the only depicted way a team would notice a breaking contract change.
• 04.12 · Create · Subgraph Library & Reusable Contracts. §1 says a feature is a subgraph of an app and an app is a node in a product. ⌘G · ExtractScope appears on three boards and there is no surface where a collapsed scope becomes a named, versioned node with its own contract instantiated at multiple call sites. Without it the graph has composition and no reuse.
• 04.13 · Trace · Flow Backpressure on the Wire. 04.02's taxonomy gives Flow<T> a pulse pattern and a rate, and §1's polyglot data plane runs on credit-based backpressure. No board draws credits, queue depth or a stalled stream. This is the one wire kind that behaves unlike anything in Blueprint and it is currently a line style.
• 04.14 · Validate · Determinism & Layout Receipt. 04.08 asserts same spec + same passes ⇒ byte-identical bundle and 04.06 asserts deterministic layout ✓ (UE ✗). Both are unbacked against §2's finding that no CI exists. A board showing two compiles of one spec, their bundle digests and a differential run converts two marketing ticks into evidence.
• 04.15 · Debug · Attach to Live Graph. 04.08's debugger is a sandbox interpreter with seed 42. The differentiator is observing a graph that is actually running; a read-only attach surface with watches on production wires, an EffectMark of read-only and a capability gate is what would make 04.06's live values on wires ✓ (UE: PIE only) true.

Seams

• Three chrome generations in one section. Full shell with mode band, query band and lens band on 04.01, 04.02 and 04.03; reduced shell with neither on 04.04, 04.05 and 04.06/A/B; no shell at all on 04.07 and 04.08. And none of the ten uses the atlas-standard SCOPES & QUERIES / SYSTEM / SAVED / COVERAGE rail that 01.03, 02.04, 13.03 and 13.04 all share — 04.03 invents a bespoke one. The most important cluster is the least conformant.
• The mode band appears only where it is not used. EXPLORE · EDIT · DEBUG · COMPARE is exactly the authoring-versus-observing switch, and it is printed on the three map boards and absent from 04.06 (which is EDIT) and 04.08 (which is DEBUG). Every board in the section should show it with its own mode lit.
• Node counts do not reconcile under one revision. Every board carries 8f41c2, and the counts are 166 nodes / 14 runtime islands (04.01, against fifty labelled cards in thirteen groups), 75 nodes · 100 edges (04.03), 60 nodes / 49 edges (04.04), forty-six across five groups (04.05) and 172 n · 153 e (04.07, marked MEASURED). Five totals for one revision, on the boards whose thesis is that the diagram cannot lie.
• Reroute is classified two incompatible ways. GraphPatch revision 2 · 1 node + 2 typed edges on 04.06B, against view patch only · spec hash unchanged on 04.07 and reroute · view patch on 04.08.
• The port taxonomy is stranded. 04.02 defines seven wire kinds with shape and colour. The wiring boards 04.06/A/B draw undifferentiated pins and 04.08's canvas has no exec pins at all.
• The element ID has two spellings on one board. 04.03's inspector header reads element:ui/onboarding/screen and its identity block reads ui:onboarding/screen, sixteen lines apart, on the board that defines semantic identity.
• Findings counts do not survive movement. FINDINGS · 3 on 04.03, ⚠ 6 warnings on 04.04, COMPILE ✗ 2 errors · 1 warning on 04.08, and 12 findings · 3 blocking on every peripheral board. The Symphony Contract promises evidence survives every movement; the count changes every time.
• Environment and principal are never carried. ovd appears in every header with no role. policy v19 · proposal only appears once, on 04.03. 04.08's palette excludes a provider on the grounds that production not legal from local, which proves an environment axis exists and that no chrome band displays it.
• The agent affordance is chrome-only on six boards. Ask · Explain · Propose · Delegate appears three times and Ask · Propose five times; only 04.03 has a place for an agent to act (Agent · 1, the patch queue, policy v19 · proposal only). 04.08, which holds the most machine-actionable artefact in the section, has no agent entry point at all.

Honesty audit

04.01 is the worst offender in the section and possibly in the atlas. It carries seventy-three unit-bearing numeric assertions — roughly one in nine of the 661 across all 104 boards — with zero provenance markers of any kind. Several are contradicted by §2 outright. GCP PubSub is drawn with four topics and throughput figures (notifications · 412k msg/h, ml-features · 88k msg/h) for a plane the audit says has no queues at all and is waitUntil fire-and-forget throughout. The honest version renders that island as DESIRED-only ghost cards with EmptyReason: NotWiredYet — every pipeline is waitUntil fire-and-forget; no queue exists, and drops the four throughput figures entirely. Similarly otel-collector · 8.4M spans/24h and codeagent-bridge · 412 cmd/min need either a SourceRef or a ? prefix. The board's own summary chip (166 nodes / 14 runtime islands against fifty cards in thirteen groups) should be computed, not typed.

04.04 and 04.05 assert and deny the same thing. Both declare projection: designed in chrome and performance · unmeasured in the footer, then paint nine and five observed metrics respectively across the canvas. The honest version binds metric footers to the projection selector: in a designed projection they do not render at all, and the node card shows port count · contract version · owner instead.

04.06's GRAPH-NATIVE ADVANTAGE table is a marketing panel in an engineering section. Eight ✓ marks with no truth marks, and two are false against §2. edit connections ✓ type-checked is the precise claim D-6 refutes. live values on wires ✓ (UE: PIE only) describes something 13.03 and 13.04 both label Unknown · Runtime observation is not wired, and the only debugger the section draws is a sandbox. The honest version replaces the ✓ column with SHIPPED / DESIGNED / NOT WIRED, which would read roughly: typed pins SHIPPED, exec wires DESIGNED, edit connections DESIGNED with a defect link, live values NOT WIRED, reroute DESIGNED, comments DESIGNED, collapse-to-subgraph DESIGNED, deterministic layout NOT PROVEN — and adds a ninth row, identity soundness, marked DEFECT · D-6. Everything else on these three boards is exemplary: connect.kt:15, Edge.kt:22, ProviderPort.edges, Graph.kt:224 and Port.kt:32 are the only real source citations in the section and possibly the atlas.

04.07 is nearly honest and typesets its aspirations like its measurements. It is the only board that says MEASURED and names its instrument (workbench Code level draws 172 n · 153 e · 72 disconnected ports) and the only one that admits a current failure (Today the workbench renders one tier at every zoom). But ≤ 5 s cold overview at 50k / 150k, registry query p95 ≤ 250 ms, scoped view p95 ≤ 33 ms and pan / zoom frame p95 ≤ 16.7 ms are targets rendered in the same weight as the one observation. Each BUDGET row needs a TARGET or MEASURED chip.

04.08 draws a compiler that does not exist and is otherwise the section's most careful board. COMPILE ✗ 2 errors · 1 warning with plausible codes implies a working compile pipeline; §2 records no CI, no differential conformance and no API-stability tooling. Deterministic: same spec + same passes ⇒ byte-identical bundle is the strongest unbacked claim in the section and should be marked in 13.03's style — desired · determinism not yet proven · L2 differential conformance not run. Against that, the board is scrupulous where it counts: the debugger is explicitly labelled a sandbox, External · barrier — rewind never re-executes production is a real safety statement, and gestures create drafts only is exactly the right constraint.

04.02 and 04.03 sit in the middle. 04.02's sealed plan #05 · 0 runtime mutations is an honest statement of an inert plan; its scattered metrics (p95 142ms · err 0.4%, p95 72ms · asia-south1, fired 12s ago · 8.2k/24h) are not. 04.03's Desired 128 · Observed 116 · Stale 7 · Unknown 5 · Findings 12 is the best evidence line in the section because it makes Unknown a first-class bucket, and scale S · unmeasured in the footer is exactly the kind of admission §1 asks for. But EVIDENCE · 94% appears in chrome on three boards and is defined on none of them, which makes the section's most repeated number its least accountable one.

The section-wide honest fix is one component. Across all ten boards the truth vocabulary — Effect, Permission, Origin, Confidence, Revision, Owner — appears zero times, and Truth appears once as a plain label. Every peripheral board carries the full block. Applying the existing 13.03 inspector pattern to 04.03's inspector, and the existing TruthMark chip to every metric footer in the section, would resolve most of what is listed above without designing anything new.

Part 7 · Section 05 — The Interface System and the Shell

Boards covered: 10 — 05.00, 05.01, 05.02, 05.03, 05.04, and the five STATE · System Studio Shell boards (Compact 390, Medium 768, Expanded 1600 Dark, Light, High Contrast).

Method note. Board text files are the primary source. Where I make a counting claim I derived it from the data-pencil-name layer names and inline hex fills in atlas.html, and I state the counting basis inline so it can be checked. My instance counts use exact component-name prefixes (TruthMark / …), which is a stricter basis than the atlas-wide figure in the brief's §3; the two point the same way, mine harder.

05.00 · Interface System — Machine Signal Design System

On the board. This is the largest board in the atlas: 14,507 characters, 923 text lines, 2,084 named layers, 3,160 units wide. Its panes in order are the manifesto header (MACHINE SIGNAL / reaktor design system / Every action becomes a typed, reviewable command / v1 · 2026-07 · dark-first / pairs with Human Signal (BestBuds)); FIVE LAWS THE VISUALS MUST EXPRESS (typed, live, one graph many runtimes, agents are visitors, code is truth); COLOR — CARBON DEPTH · STEEL TYPE · COBALT SIGNAL · SEMANTIC TRUTH in five swatch rows (surfaces and lines, text and accent, node kinds, node kinds continued plus status, wires) closing with a Semantic truth & provenance row of nine chips; TYPE — INTER FOR HUMAN CONTROL · JETBRAINS MONO FOR MACHINE TRUTH; ATOMS — CONTROLS; ATOMS — BADGES · PILLS · DATA ROWS, which is where the entire truth vocabulary lives; three TRUTH MATRIX panes (implicit dark, · LIGHT, · HIGH CONTRAST) each showing the same seven states from SOURCE to PERMISSION DENIED · scope hidden; GRAPH PRIMITIVES — LIVE SIGNAL · TYPED PORTS · SCOPE · PROVENANCE; WIRE KINDS — BEZIER · ARROWCLOSED · Z-ORDER NAV>ATTACH>DATA>CONTAIN; a canvas-chrome specimen with the lens stack (STRUCTURE · BASE, RUNTIME, CHANGES · Δ5, TEST IMPACT, SECURITY, COST + CARBON); fabric organisms (SYSTEM FABRIC, a Postgres read card reading READ ONLY · bound params · 500 rows · 5 MB · 10 s · export denied, a Worker card with DESIRED / OBSERVED / DRIFT UNASSESSED, and a topic chain carrying contract message.sent.v3 · at-least-once · idempotency REQUIRED); SHELL — QUIET CHROME · DOMINANT CANVAS · ALWAYS-VISIBLE TRUTH, a full workbench mock with left outline, inspector, drawer, command queue and a read-only CodeDiff; SHELL — SUB-TAB ROW; SYSTEM GRAMMAR · MOVEMENT × INSTRUMENT × CONTEXT with the governed-operation lifecycle Draft → Validating → Planned → Approval → Applying → Verified → Receipt; and a SYSTEM COMPOSER preview with RECEIPT PREVIEW and the good line Receipt appears only after verified execution.

Vision tie. It is the only board that states the thesis as visual law — law 05, "The canvas is a lens. Every gesture compiles to a typed GraphCommand and lands as a reviewable CodeDiff", is §1's "the diagram and the system are the same object" written as a rendering rule. Law 03, colouring nodes by deploy target, is the adapter-and-capability idea made legible. But the board embodies the thesis and simultaneously falsifies it, because the documented palette is not the palette the atlas is drawn in. Counting bare hex literals in the export: bg-0 #06080D appears 3 times in an 18 MB file, accent #5C80FF 4 times, ok #35C978 5, warn #F3B84B 3, error #FF666B 3, t-3 #8995AD 7 — essentially only inside their own swatch chips. The colours that actually paint the atlas are #9EABC1 (7,178), #F4F7FB (3,977), #263349 (2,842), #6F8FFF (2,057), #121A27 (1,776), #0C111A (1,059), #42D392 (1,007), #F5B84B (579), #070A0F (502) and #FF6B78 (238). Eighteen documented tokens, all dead. The node-kind row is the honourable exception and is genuinely in service (screen #65B58E 133 uses, edge #48B8D0 130, container #9D85E6 125, service #D2A05C 118, route #658BFF 116), but the wire-kind row is dead too (exec #E6EAF2 4, navigation #3B82F6 4, data #8B5CF6 5, attachment #6366F1 2). A design system board that documents a version of itself that no longer exists is the same failure mode the atlas exists to prevent.

Workflow tie. Opened by whoever adds a new surface or a new kind of number, roughly weekly. Today the same person opens Figma, a token file, MachineSignal.kt and a running desktop build, and reconciles four sources by eye. This board wants to be the single source, and 05.01 already reports the failure of that ambition as a finding on itself: accent.brand · 14 uses · drift: web diverged.

Agentic tie. An agent reads this board to learn how to render a claim, and gets three incompatible answers. The colour pane enumerates seven truth classes (RUNTIME LIVE, SOURCE-DERIVED, INFERRED, FIXTURE, PARTIAL / STALE, FAILED / BLOCKED, IMPORTED / OBSERVED); the component set enumerates a different seven (TruthMark / Live | Source | Fixture | Stale | Partial | Unknown | Failed); the truth matrix shows a third seven whose last cell, PERMISSION DENIED · scope hidden, is not a truth class at all but a permission state. Inferred and Observed have colours and no component; Unknown has a component and no colour. An agent asked to render an observed value has no correct choice. Worse, the marks do not use the tokens: reading the fills straight out of the export, TruthMark / Live is #42D3921F while the documented live green is #35C978; TruthMark / Source is #8DA7FF1F while SOURCE-DERIVED is #5C80FF. Six of six marks are off-token.

Blueprint tie. This is Unreal's FSlateStyleSet plus the editor style guide — not a game-facing tool at all, but the thing that makes every other tool legible. The analogy breaks in the decisive place: in Unreal the editor style is code, so it cannot document a colour it does not use. Here the guide is a drawing, so it can and does.

Replaces / augments. Figma Tokens, Style Dictionary, Zeroheight, Storybook Docs, Backlight, and the informal "design principles" Notion page.

Improvements.

1. Delete the COLOR pane's hard-coded hexes and regenerate it from MachineSignal.kt — a token row must show name, value, live usage count, and a red DEAD state at zero uses. As drawn today, sixteen of eighteen rows would show DEAD.
2. Add two columns to every swatch row: light and high contrast. Three themes ship (see the shell states) and only one is documented; the light ok is #087A4A and the high-contrast accent is #00FFFF, and neither value appears anywhere on this board.
3. Collapse the three conflicting truth enumerations into one TRUTH AXES pane with four labelled columns — Origin, Grade, Effect, Permission — and one row per value. Nothing may appear in two columns.
4. Give every mark a glyph and a word in addition to a colour, then re-render the TRUTH MATRIX · HIGH CONTRAST pane using only the glyphs. Today the high-contrast board differentiates by hue alone (#00FFFF, #00FF88, #FFFF00, #FF3355), which does nothing for colour-blind readers.
5. Move the SYSTEM GRAMMAR, SYSTEM COMPOSER and SYSTEM FABRIC panes off this board. They are second copies of 04.03, 02.01 and 13.01; when those boards change, this one silently lies. Replace them with a single SHELL FRAME component specimen plus a slot table.
6. Add a PROVENANCE ANATOMY pane showing each data component with its evidence slot filled, empty, and in conflict — three states side by side — so the empty state is a designed thing rather than an accident.

Verdict. Split into 05.00 · Machine Signal — Tokens, Marks & Anatomy (laws, colour, type, atoms, marks, matrices, graph primitives, wires) and 05.05 · Machine Signal — Shell Frame & Slots (the shell, sub-tab row, system grammar). Cut the Composer and Fabric specimens entirely; they belong to their own boards.

05.01 · Interface · Atomic Catalog

On the board. Under the standard shell it declares an eight-item sub-tab row — Canvas, Workbench, Design System, Flow, Responsive, A11y, Visual Tests, Source / Diff — and then shows four panes. The workbench pane (UI Workbench — atoms · molecules · renderer parity, reaktor-ui DesignTokens · live Compose preview · semantics inspector) shows five AppleButton states, of which AppleButton · error reads FAIL and the rest pass. A token strip lists six tokens with usage counts (color.surface.primary #0A0D14 · 24 uses, color.accent.brand #4B7BFF · 14 uses · ⚠ drift, radius.button 16dp · 18 uses, space.16 · 54 uses, type.display.lg 30/36 · 600 · 8 uses, motion.fast 180ms ease · 31 uses). ATOMIC CATALOG grades six component families as full, stub, molecules or adaptive · designed. RENDERER PARITY grades three renderers, closing with Tactile · physics skins — designed · not built. A11Y · 3 ISSUES · ONBOARDINGSCREEN lists a 38×38 tap target, a 3.1:1 contrast failure and a missing semantic label, each with a Fix with AI button.

Vision tie. This is "adapter + capability" applied to rendering: Compose · desktop/mobile — canonical, Compose · web target — shared Machine Signal tokens, Tactile · physics skins — designed · not built. Grading renderers by tier rather than by platform is exactly the capability idea, and designed · not built is the most honest string in my entire cluster — it matches the audit's finding that reaktor-tactile is an empty placeholder. The board earns credit for that.

Workflow tie. A UI engineer opens this on a Tuesday to add a variant and check nothing drifted. Today that is Storybook in one tab, an accessibility scanner in another, and a grep for the token name in a third.

Agentic tie. Fix with AI appears three times and is the most agent-forward control in the section. It is also ungoverned: no EffectMark, no blast radius, no diff preview, no approval, on a board whose own status bar reads policy required. An agent fixing a contrast failure edits a token, and a token edit is not local — color.accent.brand is claimed at 14 uses and already drifting. The correct control is Propose fix, producing a GraphPatch with the affected-use count on it.

Blueprint tie. Unreal's asset validator plus the Widget Reflector. The pass/FAIL column is Map Check. The analogy holds well, except that Unreal's validator runs on cook and blocks the build, and here there is nothing to block: the audit says no CI exists.

Replaces / augments. Storybook, Chromatic's component review, Zeroheight, Style Dictionary, axe DevTools, Accessibility Insights.

Improvements.

1. Add a Source column to the token strip so 24 uses says where it was counted (scan · reaktor-ui@8f41c2 · asOf 12m). Six numbers, zero provenance, on the board that reports drift for a living.
2. Split the sub-tab row's undelivered tabs into real states: Canvas, Flow, A11y and Source / Diff are declared here and have no board anywhere. Either build them or render them disabled with not wired.
3. Change all three Fix with AI buttons to Propose fix and add an affects column showing the count of call sites the fix touches, taken from the token usage count already on the board.
4. Add a renderer parity matrix: components down, renderers across, cells carrying pass / fail / not built. Today parity is three prose grades, so Icon · Badge · Divider — stub gives no clue which renderer is stubbed.
5. Give the AppleButton · error — FAIL state a finding row with a RunRef, so a failing state is traceable to the run that failed it rather than being a red word.

Verdict. Strengthen. This is the second-most honest board in the section and needs provenance columns, not redesign.

05.02 · Interface · Responsive & Visual Tests

On the board. Two panes under the shell. A responsive strip shows the BestBuds Circle Feed at mobile · 375 (< 600 · compact), tablet · 768 (600–1024 · medium) and desktop · 1280 (> 1024 · expanded), the desktop frame gaining a rail · circles list. A verification pane titled VISUAL TESTS · 48 SNAPSHOTS · 1 DRIFT puts baseline · v811 / OnboardingScreen.light beside current · v812 / same viewport 375×812, reports diff · 2.4% px with the diagnosis CTA moved 8px down — font fallback, offers Approve new baseline and Reject · open source diff, and closes with a11y: contrast AA pass 96% · tap targets 1 warn · focus order ok.

Vision tie. Weak. Responsiveness is a UI concern, not a graph concern, and nothing here is expressed as nodes, ports, visitors or capabilities. The one available tie is unused: a snapshot suite is exactly the "visitor" idea — a traversal that renders every screen node at every breakpoint — and the board never says so.

Workflow tie. Opened when a pull request goes red. Today that is a Chromatic or Percy web UI in a browser tab, far from the code, with an Approve button that half the team clicks without looking.

Agentic tie. Agent-hostile in a specific way: Approve new baseline is a write that changes what every future build is compared against, and it carries no EffectMark, no PermissionGate and no receipt. It is the one place in my cluster where a single click silently redefines truth for everyone, and there is nothing on the board that would stop an agent from pressing it.

Blueprint tie. Unreal's automation screenshot comparison (FAutomationScreenshotComparison / Gauntlet), which likewise stores a baseline per platform and requires a human to promote it. The analogy is close and the gap is the same one Epic solved: baselines are per-RHI and per-platform, and this board has one baseline for one viewport.

Replaces / augments. Chromatic, Percy, Applitools, Playwright and Paparazzi snapshot testing, BrowserStack, and the a11y half of Lighthouse.

Improvements.

1. Put Approve new baseline behind the governed path the rest of the atlas uses: EffectMark / Remote Reversible, PermissionGate, a sealed plan and a receipt naming the approver and the superseded baseline v811.
2. Replace the three-frame responsive strip with the five real breakpoints the shell boards ship — 390, 768, 1280, 1600 and the high-contrast fork — because the shell states use 390 and this board uses 375, and the two must not disagree.
3. Add a coverage row to the verification pane: 48 snapshots covering how many of how many screens, at how many breakpoints, in how many themes. A snapshot count without a denominator is not evidence.
4. Add a cause column linking font fallback to the commit or environment that produced it, so the diagnosis is a claim with an origin rather than a caption.
5. Add a flaky state beside pass and fail, with a run count, so 1 DRIFT distinguishes a real regression from a non-deterministic render.

Verdict. Strengthen, and re-scope it as 05.02 · Validate + Interface · Visual & Responsive Conformance. It is the Interface instrument's Validate cell and should say so.

05.03 · Interface · Command Palette

On the board. The smallest board in the section — 1,240 characters, 86 lines. One palette over the standard shell. The query is checkout; six results are listed: route:/checkout · route · 4.1k visits · ROUTE, screen:CheckoutScreen · ui/checkout/CheckoutScreen.kt · SCREEN, svc:PaymentService · p95 210ms · err 0.1% · SVC, cf.workers/payments · edge · POST /charge · EDGE, > Add Apple Pay to checkout · ask agent · creates session · CMD, and docs:/docs · Reaktor documentation · preserved site · DOCS. A key legend reads ↑↓ navigate · ↵ open · ⌘↵ open in IDE · > command mode. Below sits a three-node preview strip.

Vision tie. This is the strongest vision claim in the section and the weakest execution. "Agents as first-class operators" requires one governed doorway that humans and agents both walk through, and this is the atlas's only drawing of that doorway. The shell string Search · Navigate · Run · Change · Ask appears on 85 of the 104 board texts, so the palette is the atlas's most-repeated promise and its least-developed board.

Workflow tie. Opened fifty times a day by everybody. Today those five verbs are five tools: ⌘P in the IDE, a Grafana explore tab, wrangler tail, a kubectl shell, and a Slack thread that ends in "can someone deploy this".

Agentic tie. The board shows one agent row and governs it with the prose creates session. There is no effect mark, no permission gate, no blast radius, no dry run, no plan. The preview strip is worse than absent: CheckoutScreen and PaymentService are both tagged ROUTE, all three nodes carry the identical port list routeBinding / navBinding / authInteractor / screen, and all three carry the identical metrics p95 92ms · err 0% · 8.2k — so PaymentService reports p95 210ms in the result row and p95 92ms four lines below it. On the board whose entire job is finding the truth about an entity, the same entity has two different latencies and the wrong kind. Read charitably it is a copy-paste artifact; read as the atlas asks to be read, it is a live demonstration of defect D-6, where a service and a screen connect happily because the port identity is only a string.

Blueprint tie. Unreal's right-click Blueprint context search, plus the Content Browser search, plus the ~ console, fused into one line. Unreal deliberately keeps them separate, and the console executes immediately with no plan and no receipt. The fusion is the genuinely new claim here; the no-receipt part is what Reaktor must not copy.

Replaces / augments. VS Code's command palette, Raycast, Alfred, Sourcegraph, Grafana Explore, the Kubernetes dashboard, Postman's collection runner, and the Slack-bot deploy.

Improvements. Detailed in section D below; the five headline changes are a typed query grammar shared with the canvas chrome, an origin and asOf on every result row, effect and permission and reversibility on every actionable row, a NotWired result kind that carries the connect action, and a hard rule that no palette keystroke may apply — the maximum is to seal a plan.

Verdict. Rebuild. This board is three panes short of carrying the most important idea in the atlas.

05.04 · Interface · Drawer States

On the board. Titled "The drawer follows you everywhere — four more of its nine tabs", it shows four of the nine drawer tabs, each with the same badge row (Command Queue 7 · Code Agent 1 · Logs 412 · Traces 24 · Network 86 · Tests 14 · Build 3 · CodeDiff 5 · Diagnostics 3). LOGS — LIVE STREAM · EVERY RUNTIME, ONE TIMELINE interleaves ten entries across graph-host, compose, port, cf-workers, d1, graph-check, codeagent, hot-reload, analytics and wrangler, ending on Worker deploy failed: cannot resolve AuthAction (#1042 cmd #07). NETWORK lists eight calls across edge, D1 and Pub/Sub with a session column. BUILD is a terminal running kotlinc --incremental --target=mobile,jvm,worker with per-target timings and [!] cf.workers 2 files · requires deploy. DIAGNOSTICS — GRAPH HEALTH · AUTO EVERY 5S · ASK CLAUDE TO FIX ALL shows 11 ok · 3 warn · 1 error over six rows: integrity, autowire, compile, schema, perf, rbac, cost, with Fix on five and ✦ Ask Claude to fix all at the top.

Vision tie. The strongest genuine embodiment in the section. One timeline across graph-host, compose, port, cf-workers, d1 and pubsub is "polyglot on one data plane" made visible, and it is a real product idea — nobody ships a console where a Compose recomposition, a port invocation, a Worker response and a D1 insert are the same stream. The autowire row (ConsumerPort<MessageRepository> has no provider in offline scope) is the eigenvector-primitive idea producing a diagnostic that could not exist in a non-graph system. And the integrity row — Graph manifest hash matches registry · 38 nodes · 39 edges — is the only place in my cluster that touches §2's keystone fingerprint. It is buried as row one of six.

Workflow tie. Open all day while the app runs. Today it is Logcat, the Xcode console, wrangler tail, Chrome DevTools' network tab, the Gradle build panel and a Sentry tab, six windows, none sharing a clock.

Agentic tie. ✦ Ask Claude to fix all is the single most dangerous control in my cluster. One click covers a Worker deploy failure, an RBAC grant (Resource payments is not granted to any role), a schema propagation, an autowire fix and a performance budget breach — spanning read-only, local-write and production effects — with no plan, no blast radius, no approval and no receipt. Given §2's twelve security findings, a button that can grant a role is a governance hole, not a convenience. This is also the board an agent would most want to read, because the diagnostics list is a machine-readable finding set.

Blueprint tie. Unreal's Output Log plus Message Log plus Map Check plus the Blueprint debugger, docked as one panel. The analogy is exact and flattering, and it extends further than Unreal does: Unreal's Map Check has no equivalent of the rbac or cost rows.

Replaces / augments. Chrome DevTools console and network, Logcat, the Xcode console, Datadog Live Tail, Sentry Issues, wrangler tail, the Gradle build panel, Infracost, and a lightweight slice of Snyk.

Improvements.

1. Promote integrity out of the diagnostics list into a permanent FINGERPRINT strip in the drawer header, showing the graph manifest hash, the codec layout hash and the FFI ABI digest side by side with match or mismatch. That is §2's keystone and it currently reads like a lint rule.
2. Replace ✦ Ask Claude to fix all with Propose fixes (5), opening a plan whose rows are individually checkable, each carrying its own EffectMark. The rbac row must be unselectable without an approval.
3. Add a Traces and a Tests pane. The board's own header says nine tabs; six are drawn across this board and 05.00, and Traces and Tests — the two the verification programme depends on — are the missing ones.
4. Add a window and an origin to every badge count. Logs 412 is the same number on this board and on 05.00 with no time window, which makes the drawer's most-read element unfalsifiable.
5. Add diagnostic rows for the defects §2 actually found: a port-identity check for string-built ports carrying a null class, a lifecycle check for effects fired on rejected transitions, and a queue check for waitUntil fire-and-forget pipelines. The diagnostics list currently checks things that pass and omits the things that fail.
6. Give the cost row a source. Estimated infra: $265 / mo · within $400 budget is a confident number with no provider, no period and no method.

Verdict. Keep, and elevate. This is the best board in the section and should absorb the Command Queue and CodeDiff specimens currently stranded on 05.00.

STATE · System Studio Shell · Compact 390

On the board. 516 characters — the smallest board in the atlas that is not a section divider. Top bar: bestbuds, LOCAL, Ask. Context line: bestbuds / AuthService with Resume. The four movements survive with their desktop shortcuts intact (Map ⌘1, Trace ⌘2, Validate ⌘3, Act ⌘4). The body is MAP + RUNTIME · OUTLINE / Everything important, now. / Graph work becomes an accessible outline at this width., stamped LIVE · runtime · 2s and runtime · fresh 2s. SYSTEM OUTLINE lists BestBuds system · 128 entities, auth island · 14 entities, AuthService · selected, auth.login/v3 · 2 consumers, Postgres · profiles · stale 9m. Footer: Inspect AuthService / Enter, index r1842 · fresh, synced · 12ms.

Vision tie. The outline is a genuine expression of "one graph, many projections" — a tree is a legitimate projection of a port graph, and the line Graph work becomes an accessible outline at this width is a good design law. It is undercut by keeping ⌘1–⌘4 chips on a touch device, which is the tell that this is a shrunken desktop drawing rather than a designed compact product.

Workflow tie. The only honest 390 moment is 2 a.m.: a gate failed, you are holding a phone, and you need to know what broke and whether to roll back. This board serves a different moment — casual browsing of a system outline — which nobody does on a phone.

Agentic tie. The Ask · Propose control of the wide shell becomes plain Ask here. If Propose is the governed verb that produces a patch, then the compact shell advertises an ungoverned Ask; if it is only a label, then the label lies at two of five breakpoints. Either way the agent contract changes with screen width, which no contract should do.

Blueprint tie. There is no analogy. Nobody ships the Unreal Editor on a phone. This is either the section's boldest original claim or its most decorative board, and the atlas has not decided which.

Replaces / augments. In its current form, nothing. In the form proposed below, it displaces PagerDuty's mobile app, the GitHub mobile review flow, and the Slack "approve" button.

Improvements.

1. Replace SYSTEM OUTLINE as the default body with PENDING APPROVALS and ACTIVE RUNS; demote the outline to a second tab. Approve and roll back are the two things a phone is genuinely for.
2. Put the principal chip and the revision short-sha into the top bar. A receipt binds actor, approver and revision, so a surface intended for approvals must never drop the two fields the receipt is made of.
3. Add an evidence handle to every outline row — Postgres · profiles · stale 9m needs SourceRef and an asOf, or it is a rumour.
4. Replace the ⌘1–⌘4 chips with a segmented control and add a swipe gesture between movements.
5. Add a read-only state banner when the principal's grant does not permit action at this surface, rather than showing an Ask button that cannot act.

Verdict. Rebuild as STATE · Studio Compact 390 · Approve & Recover. As drawn it is a courtesy; the job it should do is real and different.

STATE · System Studio Shell · Medium 768

On the board. 701 characters. Top bar keeps bestbuds / main, LOCAL, the full palette placeholder Search · Navigate · Run · Change · Ask ⌘K, and Ask. Context line: bestbuds, AuthService, mission: harden-auth, Resume. Explorer · sheet holds Filter, query, jump…, the five saved scopes (Mission · auth hardening 3, System · production 128, Drifted resources 7, Unknown evidence 12, All findings 4) and a TRUTH MIX reading 16 Live · 3 Stale · 2 Unknown. The body is OUTLINE with scope:auth truth:mixed, r1842, and the caption Semantic outline and evidence table. Inspector opens as a focus-trapped sheet. Footer: Evidence & execution · 3 findings · 14 tests · inspector sheet ready ⌘J, index r1842 · fresh, selection synced · 4 surfaces, input 14ms · measured.

Vision tie. Inspector opens as a focus-trapped sheet is a real adaptive decision rather than a shrink, and the saved-scope list surviving intact is right — scopes are how a graph stays navigable when the canvas is gone. But the TRUTH MIX here reads 16 Live · 3 Stale · 2 Unknown where the 1600 shells read 128 Source · 16 Live · 3 Stale · 2 Unknown. The Source count is silently dropped, so the same system reports 149 entities at one width and 21 at another. A breakpoint has changed a fact.

Workflow tie. A tablet or a half-screen window beside an editor, used for review: reading a diff's blast radius, checking findings before approving. That is exactly the task this board strips the tools for.

Agentic tie. No principal is shown, so nothing on this board says who is asking. The Evidence & execution drawer drops 18 evidence · 1 approval and keeps 3 findings · 14 tests — the two counts an agent needs to reason about governance are the ones removed.

Blueprint tie. The closest thing is Unreal's undocked, single-panel layouts. The analogy is thin, and the honest reading is that 768 is a review surface, not an editing surface.

Replaces / augments. GitHub's PR review on a tablet, Linear's tablet view, the Datadog mobile dashboard.

Improvements.

1. Restore the revision short-sha and the principal chip to the top bar. Chrome is seven short strings and costs one 28-pixel row; the canvas is what should be sacrificed at 768, not the spine.
2. Restore the full TRUTH MIX including 128 Source, or label the reduced mix explicitly as a filtered count.
3. Draw the focus-trapped inspector sheet as its own state. It is described in a caption and never shown, which makes the board's central adaptive decision unreviewable.
4. Add the evidence handle (source://AuthGraph.kt:42) to the outline rows, since the wide shell's dedicated evidence pane has no room here.
5. Change Ask back to Ask · Propose, or state on the board that proposing is unavailable below 1024 and why.

Verdict. Strengthen. The layout thinking is sound; the invariant loss is not.

STATE · System Studio Shell · Expanded 1600 · Dark

On the board. The canonical shell. Command bar: Reaktor, bestbuds / main, 8f41c2, LOCAL, Search · Navigate · Run · Change · Ask ⌘K, Ask · Propose, ovd. Movements Map ⌘1 through Act ⌘4; the eight instruments Interface · Source · State · Identity · Intelligence · Runtime · Delivery · Product. Context spine: bestbuds / system.fabric / AuthService, main@8f41c2, LIVE · runtime · 2s, fresh · 2s / ttl 30s, mission: harden-auth, run_1842, Resume mission. Left rail: System explorer, Filter, query, jump…, five saved scopes, TRUTH MIX 128 Source · 16 Live · 3 Stale · 2 Unknown, and EXPLORE kind:service env:prod truth:source|live finding:* · snapshot r1842. Centre: System graph projection — Graph, timeline, table and source all share the same semantic IDs and selection. Right: SELECTION · SERVICE AuthService · service://bestbuds/auth · stable id with five tabs (Summary, Contracts, Runtime, Evidence, History), six fields including Desired auth.login/v3 versus Observed v2 · stale 9m and Findings 2 conflicts, then EVIDENCE source://AuthGraph.kt:42 · main@8f41c2 · authority source · asOf now · Open in source. Footer: Evidence & execution · 3 findings · 14 tests · 18 evidence · 1 approval ⌘J, main · clean, index r1842 · fresh, selection synced · 4 surfaces, policy loaded · v19, input 12ms · frame 16.4ms · measured.

Vision tie. This carries the whole Symphony Contract in one frame, and the desired-versus-observed pair with 2 conflicts is the same honest structure that makes 13.03 the model board. service://bestbuds/auth · stable id is the atlas's clearest statement that identity is a URI, not a label — which is the primitive that would fix D-6 if it reached the code.

Workflow tie. This is the product. Every engineer, all day.

Agentic tie. The best agentic surface in my cluster: an agent reads Desired auth.login/v3 against Observed v2 · stale 9m, sees 2 conflicts, follows source://AuthGraph.kt:42, and proposes against a named revision and snapshot. What it cannot do is state its own confidence — every field here is presented with equal authority, and input 12ms · frame 16.4ms · measured sits in the same footer as policy loaded · v19 with no way to tell which is measured and which is asserted.

Blueprint tie. The Unreal Editor's main window, with the World Outliner as the left rail, the viewport as the centre and the Details panel as the inspector. The addition Unreal does not have is the context spine: Unreal has no revision, environment, principal or evidence in its chrome, because Unreal edits a file and Reaktor edits a live distributed system. That is the strongest original claim in the section.

Replaces / augments. Backstage, Datadog Service Catalog, Grafana, the Cloudflare and GCP consoles, Retool, and the IDE's project view.

Improvements.

1. Make the shell one instanced component. In the export the shell exists as per-board copies: 86 layers named <board> / Command Bar, 82 Workspace Bar, 86 Context Spine, 84 Instruments, 83 Evidence Handle, 84 Status. Nothing here is shared, which is why the invariants drift.
2. Fix the stale status pill. 82 boards carry a layer named Status / policy loaded · v19, but only 4 board texts still show that string; 75 show policy required instead. The layer name is the fossil of the copy and the label was retyped over it, which is exactly the drift an instanced component makes impossible.
3. Add an origin mark to each footer status pill, so frame 16.4ms · measured and policy loaded · v19 are visibly different kinds of claim.
4. Add a principal tooltip to the ovd chip listing the grants in force, since Ask · Propose is enabled or disabled by exactly those grants.
5. Give TRUTH MIX clickable segments that set the EXPLORE query. It is currently a read-out of the one number that should be a filter.

Verdict. Keep. This is the reference frame for the whole atlas and should be promoted from a STATE board to 05.05 · Interface · Shell Frame.

STATE · System Studio Shell · Expanded 1600 · Light

On the board. Every visible string is byte-identical to the Dark board — I diffed them and the bodies match exactly, 87 lines each. What differs is only the paint: the light fork is drawn with #526078 body text on #FFFFFF and #F7F8FC grounds, accent #315BFF, and #087A4A where dark uses #42D392. Geometry is effectively identical (182,428 bytes against 182,424; 165 colour references each).

Vision tie. None of its own. It is a theme fork of the previous board, and a competent one — the recolour is complete and consistent rather than an inverted screenshot.

Workflow tie. Daylight, projectors, and the half of any team that cannot read dark UI. Real need.

Agentic tie. Nothing an agent reads here differs from the dark board. The value is purely in the token mapping, and that mapping is not written down anywhere — this board is the only record that the light ok is #087A4A, and 05.00's palette pane never mentions it.

Blueprint tie. Unreal ships a light editor theme almost nobody uses; the analogy is not instructive.

Replaces / augments. Nothing new.

Improvements.

1. Delete this board as a separate artefact and make theme a property of the single shell component, with a THEME toggle rendered on the board.
2. Extract the light values into the COLOR pane on 05.00 as a light column. Three themes ship and one is documented.
3. If the board is kept, mark it as generated from the dark board and stamp the source board id, so a shell change cannot land in one fork and not the others.

Verdict. Merge into STATE · System Studio Shell · Expanded 1600 as a theme variant.

STATE · System Studio Shell · Expanded 1600 · High Contrast

On the board. Again byte-identical in text to the Dark and Light boards, and again a genuine repaint: #FFFFFF dominates (114 references), the accent becomes pure cyan #00FFFF (23), ok becomes #00FF88, warn #FFFF00, error #FF3355, on #000000 and #0A0A0A grounds. 168 colour references against the dark board's 165.

Vision tie. This should be the most important of the three, because it is the accessibility conformance proof for the truth vocabulary — the test of whether truth survives when colour is reduced. It does not currently function as that proof: differentiation is by hue alone, so it helps low-vision users and does nothing at all for colour-blind ones, and the underlying mark collisions survive the repaint unchanged.

Workflow tie. Accessibility review, procurement questionnaires, and any user with low vision. Also the state a projector forces.

Agentic tie. Indirect but real. If the marks are only distinguishable by fill, then any rendering path that loses colour — a terminal, a diff, a screen reader, an agent's own textual view of the UI — loses the truth class entirely. High contrast is the canary for whether the vocabulary has a non-colour channel. It does not.

Blueprint tie. No Unreal analogue. This is a product-grade concern Unreal handles poorly and Reaktor could handle well.

Replaces / augments. The accessibility half of a design system audit; Stark; Accessibility Insights.

Improvements.

1. Re-render the truth marks with glyphs — a filled dot for Live, a hollow dot for Observed, a square bracket for Source, a dashed outline for Declared, a slash for NotWired — and verify the board is readable in greyscale.
2. Add a TRUTH AXES · HIGH CONTRAST conformance strip showing every mark against every other, so the collisions catalogued below become visible failures.
3. State the contrast ratio achieved for each pair on the board itself; 05.02 already asserts contrast AA pass 96% for the product, and the studio chrome should hold itself to the same claim with the same evidence.
4. Make the board the target of an automated check rather than a drawing: every token must have a high-contrast value, and every pair on independent axes must differ in a non-colour channel.

Verdict. Merge into the single shell board as a theme variant, then split out a new 05.06 · Interface · Truth Rendering Conformance that does the job this board is standing in for.

A. The truth vocabulary, judged and completed

What is actually there

By exact component-name prefix, the atlas contains 19 instances of the truth vocabulary, and all 19 are on 05.00 itself: seven TruthMark, four EffectMark, two PermissionGate, and one each of FreshnessStamp / Fresh, SourceRef / Runtime, RunRef / Correlated, EmptyReason / Unknown, PlanSummary / Sealed and ApprovalReceipt / Independent. Outside 05.00 the count is zero. The same is true of the five data-bearing components: Tile / Metric, Chip / Metric, Row / KV, Sparkline and Badge / Count exist exactly once each, on the design system board, while 96 layer names elsewhere contain "Metric", 61 contain "Chip", 27 "Badge", 29 "Tile" and 22 "KV". The single most repeated data element in the atlas is a text group called Foot Metrics, hand-drawn 51 times. The vocabulary is not under-used; it is undeployed. It has a swatch and no reach.

Three defects in the vocabulary itself

It conflates three questions into one enum. TruthMark mixes origin (Live, Source, Fixture), quality (Stale, Partial) and absence (Unknown, Failed). These are independent: a Live reading can be stale, a Source fact can be partial, and a Fixture can be complete. That conflation is why TruthMark / Stale and TruthMark / Partial ended up painted with the identical fill — they are not two classes, they are two values of a modifier that was forced into a class enum.

The axes collide on colour. Reading the fills straight from the export, four colours carry twelve meanings:

The Symphony Contract's second clause is "Truth · effect · permission · lifecycle stay independent". Rendered, they are not independent at all — and the worst pair is Read Only and Local Write, where a component that writes and a component that cannot write are the same pill. None of these fills matches the documented tokens either: the board's own palette says live is #35C978, source-derived is #5C80FF, partial/stale is #F3B84B, failed is #FF666B and fixture is #748198; six of six marks use something else, and #9EABC1 is not in the palette at all.

It has no vocabulary for verified truth. Given §2's verification programme, the enum is missing every category above "someone observed it": no mark for proved, model-checked, property-tested, differentially conformed, measured on device, or deterministically simulated. Live is currently the strongest available mark, which means a Lean 4 proof of Kahn determinism and a Cloudflare metrics scrape would render identically, and the proof would render as the weaker of the two if the metric were fresher. It is also missing the two marks the atlas most needs today: Declared, the honest label for the 661 unmarked numbers, and Conflict, which 13.03 treats as a finding rather than as a state of the datum.

The proposed final vocabulary

Four independent fields on every datum, then three orthogonal axes on every action. Nothing appears twice.

Field 1 — Origin. Exactly one, required, never defaulted silently.

Declared is the load-bearing addition. Without it, enforcement is a wall that stops work; with it, an unsupported number is authorable in one keystroke and permanently marked. It is also the honest label for most of what the atlas asserts today.

Field 2 — Grade. Always present, two measures rather than an enum: staleness (age against ttl, rendering fresh, aging, stale, expired) and coverage (observed over expected, rendering complete or partial with the shortfall named, replacing TruthMark / Partial with coverage 37/40). Grade is a decoration on the origin mark, never its own pill.

Field 3 — Conflict. A boolean overlay, not a class. When desired and observed disagree the value splits and shows both with their own origins. 13.03's Conflict · Desired and observed claims disagree is the right idea living at the wrong altitude; it must be a property of the number, not a row in a findings list.

Field 4 — Absence. Used instead of a value, never alongside one.

§1 says "NotWiredYet that states what is missing is a better answer than an invented number", and NotWired is the mark that keeps that promise: it names the remedy, which Unknown never could. 05.00 already draws the affordance — Unknown — adapter not connected … Connect Cloudflare observer · last attempt · never — so the pattern exists and only the component is missing.

Action axes, unchanged in shape and extended in range. EffectMark gains Broadcast — leaves the system and cannot be recalled, which is the correct mark for a push to 42,000 devices and is exactly the case §2 says has no idempotency — and splits ProductionDestructive into Destructive · recoverable and Destructive · irreversible. PermissionGate gains Independent approval required (the sealed-plan pane already types this in prose), Break-glass · always recorded, and Not permitted for agents, which is the only way §1's "governed, permissioned interfaces" becomes real rather than rhetorical. Every mark additionally carries a principal field valued human, agent or system, so the question "did an agent assert this?" has an answer at the level of a single number.

One rendering law. Origin is a glyph plus a word; grade is a decoration; effect, permission and absence each have their own reserved channel. No two axes may share a fill, and every mark must remain distinguishable in greyscale. That law alone would have prevented all five collisions above.

B. Enforcement — making provenance impossible to omit

Enforcement has to work in three places, because the drift happens in three places: the pen file, the Kotlin implementation, and the seam between them.

In the components

Restructure the five data-bearing components so a number cannot exist outside an evidence-carrying container.

• Tile / Metric gets required slots label, value, origin, asOf, plus sourceRef required unless origin is Declared, and runRef required when origin is Tested, Measured, Conformant or Simulated. Its variant set is generated as origin × grade, so there is no variant without an origin. The default variant is Declared, rendered muted with a dotted outline and the word DECLARED. This is the key inversion: the path of least effort must produce the least authority. A designer who does nothing gets a visibly unsupported number instead of an authoritative-looking one.
• Chip / Metric is the same contract compressed to a glyph plus value. It has no glyph-less variant.
• Row / KV gets key, value, origin, and a conflict boolean that splits the value cell into desired and observed when true.
• Sparkline gets series, window, origin, sampleCount and gapPolicy, and must draw gaps rather than interpolate. A sparkline that bridges missing buckets invents data with geometry, which no mark can catch afterwards. There is exactly one sparkline in the atlas today and it has none of these.
• Badge / Count gets count, scope, window, origin. A bare 412 with no window is the most-repeated unfalsifiable element in the atlas.

Two structural rules make those slots stick. First, evidence is inherited from the container: every pane declares an EvidenceScope of origin, asOf, revision and snapshot, and leaves may only narrow it; a leaf claiming a stronger origin than its scope is an error. That single rule retires the 51 hand-drawn Foot Metrics. Second, numbers become a primitive: a Value type of magnitude, unit, precision, origin and asOf, so that any text layer matching a digit and not inside a Value is mechanically findable.

In the file

One Shell / Frame component, instanced everywhere, with breakpoint and theme as properties. Today the shell is 86 hand-copies — 86 Command Bar layers, 82 Workspace Bar, 86 Context Spine, 84 Instruments, 83 Evidence Handle, 84 Status — which is precisely why invariants vanish at 768 and why 82 boards carry a status pill named Status / policy loaded · v19 while displaying policy required.

The parity check

Extract two artefacts on every commit: pen-truth.json from the .pen file, and machine-signal.json from MachineSignal.kt plus a compile-time component registry. Then assert:

1. Token identity. Every hex literal in the pen file resolves to a named token, and every named token has at least one use. Today this fails on both sides: sixteen documented tokens would report DEAD, and thousands of instances of #9EABC1, #6F8FFF and #42D392 would report ORPHAN.
2. Axis disjointness. The fill and outline sets of the truth, effect and permission axes must not intersect. Today this reports five collisions covering twelve meanings.
3. Theme completeness. Every token has a value in dark, light and high contrast, and every mark is distinguishable in greyscale. Today light and high-contrast values exist only as paint on three shell boards and are documented nowhere.
4. Instancing. No board may contain a hand-drawn node whose name matches <board> / <catalog component>. Today 86 command bars and 84 status bars fail.
5. Name and content coherence. A layer named after its own content must display that content. Today 82 layers fail on the policy version alone.
6. Provenance coverage. Every Value has a non-null origin; every origin other than Declared resolves its SourceRef or RunRef. Report per board as n values · m declared · k unsourced, and gate on unsourced = 0. This is the check that turns §3's "49 boards assert 5+ numbers with no provenance marker" into a build failure.
7. Kotlin binding, forward. Every catalog component has a @MachineSignalComponent("Tile / Metric") composable whose parameters are a superset of the pen slots, with origin typed as the sealed Origin class. A Kotlin caller then physically cannot render a metric without choosing an origin.
8. Kotlin binding, reverse — the important one. Any composable annotated @DataBearing that emits a numeral without an Evidence parameter is a build error. §2 notes the green build already proves roughly fifteen source-text conventions; this is convention sixteen, and it is the cheapest high-value check available given that no CI exists yet.
9. One fingerprint. Compute a digest over component name, slot names, slot types and token ids, stamp it into both the pen file and the generated Kotlin, and fail when they differ. This is deliberately the same primitive §2 calls the keystone for port type identity, codec layout identity and FFI method identity — the design system should be its first customer, because it is the cheapest place to prove the mechanism works.

Two designer-facing affordances keep this from being pure policing: a hover on any value that answers "where did this come from?" by showing origin, asOf, SourceRef and RunRef; and a palette command > mark board as declared that bulk-tags a work-in-progress board, so honesty costs one keystroke and dishonesty costs a failed check.

C. The shell across breakpoints

00 · START HERE promises action "without losing workspace, revision, environment, selection, time, principal, or evidence". Here is what each shell state actually carries.

The eight instruments are present only at 1600. The four movements survive everywhere, including their ⌘1–⌘4 chips on a 390 touch screen. And one number changes meaning with width: TRUTH MIX reads 128 Source · 16 Live · 3 Stale · 2 Unknown at 1600 and 16 Live · 3 Stale · 2 Unknown at 768, so the same system reports 149 entities on a desktop and 21 on a tablet.

Two conclusions follow.

The degradation order is backwards. The seven invariants are seven short strings and cost one row of chrome; the graph canvas costs everything else. The compact shells sacrifice the spine and keep a projection. The rule the boards should state is chrome degrades last: at 768 drop the canvas and keep revision, principal and evidence, because the tasks that are actually done at 768 are review tasks, and review is exactly what those three fields are for.

A 390 system studio is a courtesy as drawn and a real product if rebuilt. Nobody browses a system outline on a phone. Two things genuinely happen on a phone: approving a plan you already understand, and reading a failed gate at 2 a.m. and deciding whether to roll back. Both need principal, revision and evidence — the three the current compact state drops — and neither needs the outline it keeps. Rebuilt around PENDING APPROVALS and ACTIVE RUNS, with the outline demoted to a second tab, 390 becomes the surface that displaces the PagerDuty app and the Slack approve button, and it becomes the strongest argument for the receipt model, because a receipt is the only artefact small enough to be trustworthy on a phone.

One correction to the framing worth stating plainly: the three 1600 boards are not duplicates. Their text is byte-identical — I diffed all three bodies and they match exactly — but the paint is completely reworked and the geometry is the same to within four bytes (182,424 / 182,428 / 182,426). They are honest theme forks maintained as three separate copies, which is a maintenance problem rather than a dishonesty problem. Fold them into one board with a theme property, and give the high-contrast fork a new and better job as the conformance sheet for the truth vocabulary.

D. The command palette as the agentic seam

05.03 is the smallest board in the section and carries the largest claim. The string Search · Navigate · Run · Change · Ask appears in 85 of the 104 board texts, so every board in the atlas advertises this palette, and the palette itself is 86 lines with one query, six results and a broken preview strip.

It is the most important agentic surface because it is the only place where the same input accepts all five verbs the Symphony Contract requires humans and agents to share. If an agent gets its own RPC and humans get the palette, then "human and agent changes share one patch → plan → receipt path" becomes an aspiration with two implementations, and the audit trail splits permanently. Everything else in the atlas can be a projection; this has to be one door.

What it must do that it does not:

1. Parse the query and show the parse. The canvas chrome already defines a grammar — Query · kind: owner: truth: path: and kind:service env:prod truth:source|live finding:* — and the palette accepts a bare word. One grammar, two surfaces. The parsed query must render as removable chips so the human sees what the machine understood and the agent receives the same parse tree.
2. Rank by evidence and show why. Every result carries origin and asOf and a one-line matched on explanation. Ranking a Fixture above an Observed result is a lie told by ordering, and today nothing on a result row states which it is.
3. Show the effect before the keystroke. Every actionable row needs effect, permission, blast radius and reversibility on the row itself. Rows exceeding the principal's grant render disabled with the missing scope named, never hidden — hiding is how you get 05.04's own finding, Resource payments is not granted to any role — guests will hit 403.
4. Be the agent's only door, and record every pass through it. One API — resolve(query) → candidates, propose(command) → plan, apply(planId, approval) → receipt — used identically by the keyboard and by an agent. Add an origin column to a persistent palette history stamped human or agent. Since §2 says the distributed plane has no queues and no idempotency anywhere, the palette's command log is the most plausible home for a deduplication key, which makes this the rare design change that fixes a real defect.
5. Refuse rather than invent. With roughly 30 of 74 panes wired, most real queries resolve to nothing. NotWired must be a first-class result kind carrying the remedy — no adapter for the Cloudflare observer · last attempt never · Connect — which is a pattern 05.00 already draws in the fabric pane and the palette does not borrow.
6. Never apply. ↵ opens, ⌘↵ opens in the IDE, and the strongest thing any palette keystroke may do is seal a plan. Applying happens in the drawer, where the receipt appears. Write that as a law on the board, because a command line that can deploy is how every incident review starts.
7. Render agent work as an overlay. Law 04 on 05.00 says agent traversals and proposals are "visible overlays, not chat logs". The palette's one agent row, > Add Apple Pay to checkout · ask agent · creates session, produces a session that appears nowhere. Draw the session as a traversal overlay on the graph with its proposal diff attached, or law 04 is unimplemented in the one place it was supposed to start.
8. Fix the preview strip, and fix it as a lesson. CheckoutScreen and PaymentService are both tagged ROUTE, share a screen's port list, and report p95 92ms while the result row above reports p95 210ms for the same service. Correct kinds and correct ports, and add a kind mismatch state to the strip, because a service that renders as a route is the visual signature of defect D-6 and the palette is where a developer would first notice it.

Cluster findings

Missing panes

• 05.05 · Interface · Shell Frame & Slots. The canonical shell exists only as three STATE copies and a pane buried inside 05.00; the invariants have no board that owns them, which is why they leak at 768 and 390.
• 05.06 · Interface · Truth Rendering Conformance. Every data component against every origin, grade, effect and permission, in three themes and in greyscale. This is the board that would have caught four fills carrying twelve meanings, and it is the board that makes §1's "every datum carries a truth class" checkable rather than aspirational.
• 05.07 · Interface · Empty, Denied & NotWired States. EmptyReason has one instance atlas-wide, and with roughly 30 of 74 panes wired the empty state is the product's most common state. §1 says a NotWiredYet that names what is missing beats an invented number; no board draws one.
• 05.08 · Act + Interface · UI Change as a Governed Plan. The Interface instrument has no Act cell. The Command Queue, the read-only CodeDiff and the #01 SetProperty AppleButton.backgroundColor #FFFFFF → #1E232B specimens are stranded inside the design system board, which is exactly the material for the board that would prove law 05.
• 05.09 · Interface · Motion & Live Signal. Law 02 says "Data pulses along wires", the palette lists REACTIVE SIGNAL #60DDEB (used twice in the whole file), the shell claims frame 16.4ms · measured, and the only motion token is motion.fast 180ms ease. Nothing specifies the pulse, the frame budget, or what happens to motion when truth is stale.
• 05.10 · Interface · Agent Overlay. Law 04 promises agent traversals as visible overlays. No board in the atlas draws one, and the two agent controls in this section (Fix with AI, Ask Claude to fix all) are ungoverned buttons instead.
• Drawer Traces and Tests panes. The drawer declares nine tabs; six are drawn across 05.00 and 05.04. The two missing are the two the whole verification programme in §2 depends on.

Seams

The shell is copied, not composed. 86 command bars, 82 workspace bars, 86 context spines, 84 instrument rows, 83 evidence handles and 84 status groups exist as independent per-board layers. Every promise about invariants surviving movement is currently kept by hand, once per board.

The status bar has already drifted, provably. 82 boards carry a layer named Status / policy loaded · v19; only 4 board texts still display that string, while 75 display policy required. The same pattern holds for Status / index r1842 · fresh (84 layers) and Status / selection synced · 4 surfaces (83). The artefact whose thesis is that the diagram cannot lie contains eighty-odd layers whose name and content disagree about the policy version.

The design system documents a version of itself that no longer exists. Eighteen palette tokens appear between two and eleven times each in an 18 MB export, while the colours that actually draw the atlas — #9EABC1, #F4F7FB, #263349, #6F8FFF, #121A27, #42D392, #F5B84B, #FF6B78 — appear thousands of times and are documented nowhere. Node-kind colours survived the migration; surfaces, text, accent, status and wire colours did not.

Truth is named three different ways on one board. Nine colour swatches, seven components, and a seven-cell matrix whose last cell is a permission state. Inferred and Observed have colours and no components; Unknown has a component and no colour; Observed is used constantly in the fabric panes and has no mark at all.

The agent's contract changes with screen width. Ask · Propose at 1600 becomes Ask at 768 and 390. Either the capability is different at small widths, or the label is wrong at small widths.

Section 05 declares eight interface sub-tabs and delivers two. Canvas, Workbench, Design System, Flow, Responsive, A11y, Visual Tests, Source / Diff appear in the sub-tab row on both 05.01 and 05.02; only Workbench and Responsive-plus-Visual-Tests have boards. The section header's own count, LIBRARY ↗ + 4 SURFACES, disagrees with its own navigation.

One entity, two latencies, one board. PaymentService is p95 210ms in the palette result row and p95 92ms in the palette preview strip, four lines apart, and is tagged ROUTE in both.

Honesty audit

05.02 is the least honest board in the cluster. 48 SNAPSHOTS · 1 DRIFT, baseline · v811, current · v812, diff · 2.4% px and a11y: contrast AA pass 96% all assert the output of a snapshot runner, and §2 says no CI exists — the only framework workflow file is fully commented out. The board also asserts a measured accessibility percentage in the same frame whose footer says performance · unmeasured. The honest version keeps the layout and changes the marks: 48 snapshots · Declared beside runner NotWired — no CI workflow; connect, with the a11y line reading contrast · not run until something runs it. The Approve new baseline button should render disabled with the reason no baseline store wired.

05.04's diagnostics are the right shape with invented content. 11 ok · 3 warn · 1 error, 38/40 pass, p95 180 > 100ms for 28 minutes and Estimated infra: $265 / mo · within $400 budget are all confident numbers with no origin and, per §2, no subsystem behind most of them. The cost row is the clearest case: there is no cost adapter anywhere in the audit. The honest version marks integrity as Source, autowire as Inferred, compile as Observed from the actual build, and everything else as NotWired with the adapter named. That version is more persuasive, not less, because the checks that would be real are exactly the checks a graph runtime uniquely enables.

05.01 is the honest one and should be the template. Tactile · physics skins — designed · not built and AppleButton · error — FAIL are both true statements that cost the board nothing, and accent.brand · 14 uses · drift: web diverged reports a defect against itself. What it still owes is provenance on its six token usage counts.

05.00 asserts a palette it does not use. This is the cluster's central honesty problem and it is measurable rather than rhetorical: sixteen of eighteen documented tokens are effectively unused in the file they govern. The honest version regenerates the colour pane from MachineSignal.kt with a live usage count per row, which would show most rows as DEAD on the day it ships, and which is precisely the kind of uncomfortable truth the atlas exists to make visible.

The shell asserts a measurement it has no source for, and the rest of the atlas admits it has none. input 12ms · frame 16.4ms · measured appears on exactly 4 boards and input 14ms · measured on 1 — the shell states — while performance · unmeasured appears on 76. So the word measured is doing precisely the job a Measured origin mark should do, in prose, five times, with no device, method or sample count, on the five boards that depict the studio itself. That is the whole vocabulary problem in a single string: the atlas has one claim of measurement, it is unsupported, and it appears only where the product is showing itself off.

Part 8 · Section 06–07 — Inner Loop, Ship and Release

Fourteen boards: 06.01–06.05, 07.01–07.04, and the five STATE · Deploy boards.

Section 06 declares itself as "Preview, storyboard, record, trace, and test without losing causality. 5 SURFACES". Section 07 declares "Validate targets, execute pipelines, release, and pass deployment gates. 4 SURFACES". Both section cards are accurate counts. The five deploy states hang off Section 07 without a section card of their own.

06.01 · Trace + Interface · Live Preview

On the board. Three panes under the standard studio chrome, breadcrumbed bestbuds / interface / Live Preview at main@8f41c2. Left is COMPONENT TREE stamped LIVE · runtime · 2s, with a search field reading "Search components, semantics, source" and a typed tree — Surface MTRL, Column LAYOUT, TopBar MTRL, BrandRow ROW, OnboardingBody LAYOUT, Headline TEXT, Subtitle TEXT, AppleButton ● BUTTON, GoogleButton BUTTON, LegalFooter TEXT. Centre is a rendered BestBuds onboarding screen plus a chats screen, banner SEMANTICS · CLICK = INSPECT EVERYWHERE, size readout 360 × 56dp, caption observed preview · local · main@8f41c2 · 2 targets · fresh 2s. Right is an inspector — UI · BUTTON / AppleButton / key=apple_button / ui/onboarding/OnboardingScreen.kt:88, an ACTION CHAIN running AppleButton → loginWithApple → AuthInteractor → AuthService → cf.workers/auth → d1.sessions, a run chip ● trace 7f2a · 142 ms · runtime · 12s ago, and three actions Open in Map, Trace path, Propose with Agent. Below sits Graph fragment (LIVE · runtime · 2s) with AppleButton UI 360×56, AuthService SVC 142ms, cf.workers/auth EDGE 72ms, and the promise "Selection remains synchronized across Map, Trace, Validate and Act."

Vision tie. This is the clearest single expression of "the diagram of the system and the system are the same object": one click on a rendered pixel resolves to a node, a source line, a port chain and a graph fragment. It is also the best argument in the atlas that keeping the graph resident at runtime buys something — a compiled-away Blueprint could not answer "which service does this button reach" from a live process. Where it falls down is evidence: the header says projection: designed and the status bar says source projection · designed, while two panes are stamped LIVE · runtime · 2s and the caption says observed preview. The board asserts designed and observed simultaneously.

Workflow tie. A UI engineer opens this the moment a screen renders wrong or a tap does nothing, which is most mornings. Today they run the app, open the Layout Inspector or the Xcode View Debugger to find the composable, then switch to the editor to grep for the click handler, then to the network tab to see which endpoint it hit, then to the Cloudflare dashboard to see whether the worker was reached. Four tools, four selections, no shared identity. This board collapses that to one selection.

Agentic tie. An agent reads the component tree as typed nodes with source anchors, the action chain as a port path, and the trace chip as one run. Propose with Agent is the only agent affordance and it is unqualified — nothing on the board says what the agent may change, what capability it holds, or where the proposal lands. The board would become genuinely agent-legible with a permission chip next to that button and a SourceRef on every tree row so the agent can cite rather than infer.

Blueprint tie. This is Play-In-Editor plus the Widget Reflector. Unreal lets you pick a widget in a running game and jump to the blueprint that built it; this does the same and then keeps going across the process boundary into the worker and the database, which Unreal cannot do because Unreal's world stops at the executable.

Replaces / augments. Android Studio Layout Inspector, Xcode View Debugger, React DevTools, Storybook, Flipper, and the "inspect element → find the handler" half of Chrome DevTools.

Improvements.

1. Resolve the designed-versus-live contradiction with a per-pane truth chip rather than a board-level one. The component tree is derivable from source today and should read DERIVED · source; the 142 ms and 72ms figures are not and should read NOT WIRED · no span adapter.
2. Add a TARGETS strip above the preview. The caption already claims "2 targets" but the board shows one phone; render the same selection on Android, iOS, Web and Desktop side by side, since cross-platform divergence is the reason a KMP developer opens a preview.
3. Give the ACTION CHAIN a port-identity column. With defect D-6 unresolved, AuthService reached through a string-built port and through a reified port are different objects; the chain should show which kind each hop is, and flag the string hops.
4. Make Trace path carry the selection into 06.04 rather than opening a second trace. Right now the two boards show the same chain twice with no stated relationship.
5. Add an EmptyReason state for the inspector: what this pane looks like when the clicked element has no action chain, which is the common case for Headline TEXT and LegalFooter TEXT.

Verdict. Strengthen.

06.02 · Inner Loop · Flow Storyboard

On the board. A wide screen-flow canvas under the banner "EVERY SCREEN, EVERY TRANSITION — THE APP AS A STORYBOARD · CLICK ANY ELEMENT TO TRACE ITS CHAIN". Six rendered screens carry route labels and traffic numbers: /onboarding 8.2k, /chats 12k, /chats/{id} 24k, /friends/{id} 5.3k, /events/public 12k, /campaigns/current 4.1k, joined by labelled transitions login success, tap chat, tap avatar, tap events tab, tap host, tap campaign. A Graph fragment pane expands the selected element into a full vertical chain with edge verbs — /onboarding ROUTE ↓ binds OnboardingScreen SCREEN ↓ owns key=apple_button AppleButton UI ↓ onClick triggers loginWithApple ACTION ↓ invokes AuthInteractor INTER ↓ calls AuthService SVC ↓ POST /auth/apple cf.workers/auth EDGE ↓ INSERT session d1.sessions DB. A ROUTE COVERAGE · FLOWS pane lists five routes with verdicts: 2 flows ✓, 3 flows ✓, 1 flake ⚠, 0 flows ✖, 1 flow ✓.

Vision tie. This is the eigenvector-primitive argument made visually: route, screen, UI, action, interactor, service, edge, database are eight node kinds and every arrow is a typed port with a named verb. The edge verbs (binds, owns, triggers, invokes, calls, POST, INSERT) are the strongest typed-port vocabulary anywhere in my cluster. The board also embodies the visitor idea implicitly: route coverage is a traversal result, not a hand-maintained list.

Workflow tie. A product engineer or designer opens this at sprint planning to answer "what does the app actually consist of, and which parts are untested", and a new hire opens it in week one instead of reading the router file. Today that artefact is a stale Figma prototype with screens nobody re-exported after the last three releases.

Agentic tie. This is the most useful board in my cluster for an agent, because the route set plus coverage verdicts is a work queue: /events/public 0 flows ✖ is a directly actionable task. An agent could propose the missing Maestro flow, and 06.03 is where it would be recorded. Nothing on the board wires that loop — there is no "generate flow" action and no link from a red coverage row to the recorder.

Blueprint tie. The World Outliner and the level itself: the whole game laid out so you can see where every room connects. It also does something Unreal does not, which is annotate each room with how many players entered it and whether an automated test walks through it.

Replaces / augments. Figma prototype mode, Xcode Storyboards, the funnel view in Amplitude or Mixpanel, Maze, and the route table in a router config file.

Improvements.

1. Add the sixth coverage row. /friends/{id} appears in the storyboard and is missing from ROUTE COVERAGE, which silently undercounts the untested surface.
2. Split the traffic number from the route. 8.2k is unmarked invented analytics; move it to a separate EXPOSURE column with an explicit not wired state, so the route topology stays trustworthy when analytics is absent.
3. Add a DEAD ROUTES pane. The vision claims "unreachable routes are found by query"; this board is the only place that claim can be shown, and it currently is not. A route with no inbound transition is exactly what a visitor traversal would surface.
4. Make the transition labels clickable as first-class objects. login success is a navigation edge with a condition; selecting it should show the condition, the failure branch and whether the failure branch has a screen.
5. Add per-screen capability variance. The same route renders differently when a capability is absent (no camera, no push permission); show a small badge per screen for "renders differently at capability tier X".

Verdict. Strengthen.

06.03 · Inner Loop · Recorder

On the board. The thinnest board in the cluster: a header Recorder — rec_0042 · iPhone 16 Pro · 00:42 with the subtitle "every gesture becomes a Maestro step", a ■ Stop and an Export flow.yaml control, a device pane showing a "Pick your Circle / Weekend Hikers / Night Owls" screen with ● REC 00:42 · capturing taps, swipes, asserts, and a single list CAPTURED STEPS · 11 · → maestro/flows/onboarding-circle.yaml. The eleven steps are typed Maestro commands with timestamps: launchApp dev.bestbuds.app · clearState 0:00, tapOn "Continue with Google" 0:04, assertVisible "Pick your Circle" 0:07, tapOn "Weekend Hikers" 0:09, inputText displayName ← "priya" 0:14, swipe direction: UP · 60% 0:18, assertVisible "BudBot" · intro card 0:21, tapOn id: composer.send 0:26, assertVisible "message sent" toast 0:28, takeScreenshot onboarding-done 0:31, assertNoCrash session healthy 0:42. A footer states the export contract: "selectors normalized to stable ids · asserts inferred from screen transitions · replay on 8 devices in Testing tab".

Vision tie. Weak. Nothing here is graph-shaped. The captured steps are a flat list keyed on labels and one id (composer.send), which is the fragile selector model every record-and-replay tool has always used. The Reaktor-specific version of this board would record node and port identities rather than screen text, because the graph is resident at runtime and knows which node received the tap. The footer's "selectors normalized to stable ids" gestures at this without showing it. This is the one board in my cluster that could have been drawn for any framework.

Workflow tie. A QA engineer or a product engineer opens this after fixing a bug, to lock the fix in with a flow, or before a release to add coverage to a red route from 06.02. Today they hand-write YAML against a running emulator, guess at selectors, and discover the flakiness a day later in CI.

Agentic tie. Two-way potential, none realised. An agent should be able to write a recording (propose a flow for an uncovered route) and read one (explain why auth-login.google is flaky 2 of 3, per 07.02). Neither direction is drawn — there is no agent control on this board at all.

Blueprint tie. Unreal's automation recorder and Sequencer's take recording. The analogy holds well for capture; it breaks on replay, because Unreal replays into a deterministic simulation while this replays into eight physical devices with real network.

Replaces / augments. Maestro Studio, Playwright codegen, Detox recorder, Appium Inspector, and Keploy's record mode.

Improvements.

1. Add a GRAPH FRAGMENT pane, which every other Section 06 board has and this one lacks. Each captured step should resolve to the node it touched, so the flow is a path through the graph rather than a list of strings.
2. Add a SELECTOR STABILITY column per step. tapOn "Continue with Google" breaks on the first copy change; tapOn id: composer.send does not. Colour the eleven steps by that risk and offer a one-click promotion to a node key.
3. Add a COVERAGE IMPACT pane. Recording this flow should show which red rows in 06.02's route coverage turn green, which is the reason to record at all.
4. Add the assertion-authoring state. "asserts inferred from screen transitions" is a claim about generated asserts; show the inferred assert before it is written, with accept and reject, because a wrong inferred assert is worse than none.
5. Show the replay target set inline rather than pointing at a "Testing tab" that has no board behind it.

Verdict. Strengthen.

06.04 · Inner Loop · Causal Trace

On the board. Breadcrumbed bestbuds / source / Causal Trace. The header runs the chain AppleButton → loginWithApple → AuthInteractor → AuthService → cf.workers/auth → d1.sessions with a total 142 ms, labelled Causal path · trace abc4f1e2. An ORIGIN pane shows the onboarding screen thumbnail and UI · BUTTON / AppleButton / ui/onboarding/OnboardingScreen.kt:88. A BLAST RADIUS pane gives three figures — Affected nodes 14 · across 5 modules, Tests impacted 3 commands, Deploy targets cf.workers/auth · d1.sessions. The main pane is PORT INVOCATIONS · WATERFALL, seven rows each with a cumulative offset, a span label, a delta and a Graph link: 0ms ui:AppleButton · onClick +2ms, 2ms action:loginWithApple +3ms, 5ms interactor:AuthInteractor.invoke +9ms, 14ms service:AuthService.loginWithApple +38ms, 52ms edge:cf.workers/auth · POST /login +72ms, 124ms db:d1.sessions · INSERT +14ms, 138ms ui:navigate(/home) +4ms. Footers read blast radius · 14 entities · 6 modules, origin · device Pixel 7 Pro · dark · online, provider=apple · session issued · 201.

Vision tie. The strongest board in the cluster and the best case for a live graph. A conventional tracer gives spans; this gives port invocations, which means each row is an edge in the resident graph and therefore has a Graph link back to structure. Blast radius is the payoff of the graph being alive: the set of entities a change to AppleButton can reach is a traversal, computable now, on real data, with no telemetry adapter required. That makes half this board buildable today and the other half — the timings — dependent on a span collector the audit says does not exist.

Workflow tie. A backend or mobile engineer opens this during an incident or while chasing a latency regression, and a reviewer opens it before approving a change to shared code. Today the same question requires Xcode Instruments or the Chrome performance panel for the client half, a Jaeger or Datadog waterfall for the server half, and a manual grep to guess the blast radius, with no object connecting the three.

Agentic tie. Excellent raw material and no affordance. The waterfall plus blast radius plus source anchors is exactly what an agent needs to propose a fix and predict what it will break — and the atlas's 08.x agent boards would consume it. There is no Send to Agent, no Explain this trace, and no way to attach the trace to a task, which is a gap given that 06.05 has Send to Agent on every crash group.

Blueprint tie. Unreal Insights fused with the Blueprint debugger's call stack. Where the analogy breaks is scope: Unreal Insights profiles one process; this crosses device, edge worker and database in one waterfall, which is a genuinely different object and the atlas should say so rather than borrowing the profiler idiom silently.

Replaces / augments. Xcode Instruments, Android Studio Profiler, Chrome DevTools performance, Jaeger, Tempo, Datadog APM flame graphs, Sentry performance traces.

Improvements.

1. Fix the module count. Affected nodes 14 · across 5 modules and blast radius · 14 entities · 6 modules are on the same board. Whichever is right, the disagreement makes both unusable.
2. Split the board's truth classes visibly. Draw a divider: blast radius and the port chain are DERIVED · graph, the seven timings are NOT WIRED · no span adapter. A half-honest board is more persuasive than a uniformly confident one.
3. Reconcile the endpoint name. This board says POST /login; 06.02 says POST /auth/apple. One endpoint, two names, in adjacent boards.
4. Add a COMPARE control. A waterfall is only actionable against a baseline; give it "compare with previous trace" and "compare with p50", with an explicit unknown when no baseline exists.
5. Make Tests impacted 3 commands enumerable. Three named commands with run status is a work item; the number alone is trivia.
6. Add the failure variant. Every trace here succeeds (session issued · 201). The board a developer actually opens is the one where the chain stopped at edge:cf.workers/auth, and that state is not drawn.

Verdict. Keep.

06.05 · Validate + Delivery · Harnesses & Shadow E2E

On the board. Breadcrumbed delivery / Harnesses & Shadow E2E, titled "Validate — required gates, synthetic traffic, explicit unknowns" with the scope banner DESIGN FIXTURE · synthetic + redacted shadow samples · aggregate green is blocked when a required harness is unknown. Three counters read 141 pass · fixture, 1 fail · fixture, 2 flaky · fixture, next to Run validation plan. A harness list gives three rows, each with a Coverage → Graph link: maestro · android / 26 flows · devices / 141/1 / 12m 40s, playwright · web / 64 specs · traces / 64/0 / 3m 22s, keploy · replay / recorded JVM traffic / 12/12 / 0m 44s. A SHADOW E2E · SYNTHETIC FIXTURE pane declares synthetic source · redacted · 1% sample · retention 24h, four aggregates (Replays · 142k · fixture, Drift-free · 99.4% · fixture, Warnings · 612 · fixture, Errors · 42 · fixture) and five timestamped request rows comparing prod and dev latency with a drift percentage and a verdict, including POST /auth/google · synthetic_04 · prod 112ms · dev — · drift — · error · 500. Its policy line ends adapter not wired. The third pane, CRASH GROUPS · CRASHLYTICS + SENTRY · LINKED TO ACTIVE DEPLOY, lists NullPointerException / ChatScreen.kt:142 / Android · API 34 / 412 users · 1842 sessions / ↑ rc-812, Worker exception · D1 timeout / workers/auth/index.ts:62 / CF Worker / 14 sessions / ↑ rising, and ANR · 5s / OnboardingScreen / Android · API 33 / 22 users / ↓ falling, each with Send to Agent.

Vision tie. This board carries the evidence principle better than any other in my cluster and better than most in the atlas. The banner declares the fixture, every aggregate carries a · fixture suffix, the policy line ends adapter not wired, and — most importantly — it states a semantics for unknown: "aggregate green is blocked when a required harness is unknown". That single sentence is the honest-verification idea the rest of the atlas is missing, and it appears exactly once, in prose, on one board. See the focused section below on how to systematise it.

Workflow tie. A tech lead opens this before cutting a release candidate, and an on-call engineer opens the crash pane after a deploy. Today those are two different tools with no relationship: a Firebase Test Lab matrix or a Playwright HTML report on one side, Crashlytics and Sentry on the other, joined by a human remembering which release was live.

Agentic tie. The only board in my cluster with a per-item agent handoff. Send to Agent on a crash group with a source anchor and a release attribution (↑ rc-812) is a well-formed agent task. What governs it is not shown — no permission chip, no statement of what the agent may do with a production crash, no receipt for the resulting proposal. Given that this board sits one step from 07.x, the missing governance is conspicuous.

Blueprint tie. The asset validator plus the automation test session frontend. The shadow-E2E pane has no Unreal analogue at all; the nearest thing is a replay of recorded gameplay against a new build, which is closer than it first looks and is worth borrowing as a framing.

Replaces / augments. Firebase Test Lab, BrowserStack, Playwright report, Keploy, GoReplay and Diffy for shadow traffic, Crashlytics, Sentry.

Improvements.

1. Mark the crash pane. 412 users · 1842 sessions is unmarked under a header claiming a live Crashlytics and Sentry link. Either the fixture scope propagates into every pane automatically or the board's own honesty rule is optional, which defeats it.
2. Move crash groups to 10.04 · Observe · Errors, which already carries the same NullPointerException at line 142 under a different filename. One crash group, one home.
3. Turn "aggregate green is blocked when a required harness is unknown" into a visible computation. Show the required-harness list, which of them reported, and the resulting aggregate with the unknowns counted as blocking. Right now the rule is stated and the counters do not obey it.
4. Add a REQUIRED toggle per harness row. The rule needs a subject: which harnesses are required for this target, and who declared them.
5. Rename the shadow rows' error · 500 to something that cannot be mistaken for production. A fixture failure and a live failure must not look identical, particularly on the board that teaches the rest of the atlas how to be honest.
6. Add a FIXTURE LEDGER pane listing each fixture value and the real source that will replace it, turning the board into its own migration plan.

Verdict. Split into 06.05 · Validate · Harnesses (gates plus coverage), a Runtime-instrument board for shadow traffic, and a merge of the crash pane into 10.04.

07.01 · Ship · Device Lab

On the board. One pane, eight cards, breadcrumbed delivery / Device Lab, headed Device lab — 8 devices · 6 paired with + Add device and Reload all. Six paired cards — Pixel 7 Pro / Android 14 · v812 · emulator, iPhone 16 Pro / iOS 18.2 · v812 · simulator, iPad Pro 12.9 / iPadOS 18.2 · v811 · simulator, Web · Chrome 138 / macOS · v812 · devtools, Desktop · macOS / macOS 15.2 · v812 · dmg, Pixel Tablet / Android 14 · v812 · emulator — each carrying the identical trio live · mirrors, hot reloads, and the actions Preview, Hot reload, Capture. Two offline cards — Fold4 · device / Android 14 · v810 · real · 82% and iPhone SE / iOS 17.6 · simulator — carry reconnect, to pair, and the actions Pair, Logs.

Vision tie. This board should be the atlas's showcase for adapter and capability tiers and instead it is a device list. Every paired card asserts the same two capabilities in the same words. The vision says "Platform features are adapters that may be absent; what they can do is expressed as capability tiers... Degradation is designed, not discovered" — a lab of eight heterogeneous targets is the natural place to show that, and it shows nothing of the kind. A real desktop target does not hot-reload the way a Hermes-hosted web bundle does, and the board flattens that difference away.

Workflow tie. A developer opens this at the start of a task to pick where to run, and before a release to check that a real folding device and an old iPhone still work. Today this is the Xcode device menu, the Android Studio device manager, a browser, and a Slack message asking whether anyone has a Fold4 charged.

Agentic tie. Agent-hostile as drawn. There is nothing an agent can read that would let it choose a device for a task — no capability matrix, no last-run history, no queue, no notion of which device is free. An agent asked to "verify this on a small screen" has no queryable answer here.

Blueprint tie. Unreal's Launch On device menu and device profiles. Device profiles are precisely the missing half: Unreal expresses per-device capability and scalability settings as data, which is what this board needs and lacks.

Replaces / augments. Firebase Test Lab, BrowserStack Live, Xcode devices window, Android device manager, Expo dev clients, Flipper.

Improvements.

1. Add a CAPABILITY block per card, with tiers rather than booleans: hot reload: full / restart-only / none, push: full / local-only / none, camera, biometrics, background execution. This is the single change that makes the board Reaktor-shaped.
2. Add a version-skew warning. iPad Pro 12.9 · v811 and Fold4 · v810 are behind the other six on v812, and the board says nothing about it. A skew column is what a lab is for.
3. Add per-device evidence. Which flow last ran here, when, with what result — otherwise 07.01 cannot serve the "replay on 8 devices" promise 06.03 makes.
4. Add a run-targeting control: select a flow or a preview and cast it to a chosen device subset, which is the action every user of this board actually wants.
5. Give the offline cards an EmptyReason. reconnect / to pair says nothing about why the device dropped or what to do.

Verdict. Merge into Section 06. Nothing on this board is about shipping — no artefact leaves the building, there is no gate, no target promotion and no release. Section 07's own card says its scope is "Validate targets, execute pipelines, release, and pass deployment gates", and a lab of paired emulators with hot reload does none of the four. Renumber it as the first surface of the inner loop, where 06.01 Preview, 06.03 Recorder and 06.05 harness replay all already point at it.

07.02 · Ship · Pipeline

On the board. A single vertical stage list headed Pipeline · rc-812 — 7/12 pass · 1 running, with started 14m ago · ETA 5m. Twelve stages, each with a status, a duration and a one-line result, several with an inline action: Compile · KMP / pass / 42s / Android, iOS, Web, Desktop · 4 targets · 0 warnings; Unit tests / pass / 1m24 / 142 tests · 0 failures · 74% coverage; Lint + a11y / warn / 18s / 1 a11y warning · AppleButton tap target / Retry; Maestro flows / flake / 4m12 / 21/22 pass · auth-login.google flaky 2/3 / Retry; Keploy replay / pass / 2m14 / 8 recordings · all match · drift 0.0%; Visual snapshots / diff / 1m02 / 1 baseline drift · OnboardingScreen.light / Approve baseline; Migration dry-run / pass / 8s / 0042 applied · 4.2M rows · 142ms; AI evals / pass / 42s / 5/5 suites · recommend_quality 0.91 ↑; AI guardrails / pass / 12s / 412 redteam cases · 100% block; Smoke · staging / running / 42/60 checks · 18 pending / View logs; Error budget / queued / requires smoke pass; Manual approval / queued / requires @auth-squad · 2 of 3 received.

Vision tie. None, and that is the problem — see the focused section below. The board depicts a generic CI pipeline that could belong to any product. Nothing here is graph-shaped: no stage takes a subgraph as input, no stage emits a graph diff, no stage is a visitor over the node set. The one Reaktor-specific stage that exists elsewhere in the cluster (GraphManifest, Graph integrity, on 07.04) is absent here.

Workflow tie. Everyone opens this, several times a day, when a red check blocks a merge. Today it is the GitHub Actions run page — except that in this repository there is no such page, because the workflow is commented out and the Dagger pipeline is dispatch-only.

Agentic tie. No agent affordance at all, on the board where agents would be most useful: a flaky Maestro flow (auth-login.google flaky 2/3) and a visual baseline drift are both well-scoped agent tasks with clear accept-or-reject outcomes. The absence of any Send to Agent here, next to 06.05 where every crash group has one, is an inconsistency rather than a policy.

Blueprint tie. The build and cook pipeline — UnrealBuildTool and BuildGraph. The analogy is exact and unflattering: Unreal's BuildGraph is a declared dependency graph of build nodes that you can inspect and re-enter, whereas this board is a flat list. A framework whose thesis is that everything is a graph draws its build as twelve stacked rectangles.

Replaces / augments. GitHub Actions, CircleCI, Bitrise, Buildkite, Dagger, and the check list on a pull request.

Improvements.

1. Add a TRIGGER header. Today it must read manual dispatch only · no push trigger · no required checks, because that is the truth. After L0, it becomes an event matrix.
2. Classify every stage by existence, not just by status: RUNS TODAY, DEFINED · NOT TRIGGERED, NOT BUILT. On current evidence, Keploy replay, Visual snapshots, AI guardrails and Error budget belong in the third group.
3. Replace 142 tests · 0 failures · 74% coverage with a module ledger: how many of the thirty framework modules execute tests, how many have none, and what coverage is actually measured. The honest string is closer to "3 modules run JVM tests · 12 modules have zero tests · coverage not measured".
4. Delete every invented duration or bind it to a RunRef. 42s, 1m24, 4m12, started 14m ago · ETA 5m are fabrications on a board whose entire purpose is to report what happened.
5. Draw the pipeline as a dependency graph rather than a list, with fan-out per target and the four KMP targets as parallel branches. Error budget / requires smoke pass and Manual approval / requires @auth-squad are already edges written as prose.
6. Reconcile with 07.04. One release candidate cannot have both a twelve-stage and an eleven-step pipeline with different unit-test counts.

Verdict. Rebuild.

07.03 · Ship · Releases

On the board. The first board in the cluster whose environment chip reads PROD. Three release cards. v813-rc / canary · 5% · 41m with Promote now · Halt, the evidence line crash-free 99.4% · p95 61ms · no new groups, the policy promote to 25% in 2h if green, and a five-rung ladder ✓ build / ✓ staging / ● canary 5% / — 25% / — 100%. v812 / prod · 100% · 6h with Rollback plan ready, crash-free 99.2% ⚠ NPE group new · 412 ev, regression linked: cmd #12 flatInvoker bump, and a fully ticked ladder. v811 / archived · served 8d with Restore, crash-free 99.6% · clean, and a ladder showing ✓ canary 5% / — 25% / — 100%. Below, FEATURE FLAGS · CONFIG ACTOR · RUNTIME, NO REDEPLOY lists budbot-tone-v2 / 50% experiment / exposure logged · promote pending eval, voice-intro-nudge / staged · 0% / waiting on v813 100%, circle-size-9 / killed / guardrail auto-kill · retention −3.1pt, kept-buds-tab / 100% / fully rolled · remove flag in v814.

Vision tie. Partial and mostly by accident. regression linked: cmd #12 flatInvoker bump is the best line on the board and the only place in the cluster where a production regression is attributed to a specific graph command rather than a commit — that is the live-graph thesis paying off in release management. The flags pane, labelled CONFIG ACTOR · RUNTIME, NO REDEPLOY, is the nearest thing the atlas has to code push and is not the same thing: a flag chooses between paths already shipped, whereas code push replaces the paths.

Workflow tie. A release manager or tech lead opens this daily during a rollout to decide promote or halt, and a product manager opens the flags pane to check an experiment. Today that is App Store Connect phased release plus Play Console staged rollout plus LaunchDarkly plus a crash dashboard, with the correlation done by hand.

Agentic tie. No agent affordance, and here the omission is defensible but undrawn. Promote now and Halt are irreversible production actions; an agent should be able to recommend and never execute. The board should show that boundary as a permission chip rather than leaving agents silently absent.

Blueprint tie. No good Unreal analogue; the closest is the Epic launcher's patch channels, and the analogy is weak enough to abandon. This board's ancestors are Spinnaker and LaunchDarkly, not the editor.

Replaces / augments. App Store Connect phased release, Play Console staged rollout, LaunchDarkly, Statsig, Firebase Remote Config, Argo Rollouts.

Improvements.

1. Fix the version namespace. This board says v811 / v812 / v813-rc; every other board in the section says rc-810 / rc-811 / rc-812. 07.04 manages to use both in one pane.
2. Fix the v811 ladder. An archived release that "served 8d" cannot show — 25% and — 100% as never reached.
3. Move FEATURE FLAGS out. Flags with exposure and eval are experiments, and 11.03 · Learn · Experiments already exists. What should stay is the flags-as-release-lever view: which flags are load-bearing for the current rollout and which must be removed before the next.
4. Attribute guardrail auto-kill · retention −3.1pt to a guardrail definition. An automated production kill needs a visible rule, a threshold, a window and a receipt; as drawn it is a machine acting without a stated licence.
5. Add a PER-TARGET breakdown to each release card. v813-rc canary · 5% is a single number covering five heterogeneous targets, and mobile in particular cannot be at 5% and instantly promotable.
6. Add an EVIDENCE link on each metric. crash-free 99.4% · p95 61ms has no source, no window and no freshness.

Verdict. Split into a release-rollout board and a flags-and-guardrails board.

07.04 · Act + Delivery · Deployment Plan & Gates

On the board. The richest board in the cluster and the only one carrying a receipt. Its secondary nav changes to Resources · Operations · Deploy · Pipeline · Runs · Cost. Titled "Act — review one sealed plan across five targets" with the subtitle "desired state → diff → evidence gates → independent approval → rollout → observe" and the action Review deployment plan. A SEALED PLAN DIFF pane reads + 2 ports / + 1 schema field / ~ 4 nodes / − 1 deprecated handler, Bundle #1042 · 7 commands, with Inspect rc-812 and Rollback to v811. Five target cards: JVM · k3s (reaktorServer · Spring Boot, memgraph · bolt 7687, clickhouse · 8123, rollout ready · image #1042); Workers · Cloudflare (messaging · chat DO · social, moderators · analytics, notification · archiver, 7 workers · bundle fresh); Web · edge (appWeb · vite, reaktorWeb + /docs, companyOS, static assets · 18.7MB); Mobile · stores (android · Play internal, ios · TestFlight, fastlane · Maestro gate); Native · desktop (reaktorDesktop dmg/msi, MCP loopback :8765, 96MB · notarized). A REQUIRED EVIDENCE strip reads build ✓ / unit ✓ / maestro ✓ / soak · staging ✓ / blast radius · 14 entities, followed by APPROVAL REQUIRED. Validation gates · staging shows 11 steps · 7 passed · 2 running · 2 queued · started 14m ago · ETA 5m over the eleven-row list GraphManifest 14s, Graph integrity 06s, Compile · KMP 3m42, Unit · 1,284 1m24, Android build 2m08, iOS build 64%, Maestro · 14/14 4m12, Worker deploy 42%, D1 migration —, Smoke test —, Error monitor —. A RECEIPT block reads PlanApproved / plan_8dd4 · actor alice · approver bob / independent · expires 9m / sha256:8dd4…c11a · reason attached · rollback proven · one use / APPROVED. RELEASES · LAST 7D lists rc-811 / production / 2h ago / @auth-squad / b81230f / 4 cmds / eval 0.88 / gates 10/10 / Rollback and rc-810 / rolled back / 1d ago / @growth-squad / 4f81dc0 / 12 cmds / eval 0.82 / gates 7/10 / Diff.

Vision tie. The best in the cluster. A deployment expressed as a graph diff (+2 ports, ~4 nodes, −1 deprecated handler) rather than a commit range is exactly what the thesis promises, and Bundle #1042 · 7 commands makes the change a set of graph commands with a blast radius attached. GraphManifest and Graph integrity as the first two gates is the right instinct: before you build, prove the graph is coherent. The receipt — sealed hash, independent approver, expiry, single use — is the Symphony Contract's patch → plan → receipt path actually drawn, once, here.

Workflow tie. A release manager and an approver open this together at the promotion moment, which is the highest-stakes ten minutes of the week. Today that is a Terraform plan in one window, an Argo CD sync in another, a change ticket in a third and a Slack thread asking someone to look.

Agentic tie. Structurally the most agent-ready board and the most agent-empty. Everything an agent needs to reason about a deploy is present — a typed diff, blast radius, evidence, an approval object with an expiry. What is missing is the agent's side of the contract: a plan authored by an agent, with the same receipt shape and an explicit agent may propose · human must approve permission. The contract promises human and agent changes share one path; this board shows one traveller on it.

Blueprint tie. Cook, package and deploy, plus a terraform plan that has grown a real approval object. The Unreal analogy is weakest here because Unreal has no notion of an independent approver or of a diff over a live system.

Replaces / augments. Terraform and Pulumi plan-and-apply, Argo CD, Spinnaker, Jenkins deployment jobs, ServiceNow change approvals, and the release checklist in a Notion page.

Improvements.

1. Make rollback proven clickable. It is the most consequential claim on the board and the only one with no evidence behind it. Link it to the rehearsal run that proved it, or downgrade the string to rollback · unproven.
2. Show per-target reversibility on each of the five cards. Workers revert in seconds, a D1 schema change may not revert at all, and mobile cannot revert an installed binary. One Rollback to v811 button across five targets with different physics is the cluster's central design error.
3. Add an agent row to the receipt. actor alice · approver bob should have a third slot for the principal that authored the plan, which may be a model, with its capability set.
4. Carry the receipt into the deploy states. It appears here and disappears in the four boards that perform the act.
5. Reconcile Unit · 1,284 with 07.02's 142 tests, and Maestro · 14/14 with 07.02's 21/22.
6. Show what the +1 schema field does to rollback. A forward schema change is the reason a rollback becomes lossy, and this pane is where that consequence should surface before approval, not after.

Verdict. Keep.

STATE · Deploy · Blocked by Failed Gate

On the board. The 07.04 layout in a failed condition. Titled "Deploy blocked — verification failed" with "promotion stopped · last healthy release unchanged · checkpoint and evidence retained", and — jarringly — a primary button still reading Promote to Production. The GRAPH DIFF pane and all five target cards are byte-identical to 07.04, including rollout ready · image #1042 and 7 workers · bundle fresh on a blocked deploy. A PIPELINE strip reads build ✓ / unit ✓ / maestro ✕ · 2 flows / soak · blocked / blast radius · not evaluated / promote — blocked by gate. Validation gates · blocked shows 11 steps · 7 passed · 1 failed · 3 skipped · last healthy rc-811, with iOS build 64% and 2 FAILED / Maestro · 12/14. RELEASES · LAST 7D adds rc-812 / blocked / 4m ago / Shibasis / a4f12c8 / 7 cmds / eval 0.91 / gates 7/10 / Open failure.

Vision tie. blast radius · not evaluated is the single best string across all five states. It refuses to invent a number for something the run never reached, which is precisely the NotWiredYet principle applied to a runtime condition. Everything else on the board inherits 07.04's vision credit without adding to it.

Workflow tie. Opened by whoever tried to promote and by the on-call engineer who gets paged five minutes later. Today: a red GitHub check, a Slack alert, and a hunt through logs to find which of fourteen jobs failed and whether it matters.

Agentic tie. Open failure is the only action, and it goes to a human. The obvious agent task — two named Maestro flows failed, here is the diff that broke them, propose a fix or a quarantine — is not offered even though 06.05 offers exactly that shape for crashes.

Blueprint tie. A cook failure in Unreal, where the editor tells you which asset failed validation and refuses to package. The analogy is good and the board is weaker than the analogy, because Unreal names the asset and this names a count.

Replaces / augments. A red PR check, Argo CD's degraded state, Spinnaker's failed stage, PagerDuty change events.

Improvements.

1. Disable or relabel Promote to Production. A blocked board whose primary action is promote teaches the wrong reflex. It should read Promotion blocked and be inert, with Override as a separate, receipted, second-class action.
2. Name the two failed flows. maestro ✕ · 2 flows and 2 FAILED / Maestro · 12/14 never say which, which is the first thing anyone needs.
3. Grey the five target cards. They still advertise rollout ready and bundle fresh for a deploy that will not happen.
4. Explain iOS build 64% inside a run that is blocked. Either it is still running, in which case the run is not fully stopped, or it was abandoned, in which case it should say so.
5. Reconcile 7 passed / 1 failed / 3 skipped out of eleven with the release row's gates 7/10. The denominator differs from the list on the same screen.
6. Add the blocked at receipt: which gate, which policy required it, who can override, and whether an override has been requested.

Verdict. Strengthen.

STATE · Deploy · Rollback Confirmation

On the board. The only board in my cluster that changes application shell. Beneath the usual studio chrome sits a second application frame — R Reaktor / bestbuds / PRODUCTION / main · b81230f / SP — and a bottom bar reading Problems 1 · Output · Audit, which is the desktop IDE shell rather than the studio shell. The content is a confirmation dialog: section label DEPLOY / RECOVERY, instruction "Confirm the recovery boundary.", status no command emitted yet, and the question "Roll back production release? rc-811" with the body "Traffic will return from rc-811 to rc-810. Reaktor will preserve the failed release, command log, telemetry, and rollback evidence." Two comparison blocks: CURRENT / rc-811 · production / b81230f · 100% traffic and RESTORE / rc-810 · verified / 4f81dc0 · healthy. Four statistics: 100% traffic, 12 targets, ~4m estimate, 0 data loss. A REASON field reads "Gate regression after production promotion". A REQUIRED note states "Human confirmation emits a typed rollback command with identity, reason, graph diff, restore point, and resulting audit evidence." Actions CANCEL and ROLL BACK RC-811. Status line: restore point rc-810 · verified, awaiting human confirmation, promotion policy enforced, no command emitted.

Vision tie. The REQUIRED sentence is the right idea stated exactly once — a destructive act becomes a typed command carrying identity, reason, diff and restore point, which is the graph-command model applied to operations. The board then contradicts its own care by asserting 0 data loss as a certainty and by proposing a restore point the rest of the cluster records as failed.

Workflow tie. The single most stressful screen in the product: it is opened at 2am with a page in hand. Everything on it must be true, because nobody re-reads it.

Agentic tie. Correctly locked — an agent must never press this. But no command emitted yet and awaiting human confirmation describe a state an agent should be able to prepare: assemble the rollback command, fill the reason from the incident, and hand a human the confirm. That authorship handoff is not drawn.

Blueprint tie. None. This is an operations confirmation dialog and the Unreal analogy adds nothing.

Replaces / augments. The Argo CD rollback dialog, Spinnaker's manual judgement stage, kubectl rollout undo with a human in front of it.

Improvements.

1. Fix the release identity. This dialog rolls back rc-811 to rc-810; the blocked, running, complete and recovery boards are all about rc-812 and name rc-811 as the healthy restore point. As drawn it is a different incident bolted into the same sequence.
2. Stop offering a known-bad restore point. rc-810 is verified · healthy here and rolled back · 1d ago · eval 0.82 · gates 7/10 on four other boards, with the same sha 4f81dc0.
3. Replace 0 data loss with a computed reversibility statement per target. The plan contains +1 schema field and the recovery board runs Reverse migrations; a forward migration on 4.2M rows cannot promise zero loss. Show writes-since-promotion and which of them will be orphaned.
4. Replace 12 targets with the five named targets from 07.04, each with revertible / partially / not revertible. Mobile in particular cannot be reverted; only what is served to it can.
5. Make the REASON an editable required field, not a pre-filled label. The REQUIRED note says the reason goes into the command; the design must therefore capture it, and ROLL BACK RC-811 should stay disabled until it is present.
6. Show the receipt that will be produced, before it is produced — principal, approver, hash preimage — so the operator confirms an object rather than a sentence.
7. Return to the studio shell. A modal must not change the host application.

Verdict. Rebuild.

STATE · Deploy · Production Rollout Running

On the board. "Deploying rc-812 — production rollout" with "progressive exposure · automatic abort armed · graph diff and telemetry live". GRAPH DIFF and the five target cards are identical to 07.04 and to the other three full-shell states. The PIPELINE strip reads build ✓ / unit ✓ / maestro ✓ / soak · staging ✓ / blast radius · 14 entities ✓ / canary 25% · running. Production rollout · rc-812 reports 11 steps · 9 passed · 1 running · 1 queued · started 21m ago · ETA 7m over the same eleven rows, now with Maestro · 14/14 4m12, Worker deploy 1m08, D1 migration 18s, Smoke test 42s, Error monitor 25%. RELEASES shows rc-812 / canary 25% / live now / Shibasis / a4f12c8 / 7 cmds / eval 0.91 / gates 9/10 / Pause rollout.

Vision tie. Thin. The graph diff carries over from 07.04, but the rollout itself is drawn as an eleven-row job list, not as a graph being progressively swapped across five targets. The vision's whole claim is that a deploy is a graph transformation; a running rollout is where that should be most visible and it is least visible here.

Workflow tie. Watched, not used. A release manager leaves this open for twenty minutes while a canary bakes, glancing at it for the one signal that would make them press Pause rollout.

Agentic tie. This is the strongest case in the cluster for an agent that watches rather than acts: an agent monitoring the canary against a baseline and raising a halt recommendation is genuinely valuable and carries no irreversible authority. Nothing on the board admits an agent exists.

Blueprint tie. No editor analogue. Argo Rollouts and Spinnaker canary analysis are the real ancestors.

Replaces / augments. Argo Rollouts, Spinnaker canary, Play Console staged rollout progress, LaunchDarkly progressive delivery.

Improvements.

1. Show what arms the abort. "automatic abort armed" names no threshold, no metric, no window and no baseline. Give it an ABORT POLICY block with the exact rule and its current margin.
2. Show exposure per target. canary 25% is one number spanning workers, edge assets, a JVM image and two store channels that cannot possibly be at 25% in the same sense.
3. Add a live health pane. A rollout board with no error rate, no latency and no crash signal is a progress bar; the decision it exists to support needs the numbers.
4. Distinguish deployed from activated. Worker deploy completing does not mean devices are running the new graph, and the board treats them as the same event.
5. Reconcile gates 9/10 with 11 steps.
6. Show the receipt that authorised this rollout, carried forward from 07.04.

Verdict. Strengthen.

STATE · Deploy · Complete and Healthy

On the board. "Deploy complete — rc-812 healthy" with "one graph-owned release · all targets promoted · telemetry and rollback window active", and — again — a primary button reading Promote to Production on a completed deploy. Identical GRAPH DIFF and target cards. PIPELINE reads build ✓ / unit ✓ / maestro ✓ / soak · staging ✓ / blast radius · verified ✓ / production ✓. Release complete · rc-812 reports 11 steps · 11 passed · completed 2m ago · rollback window 58m, with Error monitor 5m pass. RELEASES shows rc-812 / production / 2m ago / gates 10/10 / Rollback.

Vision tie. "one graph-owned release" is a real claim and the board does not support it. If the release is graph-owned, the completed state should show the new graph as the live one, with the diff applied and the previous revision retained as a restore point. Instead it shows the same pre-deploy diff pane as the blocked and running states, so nothing on the board actually changes to reflect that the system is now different.

Workflow tie. Glanced at for ten seconds, then closed. Its real job is to be the thing linked in a Slack message saying "rc-812 is out".

Agentic tie. The natural moment for an agent to write the release note, close the linked tasks and record the receipt. No affordance.

Blueprint tie. None meaningful.

Replaces / augments. A green deploy notification in Slack, the Argo CD healthy state, a release page in GitHub.

Improvements.

1. Retire the Promote to Production button on a completed deploy, and make Rollback plus Extend rollback window the two live actions.
2. Resolve "all targets promoted" against android · Play internal and ios · TestFlight on the same screen. Internal testing and TestFlight are not production, and a twenty-one-minute mobile production rollout is not possible under store review. Either the mobile card must show awaiting review, or the thing that shipped to mobile was a pushed bundle — which is the board the atlas has not drawn.
3. Explain the rollback window 58m. What ends at minute sixty, what becomes impossible after it, and why sixty.
4. Show the post-deploy graph. +2 ports / +1 schema field / ~4 nodes / −1 deprecated handler should now render as applied, with the previous revision reachable.
5. Add the receipt and the incident-free evidence that justifies the word "healthy" — five minutes of error monitor is a claim, and it should carry its window and its threshold.

Verdict. Strengthen.

STATE · Deploy · Recovery Complete

On the board. "Recovery complete — rc-812 rolled back" with "traffic restored to rc-811 · failed release isolated · commands, evidence, and telemetry preserved". The GRAPH DIFF and five target cards are again unchanged from 07.04, still advertising rollout ready · image #1042 after the rollout was reversed. The PIPELINE strip becomes a recovery strip: freeze traffic ✓ / restore rc-811 ✓ / reverse migrations ✓ / smoke · production ✓ / error budget · stable ✓ / recovery verified ✓. Recovery gates · complete reports 6 recovery steps · 6 passed · rc-811 healthy · incident evidence sealed over a list of eight named entries plus three blanks: Freeze traffic 08s, Restore rc-811 18s, Reverse migrations 42s, Worker rollback 38s, Mobile channel reset 1m18, Smoke · production 42s, Error monitor 5m pass, Audit evidence sealed, then — — —. RELEASES shows rc-812 / rolled back / 6m ago / recovery 6/6 / Open incident, rc-811 / production · restored / 6m ago / Healthy, rc-810 / rolled back / 1d ago.

Vision tie. Mobile channel reset is the one string in the entire cluster that acknowledges mobile cannot be rolled back the way a worker can — you reset the channel, you do not un-install the binary. That is the correct model and it appears once, unexplained. Otherwise the board asserts a clean, total, ninety-second recovery of a five-target distributed system, which is the opposite of what the vision's honesty principle demands.

Workflow tie. Read the morning after, during the incident review, by people deciding what to change. It is therefore the board most likely to be treated as the factual record, which makes its inaccuracies costly.

Agentic tie. Open incident is the only action. An agent should be writing the incident timeline from the sealed evidence here; nothing invites it.

Blueprint tie. None.

Replaces / augments. An incident timeline in PagerDuty or incident.io, a post-mortem template, the Argo CD rollback history.

Improvements.

1. Fix the three conflicting enumerations of one recovery. The header says six steps, the PIPELINE strip names six different labels, and the gate list shows eight named rows plus three blanks.
2. Make Reverse migrations ✓ 42s honest or remove it. The plan added a schema field and 07.02 reports the migration touching 4.2M rows; a reversal is either lossy, long, or impossible, and stating it as a forty-two-second tick is the boldest false claim in my cluster.
3. Add an UNRECOVERED pane. A real recovery leaves residue: writes made against the new schema, devices still on the old bundle, workers in another region that did not acknowledge. The honest board has a section for what did not come back.
4. Grey the plan diff and the target cards, or replace them with the restored state. Advertising rollout ready · image #1042 after a rollback is actively misleading.
5. Make incident evidence sealed an object with a hash, a principal and a link, matching the sha256:8dd4…c11a receipt grammar on 07.04.
6. Reconcile rc-810 here (rolled back) with the rollback dialog that offers it as verified · healthy.

Verdict. Rebuild. The honest version of this board is a different shape — partial recovery, per-target outcomes, an unknown column — not the same shape with corrected numbers.

Focused judgements

1. The CI contradiction on 07.02

07.02 · Ship · Pipeline depicts a twelve-stage pipeline for rc-812 that started 14m ago with an ETA 5m, twelve wall-clock durations, and stage results down to 74% coverage and drift 0.0%. The audit is unambiguous that none of this can have happened: the framework's only workflow file is entirely commented out, BestBuds' Dagger pipeline is workflow_dispatch-only, and there are no git tags. There is no event that starts this pipeline, no record of it having run, and no branch protection that would require it. This is the sharpest planned-versus-built gap in my cluster, and it is worse than a fictional number because it is a fictional process — a reader takes away that the project has continuous integration, which changes how they read every green tick elsewhere in the atlas.

Two of the twelve stages are additionally untethered even from the project's own intentions. Keploy replay / 8 recordings · all match and Visual snapshots / 1 baseline drift · OnboardingScreen.light describe tooling the audit does not find, and AI guardrails / 412 redteam cases · 100% block asserts a perfect block rate against a moderation layer the audit reports as failing open (S-* security findings). A board claiming a hundred per cent redteam block sits in the same file as an audit finding that moderation fails open.

What the board should show today. Keep the twelve stages, because they are the right target state, and change what the board asserts about them. Add a TRIGGER line under the title reading manual dispatch only · no push trigger · no required checks · 0 tags. Give every stage a provenance class rather than only a status: RUNS TODAY for the Dagger targets that actually execute, DEFINED · NOT TRIGGERED for Gradle tasks that exist but nothing invokes on push, and NOT BUILT for the rest. Delete every duration and replace it with an empty RunRef slot carrying EmptyReason · no run recorded. Replace 142 tests · 0 failures · 74% coverage with the module ledger the audit supports: three modules execute JVM tests, twelve of thirty have none, coverage is not measured, and a green build additionally proves app compilation plus roughly fifteen source-text conventions. That last fact — that "green" currently means something much smaller than it appears — is the most useful thing this board could tell anyone, and it is the one thing it does not say.

What it should show after L0. L0 is exactly the work that makes this board stop lying, which is a good argument for prioritising it. Afterwards the board gains four things it cannot have now: a real trigger matrix (push, pull request, tag, nightly) crossed with branch; a required-checks pane tied to branch protection, so a red stage genuinely blocks a merge; a hygiene stage group (format, licence headers, API dump and binary-compatibility validation, dependency lock, generated-code drift) which is the substance of L0 and appears nowhere in the atlas; and a tags-and-versions pane whose current honest content is zero rows. At that point started 14m ago becomes a real RunRef with a run id, and the stage durations become measurements. I would also split the board at that point: the trigger matrix, required checks, hygiene and tags belong on a new 07.05 · Ship · Continuous Integration, and 07.02 becomes the run view of one execution of the pipeline that 07.05 proves exists.

2. 06.05 as the honesty exemplar, and how to systematise it

06.05 does four things no other board in my cluster does. It declares its scope up front: DESIGN FIXTURE · synthetic + redacted shadow samples. It suffixes each aggregate individually — 141 pass · fixture, Replays · 142k · fixture, Drift-free · 99.4% · fixture — so a number cannot be lifted out of context. It names the missing plumbing in the policy line: policy · synthetic only · identifiers redacted · no production PII · adapter not wired. And it states a rule for unknowns: "aggregate green is blocked when a required harness is unknown". That fourth item is the most important sentence in the atlas about verification, and it exists only as prose on one board.

It also demonstrates precisely why hand-typed honesty fails. The discipline lapses within the same board: the third pane, CRASH GROUPS · CRASHLYTICS + SENTRY · LINKED TO ACTIVE DEPLOY, asserts 412 users · 1842 sessions, 14 sessions and 22 users with no marker at all, under a header claiming two live vendor integrations. Nothing propagated the fixture scope into that pane because nothing could — the marking is a string style, so it depends on the designer remembering. Worse, none of it is queryable: you cannot ask the atlas "show me every fixture number" or "show me every unwired adapter", which is the whole point of having a component vocabulary in the first place. And the shadow row POST /auth/google · error · 500 renders a fixture failure identically to a production incident.

How to systematise it, in five moves.

First, make the truth class a property of the number, not of the prose. Define a fixed lattice — Observed, Recorded, Derived, Fixture, NotWiredYet — and require every numeric text style in Machine Signal to carry one, the way every fill must carry a colour token. A number without a truth token should fail the design lint exactly as an off-palette hex does. That is the mechanism that turns 2.5% vocabulary usage into 100%.

Second, make the banner a propagating scope rather than a caption. A FixtureScope wrapper should mark the board's rule and render every descendant number with the fixture treatment automatically. This one change fixes 06.05's own third-pane lapse and would fix the forty-nine boards that assert five or more numbers with no provenance marker.

Third, upgrade adapter not wired from a phrase to an EmptyReason with a required "what would make this real" field. 06.05 should read adapter not wired · needs: shadow-traffic tap in reaktorServer + 1% sampler. 13.01 already says the same thing in different words (OBSERVED · UNKNOWN · live adapters absent); unify the wording so one query returns every unwired adapter in the product, which is then a build backlog.

Fourth, promote "unknown blocks green" from a sentence to the arithmetic behind every aggregate in the atlas. Under that rule, 07.02's 7/12 pass and 094's gates 9/10 both become amber, because several of their inputs are unknown rather than passing. That result is uncomfortable and correct, and it is the difference between a dashboard and evidence.

Fifth, add a FIXTURE LEDGER pane — on 06.05 first, then as a standard board footer — listing each fixture value alongside the real source that will replace it and the ticket that wires it. That converts the honesty marking from an apology into a work plan, which is the only form of honesty that gets fixed.

3. Where the verification ladder belongs

The vocabulary check confirms the ladder is genuinely absent: lincheck, fuzz, property test, model check, differential, counterexample and defect return nothing across all 104 boards; fingerprint appears twice and neither is the keystone; invariant appears twice, both in North Star boards. My cluster owns the words "validate" and "ship" and hosts none of the concepts.

Allocation. L0 belongs to Section 07 and only to Section 07, because CI, hygiene, required checks, tags and API-stability tooling are delivery mechanics. Everything above L0 is not delivery.

L1, L2 and the replay half of L5 belong in Section 06, because they are things a developer authors and runs at their desk in seconds. Invariants are written next to the node they constrain; property tests and lincheck runs are pre-push activities; and replaying one failing deterministic seed is a debugging activity for which 06.04's causal waterfall is already the right viewer.

L3 protocol model checking and L4 Lean proofs belong in neither, and neither does the standing invariant register, the defect ledger D-1…D-n, or the fingerprint keystone. These are a body of evidence with their own lifecycle — a proof stays valid until a definition changes, which is a dependency relationship, not a pipeline stage. They need a new Section 14 · Assurance with four surfaces: Invariant Register, Defect Ledger, Model Checking, and Proofs. I would not fold them into Section 03 (Govern · Extend · Scale), which is about system evolution and would swamp them, nor into Section 09 (State & Trust), which is about runtime identity and data.

The two boards I would build in my cluster.

06.06 · Validate + Source · Invariants & Counterexamples. Five panes. INVARIANT LIST scoped to the current selection, each row an INV-… with its statement in prose, the nodes it constrains, the checker that enforces it (lincheck, property, model, proof, or none), and its last run — with none as the honest majority value today. COUNTEREXAMPLE showing a minimised failing schedule or input rendered on the same waterfall grammar 06.04 uses, so a concurrency counterexample reads as an interleaving of port invocations rather than a stack trace. SHRINK HISTORY showing how the minimiser got from the original failure to the minimal case, which is what makes a property-test failure comprehensible. SEED & REPLAY with a seed, a tick count and a replay action, which is the L5 inner-loop affordance. INVARIANT COVERAGE BY MODULE, whose honest content today is that most of thirty modules have zero invariants and twelve have zero tests. This board's headline figure should be open defects by class, not a pass count — D-6 · port type identity unsound deserves to be the largest number on a Reaktor validation board.

06.07 · Validate + Runtime · Conformance & Fingerprint. Four panes. ORACLE PAIRS for Kotlin against C++ against TypeScript on FlexBuffers, which is the one place the audit says real evidence exists — a differential C++ oracle, an adversarial suite and physical-device runs. CORPUS describing the adversarial inputs, the generation strategy and the last device run with device and build named. DIVERGENCES listing input, both outputs and the byte diff. FINGERPRINT showing the keystone for the current selection: port type identity, codec layout identity and FFI method identity side by side, with a conflict marker when they disagree — which is D-6 made visible in the one place it would change behaviour. This board is what would let 13.03 · Extend · FFI Switchboard move from asserting "native parity not yet proven" to showing the proof arriving.

Finally, 06.05 needs re-scoping to make room. It currently merges required gates, shadow traffic and crash groups, three things with different owners and different truth classes. Gates and coverage stay; shadow traffic moves to a Runtime-instrument board; crash groups merge into 10.04 · Observe · Errors, which already carries the same crash under a different filename.

4. Graph code push

Section 07 does not depict code push at all, and neither does any other board. The phrase returns zero hits across all 104 boards. Hermes appears exactly once, in 05.00, as a colour in a deploy-target legend — "Every node is colored by deploy target — JVM, Worker, Web, Hermes, Native" — which acknowledges the runtime and never says what it is for. The nearest approach is 07.03's FEATURE FLAGS · CONFIG ACTOR · RUNTIME, NO REDEPLOY, and it is a different capability: a flag selects between code paths that already shipped, whereas code push replaces the paths. 07.04's Bundle #1042 · 7 commands borrows bundle language but binds it to store channels (android · Play internal, ios · TestFlight), which is the opposite arrangement.

The omission matters more than a missing feature board usually would, for two reasons. First, it is the release-management consequence of the entire thesis: if the graph is alive at runtime and subgraphs are marked, then a subgraph is the unit of release and the store binary becomes a host rather than the product. Every board in Section 07 models a release as a whole-app artefact promoted through store channels, which is the pre-graph model. Second, the atlas is already leaning on the capability without naming it — 095 claims a completed production rollout twenty-one minutes after start with TestFlight on the mobile card, which is only defensible if what shipped to mobile was a pushed bundle.

The board. 07.06 · Act + Delivery · Graph Code Push, six panes.

PUSHABLE SURFACE renders the product graph with marked subgraphs highlighted and everything else dimmed, each marked subgraph annotated with its boundary ports and the revision since which that boundary has been frozen. The central assertion of this pane is that the boundary, not the code, is what governs.

BOUNDARY CONTRACT shows, for the selected subgraph, the typed ports a pushed bundle may touch, the capabilities it may request, and the explicitly denied set — native modules, storage schema, auth. This pane must display the port fingerprint, and today it must display it as unsound: with D-6 open, string-built ports carry a null class, so the boundary check that governs what a pushed bundle may touch does not currently hold. One honest row here makes the case for the fingerprint keystone more forcefully than any assurance board could.

BUNDLE carries bundle id, size, Hermes bytecode version, source graph revision, signature, compatible host binary versions, and the target engine per platform — including the honest answer for JVM and Native, where there is no JS engine, expressed as a capability tier: code push: full / flags-only / none. This is where the adapter-and-capability idea earns its place in Section 07.

ROLLOUT shows staged exposure by cohort with the distinction the docs demand. A pushed bundle's activation is a remote outcome the server cannot observe directly, so this pane shows four separate device-side counts — pushed, fetched, activated, reverted — plus unknown as a first-class fifth value, never a single "deployed" percentage.

REVERT shows the pinned last-good bundle, the automatic revert-on-crash-rate rule with its threshold, and the case that must be visible: the offline device still running the bad bundle, counted as unknown rather than as reverted.

APPROVAL reuses 07.04's receipt verbatim, because a code push is a production change with a smaller blast radius rather than a lesser one, plus a store-policy row recording what platform rules permit to be pushed.

The board opens today under a NOT BUILT banner naming the five missing pieces — subgraph marking, bundle format, host loader, boundary enforcement, revert — which makes it a Vision board and an unusually specific roadmap.

5. Are these the right five deploy states?

They are the right skeleton and the wrong set. The five cover blocked, confirm-rollback, rolling out, complete, recovered — one failure and four points on a clean path. The states that a five-target polyglot system spends most of its time in are missing.

Missing state: partially applied. The five targets deploy independently. Workers can succeed while the k3s image fails and mobile sits in review. There is no board for "three of five targets on rc-812, two on rc-811", and given the audit's finding that the distributed plane has no queues at all and every pipeline is waitUntil fire-and-forget, partial application is not an edge case — it is the expected outcome of any multi-target deploy. This is the most consequential gap in the set.

Missing state: outcome unknown. The docs say the system should not pretend it knows a remote outcome. Every one of these five states resolves. There is no board where a target's result never came back and the system says so.

Missing state: rollback not possible. The audit says rollback is only sometimes possible. The set contains a rollback confirmation and a recovery success, and nothing for the case where the plan's +1 schema field has been written against for forty-one minutes and the honest answer is "you can roll back the workers, you cannot roll back the data, here is the choice you actually have".

Missing state: awaiting store review. Mobile appears on all five boards as android · Play internal / ios · TestFlight, and no state acknowledges that mobile's clock runs in days.

The receipt chain. The Symphony Contract promises that human and agent changes share one patch → plan → receipt path. The receipt appears exactly once in my cluster, on 07.04: PlanApproved / plan_8dd4 · actor alice · approver bob / independent · expires 9m / sha256:8dd4…c11a · reason attached · rollback proven · one use. That is well designed — independence, expiry and single use are the three properties an approval object needs. It then vanishes. 094, 095 and 096 never say which receipt authorised the rollout that is running, completed or was reversed; 096 says incident evidence sealed with no hash, principal or link. 093 promises that "Human confirmation emits a typed rollback command with identity, reason, graph diff, restore point, and resulting audit evidence" and provides no field to type the reason into, no principal beyond an SP avatar, and no approver at all — so the most irreversible action in the product has the weakest approval chain in the cluster. The chain therefore breaks at exactly the point it exists to protect. The fix is a persistent receipt rail on all five states showing the receipt that authorised the current state with its principal, approver, expiry and single-use status, and on 093 a required free-text reason bound into the hash preimage before ROLL BACK RC-811 becomes enabled.

Is rollback depicted honestly? No, in three specific ways. 093 asserts 0 data loss and ~4m estimate as flat facts about a plan containing a forward schema change, and 096 ticks Reverse migrations ✓ 42s against a migration 07.02 describes as touching 4.2M rows. 093 says 12 targets where 07.04 says five. And 093 proposes restoring rc-810 as verified · healthy while four other boards in the same cluster record rc-810 — same sha, 4f81dc0 — as rolled back · 1d ago · eval 0.82 · gates 7/10. A rollback dialog offering a known-bad release as the healthy restore point is the precise failure the atlas exists to prevent, and it is drawn in the atlas.

The one honest note in the whole rollback story is 096's Mobile channel reset, which quietly concedes that mobile is reverted by changing what is served rather than by un-installing anything. That concession should be promoted into the design: per-target reversibility on every rollback surface, with three values — revertible, partially revertible, not revertible — and an explicit unknown for anything remote.

Cluster findings

Missing panes.

• 07.05 · Ship · Continuous Integration — trigger matrix, required checks, hygiene gates, tags and a first-green ledger per module. §2 says no CI exists, no tags and no API-stability tooling, and the atlas currently has no surface where that absence is visible; 07.02 actively conceals it.
• 07.06 · Act + Delivery · Graph Code Push — §1 names graph code push a load-bearing capability and the atlas mentions it zero times, while 095 implicitly depends on it to claim a twenty-one-minute mobile production rollout.
• 06.06 · Validate + Source · Invariants & Counterexamples — hosts L1, L2 and L5 replay. §3 of the brief records that lincheck, property test, counterexample and defect each appear zero times atlas-wide.
• 06.07 · Validate + Runtime · Conformance & Fingerprint — hosts the differential oracle, which §2 identifies as the project's only genuinely strong evidence, and the fingerprint keystone that unifies port type, codec layout and FFI method identity.
• STATE · Deploy · Partially Applied — five targets deploy independently and §2 says the distributed plane has no queues, so partial application is the default outcome and is not drawn anywhere.
• STATE · Deploy · Outcome Unknown — the rule that the system must not pretend to know a remote outcome has no depiction; every existing state resolves.
• STATE · Deploy · Rollback Not Possible — §2 says rollback is only sometimes possible; the cluster only draws rollback succeeding in ninety seconds with zero data loss.
• 07.07 · Ship · Store Channels & Review — mobile is on every target card as Play internal and TestFlight while four boards claim production completion in minutes; store review is the one deploy constraint no gate can compress.
• A board behind the Logs tab. All nine Section 06 and 07 boards render the sub-nav Preview · Devices · Testing · Pipeline · Releases · Recorder · Traces · Logs · Source, and Logs leads nowhere; Testing leads to 06.05, which is breadcrumbed under delivery rather than interface, so the tab and the board disagree about where it lives.

Seams.

The cluster contains two different sub-navigations and swaps between them without warning. 06.01–06.05 and 07.01–07.03 use the delivery set (Preview · Devices · Testing · Pipeline · Releases · Recorder · Traces · Logs · Source); 07.04 and the four full-shell deploy states use the runtime set (Resources · Operations · Deploy · Pipeline · Runs · Cost) borrowed from 13.01. The word Pipeline appears in both sets meaning two different things, and moving from 07.03 to 07.04 silently replaces the entire navigation the user was using.

One release candidate has two incompatible pipelines. 07.02 shows twelve stages including Unit tests / 142 tests and Maestro flows / 21/22; 07.04 and all four full-shell states show eleven steps including Unit · 1,284 and Maestro · 14/14, and 092 shows Maestro · 12/14. Same rc-812, three Maestro denominators and two unit-test counts. Neither list mentions the other exists.

Two version namespaces coexist. 07.03 uses v811 / v812 / v813-rc; everything else uses rc-810 / rc-811 / rc-812. 07.04 contains both, with Rollback to v811 eight lines above rc-811 · production.

Gate denominators disagree with gate lists. Every releases row reports gates 10/10, gates 9/10 or gates 7/10 while the gate list on the same board has eleven rows and the header counts eleven steps.

093 changes application shell mid-flow, nesting a second R Reaktor / bestbuds / PRODUCTION frame with a Problems 1 · Output · Audit bar inside the studio chrome. It also rolls back a different release (rc-811 → rc-810) from the one the surrounding states are about (rc-812 → rc-811), and offers as verified · healthy a release the other four states record as rolled back.

The receipt appears once and disappears where it matters, and the board revision never connects to the release revision: all fourteen boards carry main@8f41c2 in the chrome while releases carry b81230f, 4f81dc0 and a4f12c8. The contract's promise that revision survives every movement is drawn in the chrome and not wired to the content.

Agent affordances stop at the section boundary. Propose with Agent on 06.01 and Send to Agent on 06.05 are the only two in fourteen boards; nothing in Section 07 or any deploy state admits an agent exists. That may be correct policy for irreversible actions, but the boards should show the lock as a permission chip rather than expressing it by omission.

Crash-group identity differs across boards: 06.05 says ChatScreen.kt:142 and 10.04 says ChatActor.kt:142 for the same NullPointerException in the same release.

06.02's storyboard shows six screens and its coverage pane lists five; /friends/{id} has no coverage row, so the board's own honesty about untested routes stops one route short.

Finally, every board's status bar reads source projection · designed, policy required and performance · unmeasured, which is honest, while panes inside those same boards read LIVE · runtime · 2s and observed preview. The chrome tells the truth and the content contradicts it, on the same screen, fourteen times.

Honesty audit.

Ten of fourteen boards assert substantial unmarked invented data. 06.01 stamps two panes LIVE · runtime · 2s and captions a third observed preview ... fresh 2s on a board whose own header says projection: designed; the honest version marks the component tree DERIVED · source — it is computable today — and marks 142 ms and 72ms as NOT WIRED · no span adapter. 06.02 presents per-route traffic (8.2k, 12k, 24k, 5.3k, 4.1k) as fact for an app in internal testing with no analytics adapter; the honest version keeps the route topology as derived, moves traffic to a column with an explicit unwired state, and derives flow coverage from the Maestro files that do exist — which would show far more red. 06.03 presents rec_0042 and eleven captured steps with no marking at all and no evidence a recorder exists. 06.04 asserts a seven-span waterfall and provider=apple · session issued · 201 with no span collector behind it, and contradicts itself on module count (5 modules in the pane, 6 modules in the footer); its blast radius, by contrast, is genuinely computable and should be marked derived, splitting the board honestly in half.

06.05 is mostly honest and loses the thread in its third pane, where 412 users · 1842 sessions sits unmarked under a header claiming Crashlytics and Sentry are linked to the active deploy. 07.01 asserts hot reloads identically on five structurally different platforms; the honest version is a capability tier per device, which is also the version the vision demands. 07.02 is the least honest board in the cluster and the reasons are set out above. 07.03 asserts crash-free 99.4% · p95 61ms, 412 ev, retention −3.1pt and served 8d with no crash or analytics adapter, and describes an automated production intervention (guardrail auto-kill) with no visible rule.

Among the deploy states, 092 is the most honest — blast radius · not evaluated is a model refusal — while 093 asserts 0 data loss, ~4m estimate and 12 targets, and 096 asserts Reverse migrations ✓ 42s, 6 recovery steps over an eight-row list, and incident evidence sealed with no artefact. 095 claims all targets promoted on a screen that also says Play internal and TestFlight.

One structural tell runs through all of it. The digits 42 and 142 recur far past coincidence: 142 ms trace total, AuthService 142ms, 142 tests, migration 142ms, 142k replays, POST /chat/sync 142ms, ChatScreen.kt:142, 142 friends, 412 users, 412 ev, 412 redteam cases, rec_0042, 00:42, migration 0042, 42s three times, Errors · 42, 42/60 checks. These are one designer's house numbers reused as if measured, which is a useful diagnostic: wherever the same figure appears in unrelated units, no adapter was ever consulted. A FixtureScope that propagates and a truth token required on every numeric style would surface all of it mechanically, and would turn the atlas's most persuasive quality — that it looks like a real product — from a liability back into an asset.

Part 9 · Section 08 and 12 — Agent Operations and AI Engineering

Twelve boards: 08.01–08.05, 12.01–12.07. Cross-read for context: 01.04 Agent OS, 03.01 Visitor Lab, 04.02 Semantic Graph Editor, 07.04 Deployment Plan & Gates, 09.05 Governed Migrations, 10.01 Spans & eBPF, 11.04 Optimize Costs, and the two section covers.

0. The two planes, and which board belongs to which

There are indeed two different products in this cluster, and the atlas does not separate them cleanly.

Plane (a) — agents that operate on Reaktor. An AI reads the live graph, proposes a typed patch, and a human or a policy gates it. Boards: 08.01, 08.02, 08.03, 08.04, 08.05. The capability grammar for this plane does not live in section 08 at all — it lives in 03.01 Govern · Visitor Lab, which is the only board anywhere that names a principal (agent:codex · role:graph-auditor · session scoped), an allow set, a preview-only set, and a denied set (apply · deploy · secret access · self-approval), with capability expires with session.

Plane (b) — AI features inside a product built with Reaktor. Model routing, RAG, prompts, evals, guardrails for the app a customer ships. Boards: 12.02, 12.03, 12.04, 12.05, 12.07.

The conflation is real and it is concentrated in 12.01. That board's model roster is plane (a) spend: codex-5 · implementation · push+apply+tests · $61 · 24h, claude-sonnet-4.7 · critic · review-only · blocks apply · $38 · 24h, gemini-2.5-pro · cross-codebase ops · dep bumps · $19 · 24h. Those are the agents from 08.02's filter chips (claude codex gemini shepherd), priced on an AI-engineering board, and their spend is rolled into the same $124 · 24h chip as the product's llama-guard-3-8b moderation gate. One board, one budget line, two planes. 12.06 leaks the other way: its ask · sonnet-5 · grounded in cells 1–2 cell drafts SetProperty(matching.threshold, 0.68), which is a plane-(a) mutation proposal sitting in a plane-(b) section.

12.06 is in fact a third thing. Its content is product analytics — SQL over matches JOIN outcomes, a threshold knee study, a retention chart. Only one of its three cells is AI. It belongs with 11.05 Reports and 09.04 Data Studio.

Is the split coherent, and should both live in one atlas? They should live in one atlas, because both are governed change over one graph and the atlas's whole argument is that there is only one governance path. But they should not be two peer sections of equal weight. Plane (a) is who may change the system and how — it is a governance concern and belongs adjacent to 03 Govern, 04 Graph and 07 Ship, sharing their plan-and-receipt objects. Plane (b) is a subsystem of a product like any other, and 12.03 makes the argument for dissolving its own section: "chain = graph nodes · same command grammar as everything else / AddChainNode / ConnectPorts / SetProperty — reviewable, hot-swapped". If that sentence is true, an LLM chain does not need its own IDE any more than a repository does. Section 12 should be 04 (graph), 10 (observe) and 11 (learn) filtered to kind:llm, not a parallel studio with its own twelve-tab chrome, its own trace board, its own cost tiles and its own notebook list. Keeping it as a separate section is the atlas conceding that AI is special, which is the opposite of the thesis.

Board entries

08.01 · Agent · Conductor, Session & Critic

On the board. This uses the four-quadrant SCOPES & QUERIES shell from the 04-series, not section 08's tab strip. The four panes are HUMAN INTENT (goal · constraints · target · authority), AGENT WORK (investigation · patch · tests · evidence), CRITIC (challenge · findings · required proof · verdict) and GOVERNED RUN (plan · approval · progress · verification · receipt), under the banner SESSION PLANE · PROPOSAL ONLY. Beneath sit EVIDENCE & FINDINGS (12 findings · 3 blocking, with Conflict / Unknown / Impact / Policy rows), SELECTED PATH (Intent → proposal → critic → approval → run → verified receipt) and a SELECTION INSPECTOR reading Session / auth-hardening · 12 commands proposed · 0 applied · independent review required with Truth SOURCE, Effect READ ONLY, Permission APPROVAL REQUIRED.

Vision tie. Agents as first-class operators, and visitors. It states the separation of authority correctly in words — propose, critique, approve, run, receipt — but it depicts a policy diagram, not an instrument. Four labelled boxes with subtitles carry no session content: no intent text, no patch, no finding, no verdict.

Workflow tie. A senior engineer opens this after delegating a hardening epic, wanting one pane that shows what the agent did and whether the critic cleared it. Today that is a Claude Code transcript in one terminal, a GitHub PR in a browser tab, and a Slack thread, with no shared object between them.

Agentic tie. An agent reads nothing here, because nothing is enumerable. The thing it should read is the critic's required proof as a machine-checkable obligation set — a list of proofs it must produce before the plan seals. As drawn, "required proof" is a subtitle.

Blueprint tie. Closest to a code-review gate on a Blueprint changelist rather than to any Unreal surface. Unreal has no critic and no notion of a non-human author, so the analogy breaks at exactly the point this board is about.

Replaces / augments. Claude Code and Cursor agent transcripts, GitHub PR review, Devin's session view, Linear issue detail.

Improvements.

1. Replace the four static quadrants with a SESSION TIMELINE pane: columns Time / Actor / Act / Effect / Evidence, reusing 08.05's audit row shape so one row type serves both boards.
2. Add a PATCH pane that renders the "12 commands proposed" with before/after values and a plan_xxxx chip, so "0 applied" becomes inspectable rather than asserted.
3. Turn CRITIC into a CRITIC OBLIGATIONS list: each finding as a proof obligation with state unmet / met / waived, each met one linking to the run that satisfied it.
4. Add an INTERRUPT & STEER control with a reason field. Every competing agent product has stop-and-redirect; nothing in section 08 does.
5. Change Truth: SOURCE to UNKNOWN · not wired to match 01.04, and drop Confidence 1.0 / exact while the same board's findings block says Unknown · Runtime observation is not wired.
6. Replace the shared 12 findings · 3 blocking / 14 tests · 3 deploy targets chrome with counts belonging to this session.

Verdict. Rebuild as a session transcript. As drawn it is 01.04 North Star · Agent OS with four subtitles reworded, one banner changed and the truth mark downgraded from honest to false.

08.02 · Agents · Kanban Orchestration

On the board. Section 08's tab strip (Chat · Kanban · Tasks DAG · Agents · Pipeline · MCP · Memory · Runbooks · Audit), a title reading Kanban · multi-agent orchestration · 14/16 cards · 7 agents, filter chips all / claude / codex / gemini / shepherd, a + New card control, and six columns: BACKLOG 3, PLANNING 2, IN PROGRESS 3, REVIEW 2, BLOCKED 1, DONE 3. Each card carries a type tag (test, perf, sre, refactor, investigate, bug, deploy, analysis, review, guard, feature), a title, an owner and an age or condition — for example bug · Fix cf.workers/auth compile · missing AuthAction import · codex · P0 and deploy · Widen rc-812 canary 5% → 25% · shepherd · after k.7.

Vision tie. Weak. Nothing here is graph-typed; strip the owner names and this is Jira. The single Reaktor-flavoured touch is that card subjects name graph entities (cf.workers/auth, sb.pg/messages, SessionPayload codec), which hints at a link that is never drawn.

Workflow tie. Monday standup, and any moment someone asks what the agents are doing. Today: a Linear board plus N terminal tabs plus Devin's session list, with the true state living in none of them.

Agentic tie. Agent-hostile in an instructive way — it is a board about agents that an agent cannot use. There is no claim or lease, no priority function, no capability check at card level, no budget. An agent approaching this board cannot answer the only question it has: may I take this card, with what authority, in which worktree, spending what.

Blueprint tie. None. This is the project tracker beside the editor. The nearest Unreal object is the build farm's job queue.

Replaces / augments. Linear, Jira, GitHub Projects, Devin's session list.

Improvements.

1. Add a CLAIM / LEASE state per card: owning principal, lease expiry, and a Release control, so two agents cannot take one card and a dead agent's card returns to the pool.
2. Add a BUDGET column per card (tokens, wall clock, dollars) that rolls up to the epic cap 08.03 already invents (4.2M tok used / 10M epic cap).
3. Add an EFFECT CEILING chip to every card — read-only, sandbox, staged, production. Today Widen rc-812 canary 5% → 25% sits in the same column, in the same visual weight, as a read-only cost investigation.
4. Give each card a plan_xxxx chip that opens 07.04's sealed plan. This is the single missing link between the agent plane and the deploy plane.
5. Reconcile 14/16 cards · 7 agents with the fourteen cards and eight distinct owners actually drawn (codex, datasci, sre bot, gemini, claude, shepherd, critic, sre), and make the filter chips the real roster rather than four of eight.
6. Replace prose blockers with a BLOCKED-REASON class (needs-human-scope, needs-credential, flaky-repro) so an escalation can be routed automatically; repro iOS 18.1 only is a sentence, not a state.

Verdict. Merge into 08.03. Kanban columns and DAG nodes are the same task objects in two projections and should be one board with a Board / DAG / Timeline toggle.

08.03 · Agents · Tasks DAG

On the board. An EPIC · AUTH-HARDENING · DEPENDENCY DAG · CRITICAL PATH HIGHLIGHTED with seven nodes T-101 to T-107, each carrying an assignee and a state — T-103 · MFA enforce admin+mod · @agent claude · in progress 64%, T-105 · pen-test simulator suite · BLOCKED by T-103, T-106 · rollout staging→prod · gate: security scan clean, T-107 · postmortem + runbook · auto-drafts from audit log. A legend covers done / in progress / review / blocked / queued, and a critical-path line reads T-101 → T-103 → T-105 → T-106 · slack 0d · epic ETA Jul 18. Three side panels follow: WORKTREES (codex/auth-mfa · 14 files · +812 −204, claude/critic-pass · read-only, main · protected · merge via review), GATES (security scan · queued after T-103, maestro auth flows · 21/22 green, human approval · @shibasis pending) and ESCALATIONS (T-105 blocked 2d · agent asked for pen-test scope, budget: 4.2M tok used / 10M epic cap, no destructive commands attempted).

Vision tie. Choreography and orchestration, lifted from runtime sagas to units of work, plus the strongest embodiment of governed autonomy anywhere in the cluster. Worktree isolation, a gate list, a token budget cap and a standing "no destructive commands attempted" receipt are four real governance primitives on one board, and three of them appear nowhere else in the atlas.

Workflow tie. The lead's Tuesday view — will the epic land, and what is the agent stuck on. It is also the escalation surface: an agent has been blocked two days asking for pen-test scope, and no other board can answer it.

Agentic tie. The most agent-readable board in the cluster. An agent can read its own blocker, its remaining budget and the gate it must satisfy, and could propose a decomposition of a task into sub-tasks. What is missing is the return leg: a task should carry the capability grant it was issued under, so the agent knows what it may attempt without asking.

Blueprint tie. The build/cook pipeline's dependency graph. The analogy is close in shape and breaks in tempo — Unreal's task graph is machine-scheduled per frame, this is human-scale with human gates.

Replaces / augments. Linear cycles and dependencies, GitHub Projects roadmap, Devin's plan view, and the human-in-the-loop parts of Temporal or Airflow.

Improvements.

1. Make ESCALATIONS actionable. agent asked for pen-test scope should be a request-for-capability row with Grant / Deny / Narrow controls that mint a scoped, expiring, non-delegable capability. This is the one place in the atlas where "locks on the right doors" gets a key-cutting surface.
2. Absorb 08.02 as a second projection of the same task objects.
3. Add a per-task BUDGET burn, not just the epic roll-up, so a runaway task is visible before the cap.
4. Give each worktree its proposal state: which sealed plan, which base revision, and whether the base has drifted since (04.02 says drift invalidates approval — this is where drift becomes visible).
5. Point gate: security scan clean at the actual gate row in 07.04's validation list so one gate object serves both boards instead of two boards naming the same gate independently.
6. Mark in progress 64% and epic ETA Jul 18 as estimates with a stated basis, or remove them; a percentage-complete on agent work has no defensible derivation.

Verdict. Strengthen, and absorb 08.02 into it. This is the second board to build.

08.04 · Agents · MCP & Memory

On the board. Two panes. MCP SERVERS · TOOLS EXPOSED TO AGENTS lists six servers with tool names, call rates and a prose shield: reaktor-graph · graph.query · graph.command · lineage · 42 calls/h · ⛨ every mutation = typed command w/ review gate; reaktor-db · sql.read · schema.describe · 18 calls/h · ⛨ writes DENIED · read-only role; reaktor-telemetry · traces.search · metrics.query · 31 calls/h with no shield at all; maestro-runner · flows.run · flows.record · 6 calls/h · ⛨ device farm quota 4 parallel; github · pr.create · pr.review · checks · 12 calls/h · ⛨ merge blocked · human approves; pencil-design · batch_design · screenshot · 2 calls/h · ⛨ active-editor only · filePath ignored. AGENT MEMORY · 214 FACTS · GRAPH-LINKED lists six typed facts (project, feedback, decision, gotcha) each anchored to a graph node (→ auth.provider, global, → testing, ADR-014, build, → chat.actor), closing with facts link to graph nodes · stale facts flagged when node changes.

Vision tie. This is the board that must carry the atlas's strongest strategic claim, and it argues the opposite case. It renders Reaktor as one MCP server among six, listing reaktor-graph in the same column, same row shape and same units as github and pencil-design. If Reaktor is a doorway in the same corridor as GitHub's doorway, there is no floor plan — the board concedes the argument in its layout before its shields can make it. The memory pane is the redeeming half and is genuinely novel: facts anchored to graph nodes, with staleness driven by node change, is something no competitor does. That one line deserves an entire board.

Workflow tie. Opened when an agent did something surprising and someone asks what it could even see, and when onboarding a new agent to a repository.

Agentic tie. An agent reads a tool list and a fact list. It cannot read which scopes it currently holds, when they expire, what a rejected call would say, or which calls are proposals versus executions. The ⛨ shields are prose for humans — writes DENIED · read-only role is not a machine-readable policy an agent can plan against, and reaktor-telemetry has no shield at all, which reads as an oversight rather than a decision.

Blueprint tie. Drawn as a plugin manager. It should be Unreal's reflection system: the editor introspects UCLASS/UPROPERTY to build its panels generically, and an agent on Reaktor should introspect the typed port graph the same way rather than calling a fixed list of seven verbs.

Replaces / augments. .mcp.json server configuration, Cursor rules and CLAUDE.md, Devin's Wiki, LangChain tool registries.

Improvements. Rebuild as five panes; the full design is in section D below. In short: SURFACE CATALOG (a queryable, fingerprinted enumeration of node kinds and port contracts, not a tool list), SUBSCRIPTIONS (event masks with credits and drop counts), PROPOSAL BROKER (patch in, plan or typed reason code out), CAPABILITY GRANT (principal × scope × verb class × effect ceiling × expiry × delegation), RECEIPT (07.04's object, returned to the agent). Beyond that: demote the six MCP servers to an ADAPTERS row beneath the native surface and retitle the pane so MCP is an adapter rather than the frame; add a D-6 column to the catalog naming which ports carry no class identity, since an agent that assumes port type soundness will propose patches that compile and misconnect; and give each memory fact a SourceRef and FreshnessStamp, showing the count of currently-stale facts rather than only the total 214.

Verdict. Rebuild. This is the most important board in my cluster and the furthest below its own brief.

08.05 · Agents · Runbooks & Audit

On the board. Three runbooks with triggers, numbered steps and last-run outcomes: incident/chat-latency-spike (trigger alert p95 > 200ms · 5m, six steps from ack + page @oncall through rollback? → needs human yes to draft postmortem from audit, last run 2h ago · auto-resolved 14m); deploy/rollback-prod (trigger: manual · @oncall only, four steps, last run 12d ago · 4m); db/failover-drill (trigger: cron monthly, four steps, passed Jun 30 · RTO 41s). Then AUDIT LOG · EVERY ACTOR, EVERY COMMAND · 90D · EXPORT with eight rows in which humans, agents, a critic, a guardrail and the system are peers — @shibasis approved cmd #14 · SetProperty ChatActor.initialState · applied · hot-reloaded, @claude · critic proposed cmd #14 after NPE root-cause · evidence: 412 events · v812 only, guardrail auto-killed experiment circle-size-9 · retention −3.1pt > 2pt limit, @claude · critic BLOCKED cmd #11 · DropIndex ix_msg_room · still used by chat.query p95 path, system adjusted telemetry tail-sample 10% → 15% · error-window rule · reverts 18:00.

Vision tie. Visitors and governed change, and the best single artifact in the cluster. One ledger where a human, an agent, a critic, a guardrail and the system all appear as actors with the same row schema is a genuinely new object. The critic row is the entire thesis compressed into one line: an agent blocked a DropIndex because the graph knew that index was on the chat.query p95 path. That is impact analysis only a live typed graph can perform, and it is the most persuasive sentence in the atlas.

Workflow tie. Incident review, compliance export, and the Friday "what changed this week" read. Today this is PagerDuty runbooks, a Datadog audit trail, a GitHub audit log and Slack scrollback, four logs with four schemas and no join key.

Agentic tie. An agent reads this to learn precedent — what has been allowed, what was blocked and why — and the board already assigns it the drafting job (draft postmortem from audit). It should also be queryable: "show every DropIndex I proposed that was blocked, and the reason", which is how an agent stops repeating a rejected proposal.

Blueprint tie. The build/cook log fused with the editor's undo history. Unreal has nothing that records a designer, a script and a safety rule in one ledger, so this is the analogy's most favourable point for Reaktor.

Replaces / augments. PagerDuty and Rundeck runbooks, Datadog and GitHub audit logs, Backstage, the Kubernetes event log, Slack incident channels.

Improvements.

1. Give every audit row a plan_xxxx / receipt chip so cmd #14 resolves to a sealed plan and its sha256. Today the agent plane approves commands while the deploy plane approves bundles, and nothing reconciles the two units.
2. Add an ACTOR CLASS column (human / agent / critic / guardrail / system) as a first-class filter, because cross-class comparison is what makes this log valuable.
3. Make each runbook step declare its effect ceiling and required capability, so rollback? → needs human yes becomes a policy row an agent can evaluate rather than prose it must parse.
4. Add a REVERSIBILITY column: inverse patch available or not, at the current revision. 04.02 promises commits use inverse patches; this is the board where that promise pays out.
5. Put a query bar over the log using the same kind: owner: truth: path: grammar as the omnibox, so the audit is searched the way the graph is.
6. Relabel the run outcomes (auto-resolved 14m, RTO 41s, tests 142/142) as fixtures. The runbook steps are honest design; the outcomes describe runs that never happened.

Verdict. Keep, and build first. It is the highest-value, lowest-fabrication board of the twelve.

12.01 · AI · Models & Operators

On the board. A mega-board titled AI Studio — prompts, chains, evals, guardrails, cost with the twelve-tab section-12 strip and a $124 · 24h · -$11 chip. It contains, in one screen: two notebook cards (Friend rec quality · 2026 Q2 · success · 42 cells · 12 runs, LLM cost attribution by user · running · finding: 1% of users → 31.4% of cost) with + New notebook · kernel; EVALS · GATE THE NEXT AI RELEASE (recommendation_quality 0.91 ↑, hallucination 0.94 ↑, safety_policy 0.99, json_schema 0.96 ↑, latency_budget 0.82 ↓ REGRESS); a prompt editor for ai:prompt.recommendFriends · v12 · production with Variables · 2, Attach context, model: fast-default and Run; RETRIEVED CONTEXT with five scored sources; OUTPUT · STREAMING with guardrails · pass, schema · valid, a JSON body and 1.4k → 0.8k tok · 820ms · $0.0024 · eval 0.92; a four-model roster; and GUARDRAILS · 24H (PII redaction · 4 violations, jailbreak detector · 12, toxicity · 2, secrets · 0, human-approval queue · 0, 412 red-team cases · 100% block).

Vision tie. Weak, and the board knows it should be stronger — its subtitle promises "every call typed, budgeted, guarded and attributable to a graph entity" and not one graph entity is named on any pane. Strip the subtitle and this is a competent LangSmith clone.

Workflow tie. An AI engineer's daily driver. Today: LangSmith plus a provider console plus a spreadsheet.

Agentic tie. Readable, not actionable. Nothing on this board is a command, in contrast to 12.05's PromoteChain and 12.03's AddChainNode / ConnectPorts / SetProperty. An agent can observe an eval regression here and has no verb with which to respond.

Blueprint tie. The content browser for AI assets — prompts, models, evals as browsable items with metadata. Not the graph editor, and not the profiler.

Replaces / augments. LangSmith, Weights & Biases Weave, Braintrust, Humanloop, the OpenAI and Anthropic consoles.

Improvements.

1. Split out the model roster. codex-5 · implementation · push+apply+tests, claude-sonnet-4.7 · critic · review-only · blocks apply and gemini-2.5-pro · cross-codebase ops are section-08 operators with section-08 spend; move them to a new 08.06 Agent Fleet & Budget and leave 12.01 the product's models.
2. Delete the notebook cards and eval tiles, which are 12.06's and 12.05's content with different numbers — and where they differ they contradict: latency_budget 0.82 ↓ REGRESS here against latency_budget 0.96 there, on the same revision 8f41c2.
3. Rename hallucination 0.94 ↑ to groundedness to match 12.05. A defect metric carrying an up-is-good arrow is a chart that lies about its own direction.
4. Add a GRAPH ENTITY column to every row — which node consumes this prompt, which port carries its output, which actor called it. That column is the only thing that would distinguish this board from LangSmith.
5. Apply 12.03's DESIGN FIXTURE band to the whole board.

Verdict. Split into 08.06 Agent Fleet & Budget plus a slimmed 12.01 AI Playground. The remainder duplicates four sibling boards.

12.02 · AI · Models & Routing

On the board. MODEL REGISTRY · TRAFFIC LAST 24H with four rows carrying role, price, latency and traffic share (claude-sonnet-5 · primary · chat + chains · $3 / $15 per Mtok · p50 1.2s · 62%; claude-haiku-4-5 · router · drafts · young circles · $0.80 / $4 · p50 180ms · 31%; workers-ai · llama-3.3-70b · moderation fallback · $0.10 flat · p50 340ms · 6%; workers-ai · bge-base · embeddings · $0.02 / Mtok · 4ms / doc · 1%). Then ROUTING RULES · EVALUATED TOP-DOWN · EACH RULE = A GRAPH COMMAND with four rules, each with a condition, a target and a rationale — including circle.age < 4d ∧ intent = icebreaker → haiku-4-5 · optimizer rule · saves $31/mo · quality Δ 0.02. A fallback line reads sonnet-5 → haiku-4-5 → llama (on 429/529 · 3 retries · jitter) · last triggered 4d ago · 0 dropped requests. HEALTH · LAST 24H closes with six tiles including cache hit 62% · saves $41/d and cost / day $118 · trending +9%.

Vision tie. The claim that each routing rule is a graph command is a genuine tie to the eigenvector-primitives idea: a router is not a special subsystem, it is typed conditions on a node. But the board never shows a rule in command form, so the claim is a caption rather than a demonstration. The deeper missed tie is adapter and capability — routing on model name is what everyone does; routing on capability tier is what Reaktor's own vision argues for.

Workflow tie. Opened when the AI bill jumps or a provider degrades. Today: a hand-rolled router in application code, provider status pages, and a cost dashboard that cannot explain itself.

Agentic tie. The best place in section 12 for an agent to earn its keep — propose a routing rule, back it with an eval delta and a cost delta, and let it be gated. Rule 2 is literally that proposal. But 11.04 shows the identical proposal as not yet applied (apply as command RouteModel(budbot.icebreaker, haiku, cond: circle.age<4d)) while this board shows it as live rule 2. Two boards on one revision disagree about whether a change shipped.

Blueprint tie. The platform / RHI abstraction — one call routed to different backends according to declared capability. This is the closest section-12 board to Unreal's actual architecture and it does not claim the resemblance.

Replaces / augments. LiteLLM, OpenRouter, Portkey, Cloudflare AI Gateway, Helicone.

Improvements.

1. Render each rule in its command form with an Edit as command control that opens the sealed-plan flow, delivering on EACH RULE = A GRAPH COMMAND instead of asserting it.
2. Add a CAPABILITY TIER column to the registry (tool use, JSON mode, 200k context, vision, on-device) and let rules branch on tier rather than model id. Product code branching on capability rather than platform is §1's rule; this is that rule applied to models, and it is the board's strongest available differentiator.
3. Add a SHADOW column: what the rule would have routed over the last window and what that would have cost, so a rule change is evaluable before approval rather than after.
4. Reconcile the cost figure with 11.04 and 12.01. $118 appears here as a daily cost and on 11.04 as claude api · budbot chains $118.00 for the month to date. One of those is wrong by a factor of thirty.
5. Give provider prices a SourceRef and an as-of date. They are the only externally verifiable numbers on the board and currently carry no more provenance than the invented ones.
6. Replace last triggered 4d ago · 0 dropped requests with a fallback timeline, since the interesting question during an incident is the shape of the degradation, not its age.

Verdict. Strengthen. It has the clearest reason to exist in section 12, but its health and cost tiles must merge with 11.04 rather than restate them differently.

12.03 · Map + Intelligence · Governed Chain Builder

On the board. The honest board. A banner reads DESIGN FIXTURE · desired chain budbot-icebreaker@v7 · not released, with Run eval plan and Review release plan controls. An eight-node left-to-right chain follows: INPUT (user message + circle context), GUARD·in (pii-redact · 0.2ms · pass 100%), ROUTER (intent classify · haiku · 120ms), RAG (profiles index · top-8 · 0.74 recall), TOOL (suggestActivity() · MCP · 340ms), LLM (claude-sonnet-5 · 1.2s · 812→214 tok), GUARD·out (toxicity + brand · 8ms · block 0.3%), OUTPUT (→ chat.actor · stream 34 tok/s), captioned chain = graph nodes · same command grammar as everything else / AddChainNode / ConnectPorts / SetProperty — reviewable, hot-swapped. Below, DESIGN FIXTURE · SAMPLE RUN · tr_ai_4f21 gives six metric tiles and a sample output string.

Vision tie. The strongest in section 12 and among the strongest in the cluster. It states the thesis outright — an AI chain is not a special artifact, it is nodes and ports under one command grammar — and it labels its own numbers as fixture twice, which is precisely what §2's evidence standard asks for.

Workflow tie. Designing or changing a product AI feature, and the review moment before a chain ships.

Agentic tie. Excellent. The chain is enumerable, the mutation verbs are named, and reviewable, hot-swapped implies proposal then approval. An agent proposing AddChainNode meets the same gate as any other node change, which is exactly the property the whole atlas is selling.

Blueprint tie. This is the Blueprint graph editor, applied to an LLM pipeline. The truest analogy in section 12.

Replaces / augments. LangGraph and LCEL editors, Flowise, Dify, Vertex AI pipelines, n8n AI chains.

Improvements.

1. Show the port contracts on the wires. Today the nodes are boxes joined by arrows with prose beneath; a typed chain (Message → RedactedMessage → Intent → Context[] → ToolResult → Draft → SafeDraft) would prove the "same grammar" claim rather than assert it.
2. Add a CAPABILITY row per node: which node may egress to a provider, which may read unredacted PII, which may write to chat.actor. The guards are the interesting part and their authority is invisible.
3. Wire Review release plan to a real plan_xxxx from 07.04. As drawn it is the only control on the board and it leads nowhere.
4. Add a FAILURE PATH overlay — tool timeout, guard block, provider 429 — because a chain without its error edges is a happy path, not a graph.
5. Add the DESIRED + OBSERVED dual plane that 13.03 uses, so the fixture numbers sit beside empty observed slots marked NotWiredYet rather than standing alone.

Verdict. Keep, and make it the template against which the rest of section 12 is rebuilt.

12.04 · AI · RAG

On the board. Header RAG — profiles index · 52,180 docs · Vectorize with a Reindex · ~4m control. INGEST PIPELINE · INCREMENTAL · TRIGGER: user_profiles UPDATE shows five stages: user_profiles · Supabase CDC · 214 rows/h → chunk + clean · strip pii · 512 tok windows → embed · matching.profile-embed v3 · workers-ai · 4ms/doc → Vectorize index · 52,180 vectors · 768d → retriever · top-8 · mmr λ0.6 · filter: same-circle. RETRIEVAL TEST runs a query with five scored hits. INDEX HEALTH gives six tiles: recall@8 0.74 · golden set 200q, freshness lag p95 41s after profile edit, orphan vectors 0 · GC nightly, pii leakage scan 0 hits · weekly, embedding drift cos 0.98 vs v2 · stable, cost $4.20/mo. The footer reads index = graph node vectorize.profiles — same lineage, same commands · DropIndex is a reviewed command, not a console click.

Vision tie. Good. The footer makes 12.03's argument again, and it echoes 08.05's audit row where the critic BLOCKED DropIndex ix_msg_room. That echo across two sections is the best latent seam in the cluster — and neither board links to the other, so it goes unclaimed.

Workflow tie. Opened when retrieval quality drops, or when a privacy review asks what is in the index and who can reach it.

Agentic tie. An agent could propose chunk-size, λ or top-k changes and measure them against the golden set, which is the one closed measurement loop in section 12. Governance is claimed in the footer and never shown.

Blueprint tie. The asset cook and derived-data pipeline — source assets in, derived index out, with staleness and invalidation. Genuinely close.

Replaces / augments. Pinecone and Weaviate consoles, the Vectorize dashboard, LlamaIndex observability, Ragas.

Improvements.

1. Add a GOLDEN SET pane: 200 queries with per-query recall and a diff against the previous index build. recall@8 0.74 alone is not actionable; the twenty queries that regressed are.
2. Turn Reindex · ~4m into a proposal that produces a plan with cost, read-path impact during rebuild, and a rollback to the previous index version. A bare button on this board contradicts the board's own footer.
3. Add INDEX VERSIONS with side-by-side serving and eval-based cutover. The pipeline shows v3 with no mechanism for shipping v4.
4. Surface the redaction rules behind strip pii, with an audit of what was stripped. pii leakage scan 0 hits is the claim; the rules are the mechanism, and only the claim is drawn.
5. Make vectorize.profiles a selectable graph entity with visible lineage, so the footer's promise is a click rather than a sentence.
6. Mark every health tile as fixture; see the honesty audit.

Verdict. Strengthen.

12.05 · AI · Prompts & Evals

On the board. PROMPT REGISTRY · VERSIONED LIKE CODE lists six prompts with version, state, score, volume and author: budbot.icebreaker v7 · live · 0.91 · 8,412 runs/d · $34/d · @shibasis · 2d ago; budbot.tone v2 · experiment 50% · 0.89 · 4,206 runs/d · @agent · 6d ago; budbot.activity-suggest v4 · live · 0.87; moderation.text v9 · live · 0.98 · 41k runs/d · haiku · @agent · 4d ago; matching.profile-embed v3 · live · — · 5,236 embeds/d; budbot.recap v1 · draft · 0.71 ⚠ · eval below gate 0.85 · @agent · 4h ago. DIFF · budbot.icebreaker v6 → v7 shows the removed and added prompt lines verbatim. EVAL SUITES · GATE ≥ 0.85 TO SHIP lists six suites with scores and methods (142 cases · llm-judge + human 20%, no-invented-facts checker, brand voice rubric, 41 adversarial cases, p95 < 2.5s, and recap_faithfulness 0.71 · BLOCKS SHIP). The footer reads ship = command: PromoteChain(budbot.icebreaker v7→v8) / gate runs evals in CI · fail = command rejected, not deployed.

Vision tie. Moderate. "Versioned like code" and "ship = command" are the right instincts and the diff pane is the right control. But the gating claim rests on CI, and §2 establishes that no CI exists — the only framework workflow file is fully commented out. The board's entire safety argument is delegated to a system that has not been turned on.

Workflow tie. Every prompt change, plus the release gate before an AI feature ships. Today: a prompt in a string constant, a PR, and someone's judgement.

Agentic tie. The most consequential permission claim in the cluster is rendered here as a byline. Three of six prompts are authored by @agent, including moderation.text v9 — an agent editing the safety gate that guards the product's output — and no approver is shown for any of them. 03.01 says agents are DENIED apply; this board shows agent-authored prompts live.

Blueprint tie. The asset validator plus the content browser's version history. Close and useful.

Replaces / augments. LangSmith Prompt Hub, PromptLayer, Braintrust, Humanloop, Weights & Biases.

Improvements.

1. Add an APPROVER column beside AUTHOR. An agent-authored change to moderation.text must show who approved it, under which capability, and against which eval run.
2. Make eval suites drill down to cases. 142 cases · llm-judge + human 20% needs a case list with input, output, verdict and judge rationale — the exact capability LangSmith ships today and this board lacks.
3. Show the eval delta caused by the diff. The v6→v7 text is visible; its effect on recommend_quality is not, which makes the diff pane decorative.
4. Resolve three cross-board contradictions: latency_budget at 0.96 here versus 0.82 REGRESS on 12.01; moderation served by haiku here, by llama-3.3-70b on 12.02 rule 1, by llama-guard-3-8b on 12.01 and by "workers-ai" on 11.04; 8,412 runs/d · $34/d here against 11.04's 8.4k runs/d at $118.00 for the month.
5. Replace gate runs evals in CI with the true state and its prerequisite: gate blocked · requires L0 CI · not started.
6. Register PromoteChain in a command catalog with arity, inverse and required evidence. It is one of five verbs invented board-by-board across the atlas.

Verdict. Strengthen. The registry and the diff are right; the gate is an unbacked claim about a system that does not exist.

12.06 · AI · Notebooks

On the board. A notebook list (matching-quality.nb · threshold study · 12 cells, budbot-tone-eval.nb · v2 experiment analysis, cohort-deep-dive.nb · jun 30 retention lift, flexbuffer-bench.nb · parse regression repro) captioned cells run against live graph / queries · results cached · shareable as reports. Then an open notebook, matching-quality.nb — does threshold 0.68 beat 0.72?, with three cells: [1] sql · 142ms showing a real statement over matches JOIN outcomes USING (match_id) and a six-row result; [2] chart · matplotlib-style annotated 0.68 — knee of the curve · below this, match volume ↑ but quality craters; and [3] ask · sonnet-5 · grounded in cells 1–2 producing a written analysis that ends → draft command: SetProperty(matching.threshold, 0.68) already live since Jun 28.

Vision tie. The ask cell is the single best agentic interaction in the whole cluster and possibly in the atlas: analysis grounded in the preceding cells that terminates in a typed, reviewable draft command rather than a paragraph. Nothing on the market closes that loop. Everything else on the board is Jupyter.

Workflow tie. The analyst or engineer answering "did that threshold change help", mid-week, usually to settle an argument.

Agentic tie. This is the agent's own workbench, and it is ungoverned. The draft command targets matching.threshold — a live production parameter — with no plan, no blast radius, no approver and no effect ceiling anywhere in view.

Blueprint tie. None in Unreal. The nearest is the profiler's session comparison, but honestly this is Jupyter or Hex with a graph-aware kernel.

Replaces / augments. Jupyter, Hex, Deepnote, Mode, Metabase, Weights & Biases Reports.

Improvements.

1. Make → draft command a real control that opens the sealed-plan flow with blast radius and approver, closing the loop this board comes one pixel short of closing.
2. Add a PROVENANCE strip per cell: which datastore, which revision, which as-of time. cells run against live graph means every cached result goes stale silently, and the board advertises caching in the same breath.
3. Give each cell a truth mark so the fixture chart is distinguishable from a live query at a glance.
4. Move the board out of section 12 to sit beside 11.05 Reports and 09.04 Data Studio. Its subject is product analytics; only one of three cells is AI.
5. Resolve the internal oddity that the analysis recommends 0.68 and then notes it is already live since Jun 28, which makes the notebook a post-hoc justification rather than a decision. Either show the decision receipt from June or drop the recommendation framing.

Verdict. Merge into 11.05 Learn · Reports, carrying the ask-cell-to-command interaction as the reason it exists.

12.07 · AI · Traces

On the board. The 04-series four-quadrant shell again, with the panes retitled: PROMPT + ROUTING (template · version · policy · provider decision), MODEL (tokens · latency · retries · cost · output schema), TOOLS + RAG (calls · retrieval · citations · redactions · failures), EVAL + RELEASE (guardrails · scores · regression · deployed chain), under TRACE PLANE · SELECTED RUN + BASELINE. Coverage reads Recorded trace · eval coverage partial with a PARTIAL · 3 unknown chip. Below sit the same EVIDENCE & FINDINGS block as 08.01 (12 findings · 3 blocking, Conflict / Unknown / Impact / Policy), a SELECTED PATH (Request → prompt → model → tool → guardrail → eval → product signal), and a SELECTION INSPECTOR reading Trace / tr_ai_4f20 · Recorded run · sensitive values redacted · cost evidence attached with Truth SOURCE, Effect READ ONLY, Confidence 1.0 / exact.

Vision tie. Weak as drawn, and structurally backwards. An AI trace is a trace. The Reaktor-specific claim would be that the LLM span sits in the same span tree as the button press and the database insert that 10.01 already draws (AppleButton.onClick → AuthAction → … → d1.sessions). By giving AI its own trace plane, this board asserts that model calls are a different kind of event, which is the opposite of the one-graph thesis.

Workflow tie. Debugging a bad model output — why did it pick that model, what did it retrieve, what did the guard do.

Agentic tie. An agent could read a failing trace and propose a prompt or routing fix, but nothing here is enumerable: four labelled boxes with subtitles and no run content.

Blueprint tie. The profiler and debugger. The problem is that 10.01 is already the profiler, so this is a second profiler scoped to a subset of spans.

Replaces / augments. LangSmith traces, Weave, Langfuse, Datadog LLM Observability, Helicone.

Improvements.

1. Merge into 10.01 as a kind:llm lens with LLM spans nested inside the real request tree. That both delivers the one-graph claim and removes a duplicate board.
2. If kept, draw an actual run tree — nested spans with token counts, retries and tool results. Four static boxes are strictly worse than what LangSmith gives a developer today.
3. Link tr_ai_4f20 to 12.03's tr_ai_4f21. Two sample traces one digit apart in the same section, unlinked, is the clearest violation of the atlas's own "selection survives every movement" contract.
4. Drop Confidence 1.0 / exact while the same board simultaneously reports PARTIAL · 3 unknown and Unknown · Runtime observation is not wired.
5. Add the BASELINE control the header promises. SELECTED RUN + BASELINE shows one run and no baseline.

Verdict. Merge into 10.01 Trace + Runtime as an LLM lens.

Cluster findings

Missing panes

1. 08.06 Agent Fleet & Budget — a roster of agent principals with per-principal capability, spend, concurrency and a kill switch. §1 makes agents first-class operators; the atlas shows their work everywhere and the operators themselves nowhere. Section 08's own tab strip has an Agents tab with no board behind it, and 12.01 is currently holding the roster by accident.
2. 08.07 Agent Chat / Delegation — the section 08 tab strip lists Chat first and no board exists. This is where intent becomes a task, and it is the one surface every competitor ships as their entire product.
3. 08.08 Capability Grant & Escalation — a pane to answer an agent's request for scope, minting a narrow, expiring, non-delegable capability with a reason. 08.03 raises the request (agent asked for pen-test scope) and no board can answer it. Without this, §1's "locks on the right doors" has no key-cutting surface anywhere in 104 boards.
4. Command Catalog / verb registry — the atlas invents AddChainNode, ConnectPorts, SetProperty, PromoteChain, RouteModel, DropIndex, DataChange, ExtractScope and GraphViewCommand.Move across nine boards with no list, no arity, no inverse and no required-evidence rule. §1's eigenvector-primitives claim is a claim about exactly this set, and it is undocumented.
5. Agent Failure & Rejection — every board shows agents succeeding. Nothing shows the reason-code taxonomy for a rejected proposal, a hallucinated node reference, a patch on a stale base, an exhausted budget, or a capability denial. Given §2's evidence standard this is the most important missing surface in the cluster: the honest agent story is mostly about what gets refused.
6. Eval Case Explorer — 12.05 gates on ≥ 0.85 and offers only aggregate scores. Without per-case drill-down the gate cannot be audited, and case-level inspection is precisely the feature LangSmith and Braintrust are bought for.
7. 12.08 Tools & Function Registry — the section 12 tab strip lists Tools with no board. 12.03 draws TOOL suggestActivity() · MCP · 340ms as a chain node whose contract, permissions, failure modes and cost appear nowhere.
8. 12.09 AI Releases — the tab strip lists Releases; 12.05 asserts PromoteChain and 07.04 owns releases for everything else. Today an AI chain ships through neither.
9. Type-identity surface for agent reads — §2 names one fingerprint system as the verification keystone and D-6 as unsound port identity, where string-built ports carry a null class. An agent reading the graph to plan a patch must be told which ports carry real identity. No board says so, so every agent proposal in the atlas is drawn as if the type system were sound.

Seams

One board drawn four times. 08.01, 01.04, 03.01 and 12.07 share the same four-quadrant template, and the EVIDENCE & FINDINGS block is byte-identical across all four: 12 findings · 3 blocking, Conflict · Desired and observed claims disagree, Unknown · Runtime observation is not wired, Impact · 14 tests · 3 deploy targets, Policy · Approval required before mutation. So is the evidence block: Origin source:main, Observed runtime · 3s, Confidence 1.0 / exact, Revision spec@8f41c2, Owner platform. Four boards report the same twelve findings about four different subjects. 08.01 and 01.04 in particular are the same board with four subtitles reworded — and 08.01 is the worse of the two, because it downgrades 01.04's honest Truth: UNKNOWN · not wired to Truth: SOURCE.

Two chromes with no bridge. 08.01 and 12.07 use the SCOPES & QUERIES shell; 08.02–08.05 and 12.01–12.06 use a tab strip. There is no route from the Conductor to the Kanban: 08.01 has no tab strip, and the tab strip has no Conductor entry.

Dead tabs. Section 08's strip lists nine tabs and the section has five boards — Chat, Agents and Pipeline lead nowhere, and MCP/Memory and Runbooks/Audit are each two tabs served by one board. Section 12's strip lists twelve tabs against seven boards — Tools and Releases lead nowhere, while Playground and Guardrails exist only as panes buried inside 12.01.

The capability model is in the wrong section. 03.01 Visitor Lab holds the only real agent authority grammar in the atlas: PRINCIPAL agent:codex · role:graph-auditor · session scoped, ALLOWED inspect graph · query evidence · explain findings, PREVIEW ONLY draft GraphPatch · calculate impact · request review, DENIED apply · deploy · secret access · self-approval, capability expires with session, and even PERMISSION DENIED · scope hidden. Section 08 never references it and 08.04 re-states it informally as ⛨ prose per MCP server. Two vocabularies for one concept, in two sections, with the weaker one placed on the board that most needs the stronger.

No diff anywhere in section 08. Five boards about agents changing a system, and not one line of proposed code, not one before/after property value, not one file hunk. 04.02 has the patch grammar and 07.04 has a diff summary (+ 2 ports · + 1 schema field · ~ 4 nodes · − 1 deprecated handler). Section 08 has card titles and log lines. This is the single largest competitive gap: reviewing the actual patch is the core loop of every tool this cluster claims to displace.

Selection does not survive. tr_ai_4f21 on 12.03 and tr_ai_4f20 on 12.07 are unlinked. cmd #14 on 08.05 resolves to no plan. rc-812 on 08.02 does not reach 07.04's Inspect rc-812. vectorize.profiles on 12.04 does not reach 08.05's blocked DropIndex ix_msg_room, which is the most persuasive cross-board story in the atlas and goes untold.

Cost is asserted four times in three denominations. 11.04 gives claude api · budbot chains $118.00 for the month at 8.4k runs/d; 12.02 gives cost / day $118; 12.01 gives $124 · 24h; 12.05 gives budbot.icebreaker · 8,412 runs/d · $34/d, where $34 is 11.04's monthly workers-ai line. The same fictional figures were copied between boards with the units scrambled. And the optimizer proposal appears in two states at once: 11.04 offers RouteModel(budbot.icebreaker, haiku, cond: circle.age<4d) as an un-applied suggestion while 12.02 shows it live as rule 2.

Moderation is routed four ways on one revision. 12.02 rule 1 sends it to llama-3.3-70b; 12.01 names llama-guard-3-8b · workers ai; 12.05 says moderation.text v9 · live · 41k runs/d · haiku; 11.04 books it under workers-ai · embeddings + moderation. One fact, four answers, all stamped main@8f41c2. This is the cluster's deepest structural failure, because the atlas's central promise is that "the diagram of the system and the system are the same object, so the diagram cannot lie." Hand-authored fixture data lies, and here it lies inconsistently with itself, which is proof that these boards are drawings rather than projections.

Eval suites are renamed between siblings. 12.01 has recommendation_quality / hallucination / safety_policy / json_schema / latency_budget; 12.05 has recommend_quality / groundedness / tone_match / safety_refusals / latency_budget / recap_faithfulness. The scores line up pairwise (0.91/0.91, 0.94/0.94) except latency_budget, which is 0.82 ↓ REGRESS on one board and 0.96 passing on the other.

Honesty audit

Ten of my twelve boards carry no truth-class component at all: 08.02, 08.03, 08.04, 08.05, 12.01, 12.02, 12.04, 12.05, 12.06, and 12.03's metric tiles. Only 08.01 and 12.07 carry Truth / Effect / Permission plus an evidence block, and both stamp Confidence 1.0 / exact on a plane whose own findings block reads Unknown · Runtime observation is not wired. A confident stamp on an admittedly unwired subsystem is worse than no stamp.

The fix is not invention. 12.03 already models it inside my cluster with DESIGN FIXTURE · desired chain budbot-icebreaker@v7 · not released and DESIGN FIXTURE · SAMPLE RUN; 09.05 does it with DESIGN FIXTURE · ESTIMATED PLAN ONLY and SOURCE · applied state UNKNOWN; 10.01 does it with FIXTURE · sample counts · not operational. Three boards already carry the band that the other nine need.

Board by board, what the honest version shows:

• 12.05. 0.91, 8,412 runs/d, $34/d, 142 cases · llm-judge + human 20%, 41 adversarial cases are all fabricated; no eval harness exists. Honest board: keep the registry rows with name, version, state and author, replace the score column with — under a header reading no eval harness exists, and render the gate as blocked on its own prerequisite — gate ≥0.85 requires CI · L0 not started. The DIFF pane is real design work and should stay.
• 12.02. p50 1.2s, 99.98%, 0.02% 429 rate, 62% cache hit, 41.2M in / 8.1M out, $118/d, 0 dropped requests describe traffic that has never flowed. Provider list prices are externally verifiable and should stay with a SourceRef and an as-of date. Every traffic, latency and health tile becomes no traffic recorded, and the rules stay as desired routing beside an OBSERVED: none column.
• 12.01. hallucination 0.94, recommendation_quality 0.91, 1% of users → 31.4% of cost, $124 · 24h, 1.4k → 0.8k tok · 820ms · $0.0024 · eval 0.92 are all fixture. 412 red-team cases · 100% block is the most dangerous single string in the cluster: a perfect safety record asserted for a guardrail that has not been written. Honest version: red-team suite not written · 0 cases.
• 12.04. The ingest pipeline shape is a legitimate design claim and should stay. 52,180 docs, recall@8 0.74 · golden set 200q, freshness lag p95 41s, embedding drift cos 0.98 become index not built. pii leakage scan · 0 hits · weekly is a compliance-grade assertion about a scan that has never run and must be removed or marked scan not implemented.
• 12.06. The SQL is real design work; 142ms, the six-row result table, 2,180/wk vs 1,410/wk and already live since Jun 28 are invented. Honest framing: WORKED EXAMPLE · synthetic results.
• 08.02. 14/16 cards · 7 agents and every card age are fixture. The honest board is mostly empty — no agent sessions recorded — with one worked example card showing the full field set.
• 08.03. Separate policy from usage. The budget cap, the worktree protection rules, the gate list and no destructive commands attempted are policies, honest to show as desired state. +812 −204, 64%, 4.2M tok used, epic ETA Jul 18 are usage and are invented. Note also that maestro auth flows · 21/22 green sits against §2's record of Maestro flows failing broadly on authenticated paths.
• 08.04. No MCP server exists for reaktor-graph, reaktor-db or reaktor-telemetry, so 42 calls/h, 18 calls/h and 31 calls/h describe traffic to software that has not been written. 214 FACTS likewise. Honest version adds an EXISTS column reading designed / designed / designed / external / external / external and shows the fact count as 0 recorded · schema designed.
• 08.05. The runbook steps are honest design and among the best content in the atlas. The outcomes — last run 2h ago · auto-resolved 14m, passed Jun 30 · RTO 41s, tests 142/142, evidence: 412 events · v812 only, retention −3.1pt — describe runs that never happened. Retitle the audit pane WORKED EXAMPLE · no audit log exists and keep every row, because the row schema is the deliverable.
• 08.01 and 12.07. The dishonesty here is subtler and worse than a fabricated number, because it is a false provenance mark rather than a false datum. Both assert Confidence 1.0 / exact and Truth: SOURCE while their own findings blocks say the runtime is not wired. 01.04, the North Star board, gets this right with Truth: UNKNOWN · not wired. Section 08 regressed from its own North Star.

D. What a genuinely superior-to-MCP agent interface looks like

This is the design 08.04 should carry. The one-line difference: MCP's unit is a tool call; Reaktor's unit is a scoped capability over a typed live graph that returns proposals and receipts instead of effects. Enumeration becomes a query rather than a list, delivery becomes a subscription rather than a poll, writing becomes a proposal rather than an execution, and the answer is a receipt rather than a string. Five panes.

Pane 1 — SURFACE CATALOG (what the agent can enumerate). Not a list of seven verbs. A queryable projection of the graph's own type system, driven by the same omnibox grammar the human uses (kind: owner: truth: path:), which is the actual superiority claim: one query language, one result shape, for human and agent. Columns: entity kind (ServiceNode, Actor, Flow<T>, Adapter, Visitor), instance count, port contracts exposed, read verbs available, propose verbs available, and a fingerprint column — §2's keystone primitive unifying port type identity, codec layout identity and FFI method identity. One further column is non-negotiable given D-6: type identity, marking each port reified or string-built · class null. An agent told which ports lack class identity will propose differently from one that assumes soundness; hiding D-6 from the agent is how you get patches that compile and misconnect.

Pane 2 — SUBSCRIPTIONS (what the agent can subscribe to). MCP is request/response with no push, so every MCP agent works from a stale snapshot. Reaktor's entire differentiator is that the graph is alive, so the agent should hold subscriptions rather than poll: subscribe(scope, mask) over NodeAdded, PortsConnected, PropertySet, LifecycleTransition, EvidenceChanged, PlanSealed, ReceiptIssued, delivered as credit-based backpressured frames on the same reaktor-ffi data plane as everything else (§1's polyglot floor, which §2 notes is still a skeleton — so this pane ships marked designed). Columns: scope selector, event mask, credits outstanding, frames dropped, and facts invalidated — the link that turns 08.04's throwaway line stale facts flagged when node changes into a mechanism, because a subscription is exactly how a memory fact learns its anchor moved.

Pane 3 — PROPOSAL BROKER (what the agent may propose). 04.02 already names the mechanism — mutation broker → proposal/plan — and no board renders it. The agent submits GraphPatch(base=r1842, commands=[…]) and receives one of two things. On success: a compile result, a typed impact set, a blast-radius entity count, the list of evidence the plan will require, and a plan_xxxx id. On rejection: a typed reason code, not a string — TYPE_MISMATCH, SCOPE_DENIED, BASE_STALE, EVIDENCE_MISSING, BUDGET_EXHAUSTED, INVERSE_UNAVAILABLE. The reason code is the difference between an agent that recovers and one that retries the same mistake; MCP hands back an error string and the agent guesses. The pane must show rejected proposals as prominently as accepted ones, which also fixes the cluster's "agents only succeed" problem.

Pane 4 — CAPABILITY GRANT (what scopes the agent holds). 03.01's principal model, made per-scope and per-verb rather than per-server. Each row: principal (agent:codex), scope path (a subtree or query, not a server name), verb class (read, subscribe, propose, simulate, and apply which is never granted to an agent per 04.02's never self-approve or apply), effect ceiling (READ ONLY / SANDBOX / STAGED / PRODUCTION, reusing the atlas's existing EffectMark), expiry (expires with session, from 03.01), and delegation — whether this principal may mint a strictly narrower capability for a sub-agent, and to what depth. Delegation is the single strongest technical claim available here, because MCP has no vocabulary for it at all: an MCP client either has a server's tools or it does not, and it cannot hand a sub-agent a weaker version of what it holds. A denied row must render as 03.01 does — PERMISSION DENIED · scope hidden — so the agent learns a boundary exists without learning what is behind it.

Pane 5 — RECEIPT (what comes back). MCP returns tool output. Reaktor returns the object 07.04 already defines: PlanApproved · plan_8dd4 · actor · approver · independent · expires 9m · sha256:8dd4…c11a · reason attached · rollback proven · one use. For read-only calls the return is an evidence receipt: what was read, at which revision, with which freshness stamp, and therefore what the agent is licensed to assert downstream. This closes the loop three ways — the agent can cite the receipt into its memory facts, a stale receipt self-invalidates when its base revision moves (drift invalidates approval), and the audit log on 08.05 gains the join key it currently lacks.

The design is defensible because each pane names something MCP structurally cannot express: a type-system query instead of a tool list, a push subscription instead of a poll, a proposal tier between read and write, a delegable expiring scope, and a signed one-use receipt. That is the concrete content behind "MCP gives an agent a doorway; Reaktor gives it the floor plan with locks on the right doors" — and none of it is on 08.04 today.

E. Governed change — a serious structural flaw

The Symphony Contract promises that "human and agent changes share one patch → plan → receipt path". The canonical path is specified twice outside my cluster and instantiated once. 04.02 states it: SEMANTIC CHANGE — PATCH → COMPILE → PLAN → AUTHORIZE → RUN → VERIFY → RECEIPT, with drift invalidates approval · agent/Critic may propose and review, never self-approve or apply · external undo is a governed rollback. 09.05 restates it for data. 07.04 instantiates it with a real object: Bundle #1042 · 7 commands governed by RECEIPT · PlanApproved · plan_8dd4 · actor alice · approver bob · independent · expires 9m · sha256:8dd4…c11a · reason attached · rollback proven · one use.

None of my twelve boards shows a plan id, a receipt object, a content hash, or an approver distinct from the requester. Approval appears as a word — APPROVAL REQUIRED, human approval · @shibasis pending, approved cmd #14, merge blocked · human approves — never as the artifact. That alone is a chain break: the contract promises the receipt survives every movement, and it does not survive into either of my sections.

Worse, the unit of governance diverges. The deploy plane governs a bundle: one plan, seven commands, one sha, one use. The agent plane governs a command: 08.05 logs approved cmd #14 and BLOCKED cmd #11 individually, and 08.01 reports 12 commands proposed · 0 applied with no bundle anywhere. Approving twelve commands one at a time has different atomicity, different rollback and different drift semantics than approving one sealed plan — a partially approved set can leave the graph in a state no plan ever described. This is not a cosmetic inconsistency; it is two different transaction models wearing the same word.

Then section 12 invents a third mechanism and 11.04 a fourth. 12.05 ships by PromoteChain(budbot.icebreaker v7→v8) gated by evals in CI — neither a sealed plan nor a command approval, and gated on CI that §2 says does not exist. 11.04 proposes RouteModel(...) as an optimizer suggestion with no gate at all. 12.04's Reindex · ~4m is a bare button on a board whose own footer insists DropIndex is a reviewed command, not a console click. 12.06's ask cell drafts SetProperty(matching.threshold, 0.68) against a live production parameter with no gate in sight.

So the atlas has four governance mechanisms where it promises one: sealed bundle plan (07.04, 09.05), per-command approval (08.05, 08.01), eval-gated promotion (12.05), and unguarded console action (12.04, 12.02, 12.06). There is also an independence problem in the one place independence is drawn: 07.04 is careful to show actor alice · approver bob · independent, while 08.03 lists human approval · @shibasis pending on an epic where @shibasis also owns task T-104. The same principal is worker and approver on one epic.

The remedy is a single rule enforceable by a designer: no board may render a mutating control that does not produce a plan_xxxx. One PROPOSAL object, one RECEIPT object, rendered identically on every board that changes anything, with the effect ceiling and the approver visible in both. Every divergence listed above is then a lint failure rather than a design decision.

F. Competitive framing — against what Cursor, Claude Code, Devin, LangSmith and W&B ship today

Where these surfaces genuinely win.

1. Computed blast radius. 07.04's blast radius · 14 entities and 08.05's critic blocking a DropIndex because the index still used by chat.query p95 path are impact analyses that require a live typed graph. Cursor greps and embeds; Claude Code reads files; Devin explores a repository. None of them can enumerate the true consumers of a database index or a port, because none of them has a runtime model of the system. This is the cluster's one unassailable advantage and it appears on exactly two rows of one board.
2. One approval object shared by humans and agents. An agent's change and a human's change producing the same sealed plan, with drift invalidates approval, is something no competitor has. GitHub approves diffs, not plans; LangSmith approves nothing.
3. Budget and destructive-action receipts as governance primitives. 08.03's 4.2M tok used / 10M epic cap and no destructive commands attempted are per-epic policy objects. Devin meters ACUs per session for billing, not as a governance cap tied to a unit of work, and nobody surfaces "no destructive commands attempted" as a standing receipt.
4. Prompt changes and code changes in one ledger. Because 12.03 makes a chain into nodes, a prompt edit and a port rewire are the same kind of command in the same audit log. LangSmith versions prompts in a silo that has no relationship to your deploy; this cluster could make one release contain both.
5. Graph-anchored memory. 08.04's facts link to graph nodes · stale facts flagged when node changes beats every competitor's memory model. CLAUDE.md, Cursor rules and Devin's Wiki are all prose that rots silently; a fact whose anchor node changed can be flagged automatically.

Where they tie. The kanban of agent sessions is Devin's session list. The memory pane is Devin's Wiki and Cursor's rules. The prompt registry with diff and an eval gate is LangSmith's Prompt Hub with CI evals. Index health is what every vector vendor's console shows. Notebooks are Hex. None of these is worse than the incumbent; none is better either, and all of them are drawn from further away than the incumbent's real screen.

Where they lose, concretely.

1. No patch review anywhere in section 08. Cursor's core loop is reading and accepting the proposed diff hunk by hunk. Five agent boards show not one line of proposed code and not one before/after property value. SetProperty ChatActor.initialState with no values shown is unreviewable.
2. No case-level eval drill-down. LangSmith lets you click a failing eval case and read the exact input, output and judge rationale. 12.05 shows six aggregate scores and 142 cases with no way in. The gate cannot be trusted without it.
3. No real trace tree. 12.07 draws four labelled boxes where LangSmith and Weave show a nested run tree with token counts, retries, tool payloads and per-span cost. This is strictly worse than the incumbent, on the incumbent's home ground.
4. No interrupt or steer. Cursor, Claude Code and Devin all let you stop an agent mid-run and redirect it. Nothing in section 08 has that control, which means the only lever a human holds is approval at the end.
5. No cost attribution to a requester. 12.01 attributes spend to models, 11.04 to resources, 12.02 to days. None attributes to the person, the task or the PR that caused it — which is the question a lead actually asks, and which 12.06's own notebook is trying to answer (1% of users → 31.4% of cost) on a different axis.
6. No local-first loop. Every competitor works in a checkout on a laptop with no server. These boards presume a live graph, a telemetry plane and an approval service, none of which exists per §2. The honest sequencing story — what an agent can do on day one with only the source projection — is missing entirely.

The strategic read: the cluster's claim to "demolish Cursor" rests on the graph, and the boards that actually use the graph are 08.05's critic row, 12.03's chain-as-nodes and 12.04's index-as-node. Everything else in twelve boards is a competent redraw of LangSmith and Linear with a Reaktor header. Cutting the redraws and building the three graph-native ideas properly is a stronger product argument than the current twelve.

Part 10 · Section 09 — State and Trust

Sixteen boards. Six Trust/State boards under bestbuds / identity and bestbuds / state, and ten boards of a single wizard under bestbuds / state.

Two structural facts drive most of what follows, and both are mechanical rather than interpretive.

First, the six 09.x boards are not six surfaces. They are two surfaces with tab strips drawn on them. 09.01, 09.02 and 09.03 all carry the identical strip Providers · Roles & Permissions · Sessions · Audit · Security · Simulator, and each board is one or two of those six tabs rendered as a whole board. 09.04, 09.05 and 09.06 carry a Schema · Data · Relationships · Query Plan · History · Migrations strip, which 09.04 alone prefixes with a seventh tab, Query.

Second, the ten Composer boards are one board. Steps 1, 2, 4 and 5 differ from each other by exactly six lines out of 119: the title, three breadcrumb echoes, the headline verb, the draft chip, the Next: line and the closing footnote. The five provisioning states differ by eight or nine lines out of 120. Everything between those lines — the generated-graph summary and the five-step bootstrap ledger — is byte-identical across all ten.

09.01 · Validate + Identity · Policy, RBAC & Explanation

On the board. Under the shared identity tab strip, a left IDENTITY PLANE rail lists PROVIDERS (apple 89k, google 41k, email · magic link 11k), ROLES (superadmin 4 through guest 31k) and POLICIES (rate-limit · login 10/min, mfa · admin enforced, ip-allowlist 4 ranges, session-ttl 24h · 4h). The centre carries a prose contract, "Select permission → propose diff → show effective blast radius → run negative tests → approve → apply → audit receipt", then an EFFECTIVE HIERARCHY · EXPLAINABLE chain from superadmin 4 users · 42 perms down to guest, then the board's bulk: a Permission matrix of 5 roles × 6 resources with C R U D letters or · in every cell across USERS · SESSIONS · ROLES · MESSAGES · CAMPAIGNS · MEDIA. A right rail holds RBAC Summary (Strategy role-based · hierarchical, Backend supabase-rls · jwt claims, Inheritance superadmin → guest, Last change 3m ago by @shibasis) and Policies · 7 with an + Add policy control.

Vision tie. It embodies almost none of §1. Nothing here is a node, a port or a traversal. RBAC is modelled as a static configuration table of the kind any framework ships, and the one genuinely Reaktor-shaped promise on the board — "show effective blast radius", which would require walking the live graph from a permission to every node that consumes it — exists only as prose in a caption. The Backend supabase-rls · jwt claims line quietly concedes that authorization lives in Supabase, not in the graph, which makes the whole surface a viewer over someone else's policy engine rather than an instrument of the framework.

Workflow tie. Someone opens this the week a role is added, or during a SOC 2 evidence pull, to answer "who can do what". It is the screen a new engineer is shown on day three and never returns to. Today that work happens in the Supabase dashboard, in a policy/*.yaml file, and in a Notion table that drifts from both.

Agentic tie. An agent reads a clean, dense, structured matrix — and is thereby actively misled. The matrix is a total function from (role, resource-class) to CRUD, so an agent that reads it concludes the authorization model is fully specified and closed. It is not: every instance-scoped rule in the real system is invisible here. An agent asked "can this user read that room" cannot even form the query, because the board has no axis for a resource instance. The board is worse than agent-hostile; it is agent-deceiving.

Blueprint tie. This is Unreal's collision matrix in Project Settings — an object-type by object-type grid resolving to block, overlap or ignore. The analogy is exact and it is also the indictment. Unreal's collision matrix is famous for being unable to express per-instance exceptions; that is why per-actor overrides exist alongside it. This board has the matrix and no overrides.

Replaces / augments. Okta and Auth0 role dashboards, the AWS IAM policy editor, the Supabase RLS editor, and the playground UIs of Oso, OpenFGA and Cedar.

Improvements.

1. Add a third axis to the permission matrix: a Scope column group per resource with the values global, owned, member-of, tenant. user × MESSAGES becomes R (member-of) rather than R, which makes the relationship predicate a first-class cell value instead of an omission.
2. Add a Rules count and a Predicate column to the Policies · 7 list, so a policy row states which function enforces it and at which callsite; a policy with zero callsites renders as a finding, not a row.
3. Replace Last change 3m ago by @shibasis with a FreshnessStamp component bound to the policy store, and mark the entire IDENTITY PLANE rail FIXTURE · identity adapter not connected until it is — the counts 89k / 41k / 11k / 142k / 31k currently carry no provenance of any kind.
4. Make "show effective blast radius" a real control: a Blast radius button on each matrix cell that opens the set of graph nodes reached by that permission, with a count in the cell gutter.
5. Add an Unenforced state to the matrix cell vocabulary alongside C R U D and ·. A cell that policy grants but no code checks is the single most important state this board could show, and it is the state that describes S-1.
6. Link the EFFECTIVE HIERARCHY chain to 01.02's chat.membership finding so that a blocking authorization finding surfaces on the board where permissions are read, not only on the North Star board.

Verdict. Rebuild. The policy list, the RBAC summary and the propose-simulate-approve contract are worth keeping; the permission matrix, which is more than half the board's content, is structurally incapable of answering the question the board's own title promises to explain.

09.02 · Trust · Auth Sessions

On the board. The Sessions tab of the identity surface. A header reads Sessions — 42,118 active · across 142 countries immediately followed by session adapter not connected, and a PRODUCTION DESTRUCTIVE / APPROVAL REQUIRED / Revoke all… cluster. Then SESSION DENSITY BY REGION · FIXTURE · no geo adapter — counts only over a TOP REGIONS list (Mumbai · IN 18,421, Bengaluru · IN 12,042, Hong Kong 4,811, Pune · IN 2,814, Berlin · DE 1,942, Paris · FR 1,418, Dubai · AE 942), and RECENT SESSIONS · page 1 of 6,017 · masked by policy listing seven rows of masked session id, masked handle, device string, partially masked IP, city, provider, age and a Revoke control.

Vision tie. None, and the omission is precise. §1 says evidence is the load-bearing idea and that every datum carries a truth class. This board carries truth classes in prose but its subject matter — a session — is exactly the object that should link authentication to authorization, and it does not. Every column describes the provenance of the session (device, IP, provider, age). No column describes what the session may do.

Workflow tie. Opened during an incident: an account is compromised, someone needs to see live sessions and kill them. That is a real and valuable five-minute task, and the board supports it. It is opened at no other time. Today this is the Auth0 session list or a delete from auth.sessions.

Agentic tie. An agent can read a session inventory and propose revocations, governed by the APPROVAL REQUIRED chip on Revoke all…, which is correctly placed. It cannot answer any question about entitlement, and the geographic leaderboard is the least agent-useful shape the data could take: seven cities ranked by count supports no decision an agent could make.

Blueprint tie. Unreal's network connection list in the session frontend — connected clients with address, ping and platform. The analogy holds completely, including its limitation: the connection list tells you a client is attached, never what it is replicating or authorized to replicate.

Replaces / augments. Auth0 session management, the Okta System Log, Stripe's device list pattern, and the Supabase auth.users table view.

Improvements.

1. Add an Entitlements column: per session, the count of resource instances that session can currently reach, linking to the Decision Record pane proposed below. This converts a session inventory into an authorization instrument and is the change that would make the board matter.
2. Delete the TOP REGIONS leaderboard. Replace it with SESSIONS BY ENTITLEMENT — grouped by role and by scope breadth, with an over-scoped bucket at the top.
3. Mark the header. 42,118 active · across 142 countries sits directly above session adapter not connected; with no adapter, that is not a stale number but an invented one. The honest header is Sessions — UNKNOWN · session adapter not connected with the fixture count demoted into the band.
4. Bind the four prose marks (session adapter not connected, FIXTURE, masked by policy, no geo adapter) to TruthMark and EmptyReason components rather than typed band labels, so an atlas-wide query can see them.
5. Add a Last decision column showing the most recent authorization decision made for that session, which turns the row into an entry point rather than a terminus.

On the twenty numbers, and the V2 grammar. These two facts reconcile cleanly, and the received framing of the board is wrong in a way worth correcting. 09.02 is not an unmarked board. It carries four separate provenance strings and is one of the more heavily marked boards in the atlas. It belongs to the thirty-five boards that §3 describes as marking provenance "with hand-typed prose rather than components", not the forty-nine with no marker at all. The atlas-wide scan reports it as unmarked because the marks are typed into V2 band labels instead of instantiated as TruthMark, FreshnessStamp or EmptyReason components — so they are legible to a human and invisible to a query. That is precisely what one expects of the V2 grammar proof-of-concept board: the V2 band grammar puts provenance in the band label, the PoC proved the band grammar works, and nobody has yet made the band label a slot that renders a truth component. Making it one is a single change to the band primitive that would move all thirty-five prose-marked boards into the queryable set without redesigning any of them. It is the highest-leverage change available in the atlas, and this board is where to prove it. The residual honesty problem is narrower than "twenty unmarked numbers": it is that the header total and the fixture mark contradict each other on the same screen.

Verdict. Merge into 09.01 as the Sessions tab of one Identity surface, and rebuild its body around entitlement rather than geography.

09.03 · Trust · Security Simulator

On the board. Two tabs of the identity strip on one board. A posture header reads High-risk findings 1, Medium 3, Healthy 8, MFA adoption 62% · goal 90%, with a Run security scan control. Below it SECURITY POLICIES · 12 lists eleven rows with a severity and an action — OAuth secret rotation / last rotated 142d ago / high / rotate now, JWT signing key rotation / last 38d ago · 90d due / medium / review, Session lifetime / 7d · sliding window / medium / review, then eight low / OK rows. The lower half is the Permission simulator, captioned "can this role do this action on this resource?", with three selectors (Subject auth:role.user, Resource messages, Action update), a DENY verdict reading user → update messages · cannot edit messages after 5 min · policy/user.yaml:14, and a five-step TRACE: 1 resolve role → auth:role.user, 2 inherit chain → user ← moderator ← admin, 3 check policy/user.yaml, 4 resource messages · action update, 5 → DENY (time-window rule).

Vision tie. The TRACE block is the best thing in this cluster and the only place in it where the vision genuinely lands. A decision decomposed into ordered, individually inspectable steps with a source citation is what "the diagram and the system are the same object" looks like applied to policy. It is also the only pane in sixteen boards that explains why rather than what.

Workflow tie. Opened when a support ticket says "this user says they can't edit". An engineer reproduces the denial in the simulator instead of reading YAML. That is a genuinely good five-minute loop and it is the one loop in this cluster that would get daily use.

Agentic tie. The strongest agentic surface here. A structured subject/resource/action query with a structured trace is directly machine-composable: an agent can enumerate the cross product, diff verdicts across a proposed policy change, and cite policy/user.yaml:14 in a PR. What governs it is weak — the board shows no approval requirement on the simulator, correctly, since simulation is pure, but it also offers no way for an agent to record a simulation as evidence attached to a change.

Blueprint tie. The Blueprint Debugger: a breakpoint hit with a call stack and the ability to inspect each frame. The five-step TRACE is a call stack. The analogy breaks in one place and it is the important place — Unreal's debugger traces an execution that actually happened, whereas this traces a hypothesis the user typed in. Nothing here is bound to a real request.

Replaces / augments. The AWS IAM Policy Simulator, the OPA/Rego playground, Cedar's CLI evaluator, and — for the posture list — Vanta or Drata.

Improvements.

1. Change Subject from a role to a principal. auth:role.user must become u_9c2e with the role shown as a resolved attribute. Every instance-scoped bug lives in the gap between a role and a principal.
2. Add a fourth selector, Resource instance, beside Resource. messages must become messages in room r_8f41. Without an instance field the simulator cannot express S-1.
3. Add a worked PERMIT example beside the DENY. Every explanation on this board and on 09.01 explains a denial; the security-relevant failure is always a wrongful permit, and no board in the atlas explains one.
4. Add a Checks not performed column to the TRACE, populated from the graph by callsite census.
5. Reconcile the posture header with reality or mark it. High-risk findings 1 / Healthy 8 is asserted against a code audit that found twelve security findings with a critical authorization bypass among them; 01.02 in this same atlas says 12 findings · 3 blocking. Two boards, same subject, different counts, neither marked.
6. Make Run security scan state what scanner runs. There is no CI in this repository, so the control currently promises an execution with nothing behind it.

Verdict. Strengthen. This is the anchor board of the identity surface and the right home for the Decision Record pane described below.

Would 09.01 or 09.02 have surfaced S-1? No — and the reason is structural, not accidental

S-1 is that any authenticated user can join any chat room: a realtime token is minted after authenticating the caller and validating the room's shape, but membership is never checked, and the membership function that exists is called from only two other places. Four separate properties of this cluster guarantee it is invisible.

The matrix has no instance axis. 09.01's permission matrix is 5 roles × 6 resources where the six resources are classes: USERS · SESSIONS · ROLES · MESSAGES · CAMPAIGNS · MEDIA. A function from (role, class) to CRUD cannot express "principal u may read room r but not room r′", because there is no place in its domain for r. S-1 lives entirely in that gap.

The matrix actively certifies the bug as correct. The user × MESSAGES row reads C R · · — create and read messages. The deployed behaviour, in which any authenticated user reads any room's messages, satisfies that cell exactly. A reviewer checking the running system against this board finds conformance. The board does not merely miss the bug; it ratifies it.

Every explanation is a denial. 09.03's only worked example is DENY, and 09.01's hierarchy is captioned EXPLAINABLE but explains nothing beyond inheritance. A system that can justify refusals and cannot justify permissions can never find over-permission, and over-permission is the whole of the security-relevant failure class.

Sessions are authentication inventory. 09.02 shows that a session exists and offers to revoke it. Authentication is exactly what worked correctly in S-1. The bug is a resource-authorization failure downstream of a successful authentication, and there is no column on 09.02 in which it could appear.

There is a fifth fact, and it changes the recommendation. The atlas already contains the right concept, on the wrong board. 01.02 · North Star · Auth System Slice carries a RESOURCE POLICY node reading chat membership · profile views · tenant boundaries; a SELECTED PATH reading Principal → token → resource decision → repository → audit evidence; a coverage line reading Source finding · negative authorization tests required; an EVIDENCE & FINDINGS block reading 12 findings · 3 blocking; and a selection inspector reading Finding / chat.membership — Source-proven authorization gap · production mutation blocked, with Truth FAILED · run_7f2a. That is S-1, named, counted alongside its eleven siblings, and correctly classified. It sits on the aspirational North Star board and appears nowhere on the three boards a developer actually opens to ask who can do what. The word membership occurs in four boards atlas-wide and in none of mine.

So the fix is not greenfield. It is to promote 01.02's model into the working surface.

The pane to build: Decision Record, on 09.03. Its subject is one real request, not a hypothesis, headed POST /realtime/token · room r_8f41 · principal u_9c2e · 15:04:02.118 · run_7f2a. Its anatomy:

• A verdict chip that distinguishes PERMITTED BY RULE from PERMITTED BY DEFAULT. This single distinction is the pane's reason to exist. S-1 is a permit-by-default: the request succeeded because nothing denied it, which no existing board can represent.
• Rules evaluated — an ordered list of every predicate the request passed, each with its verdict and source location: authenticate(caller) → PASS · auth/token.kt, validateRoomShape(room) → PASS · realtime/room.kt. This is 09.03's TRACE, rebased onto a real request.
• Checks not performed — the column that finds the bug. isMember(principal, room) → NEVER CALLED, annotated with a callsite census drawn from the live graph: defined · called from 2 sites · not on this path. A predicate that exists, is called elsewhere, and is absent from a path that reaches a protected resource is a computable, high-precision signal. This is exactly the reasoning the human audit performed, and on a live typed graph it is a traversal, not an insight.
• Counterfactual — a one-click re-evaluation reporting if isMember returned false, this request would still be PERMITTED. It converts "the check is missing" from a claim into a demonstration, and it is the control that would survive an argument with a sceptical engineer.
• Blast radius — 142k principals × N rooms, cashing out the promise 09.01 already makes in prose.
• Reachability — how many public routes reach this decision path.
• Truth, Effect and Permission fields plus the Origin / Observed / Confidence / Revision / Owner evidence block, per the 13.03 model board; and when the decision log is unwired, an explicit OBSERVED · not wired · decision log adapter absent rather than an empty pane.

The delta from what 09.03 already draws is small: a principal instead of a role, an instance instead of a class, a permit instead of a denial, and one new column. That is the most valuable design change available in this cluster.

09.04 · Map + State · Data Studio — Query, Schema & Lineage

On the board. A seven-tab strip Query · Schema · Data · Relationships · Query Plan · History · Migrations over a governed SQL console. The console is banded READ ONLY · target + tenant pinned · masked · writes → governed DataChange plan, targeted at POSTGRES · public.profiles marked local · tenant:synthetic · AUTHORITY, and the query itself is FIXTURE DRAFT · UNPREPARED with a PREPARE ONLY · bind circle_id + since · authorize tenant · 10 rows · 1 MB budget and a PREPARE control. The seven-line SQL includes the comment "Postgres-only draft; Memgraph join requires an explicit federated plan". Results are banded FIXTURE RESULT · 10 masked rows · no provider query receipt · design specimen over three rows. Below, a SOURCE SCHEMA · public.profiles · row count / p95 UNKNOWN column list (id text PK, handle text UQ CITEXT, email text UQ · IDX, location geography IDX PostGIS point · gist), and a store-card grid pairing each engine with its role: Postgres · AUTHORITY / ClickHouse · ANALYTICS PROJECTION, Memgraph · GRAPH PROJECTION / D1 · EDGE AUTHORITY, Durable Objects · INSTANCE STATE / ObjectDatabase · LOCAL WORKING SET, with observed state UNKNOWN and browse bounded.

Vision tie. This is the best board in the cluster and one of the better boards in the atlas. It embodies polyglot on one data plane and evidence together and without cheating. The store cards make authority a first-class visual property, and the SQL comment "Memgraph join requires an explicit federated plan" is the polyglot seam shown honestly rather than papered over. Every number on the board is either marked fixture or marked UNKNOWN.

Workflow tie. Opened several times a week by anyone answering a data question — the "top 10 most active users" query in the console is exactly the ad-hoc ask. Today that is TablePlus pointed at production with no tenant pin, no masking and no budget, which is the practice this board is designed to end.

Agentic tie. Excellent. An agent reads store authority, column types, index coverage and the budget envelope, and can compose a query it knows must be PREPAREd before running. writes → governed DataChange plan is the governing rule and it is stated on the band rather than implied. The no provider query receipt mark is precisely the signal an agent needs to avoid reporting fixture rows as findings.

Blueprint tie. The Content Browser plus the Reference Viewer — assets with their types, and what references what. referenced by 14 tables on the id column is literally a reference-count badge. The analogy is strong and the board should lean into it further.

Replaces / augments. TablePlus, DataGrip, pgAdmin, the Supabase SQL editor, dbt docs for lineage, and the ad-hoc half of Metabase or Hex.

Improvements.

1. Move AUTHORITY from the store card to the datum. The audit's finding is about which store is authoritative for what, and a per-store badge cannot express that identity is authoritative in Postgres while presence is authoritative in the Durable Object. Add an Authority column to the schema list, valued per column or per table.
2. Resolve the two-authority conflict the board creates. Postgres · AUTHORITY and D1 · EDGE AUTHORITY both appear with no rule for disagreement. Add a Conflict finding component — 13.03 already defines one — that fires when two stores claim authority for the same datum.
3. Add a Staleness field to each projection card. ClickHouse · ANALYTICS PROJECTION and Memgraph · GRAPH PROJECTION are read models, and their lag is the single most consequential fact a developer needs; eventually consistent appears zero times in the entire atlas.
4. Restore the Query tab on 09.05 and 09.06, which drop it — the same surface currently has two different tab strips.
5. Depict the Data tab. It is listed here and on both sibling boards and no board shows it.
6. Make referenced by 14 tables clickable into the graph; it is the one lineage affordance already present and it currently goes nowhere.

Verdict. Strengthen. This board should be the template the identity cluster is rebuilt against.

09.05 · State · Query Plan & Governed Migrations

On the board. A six-tab strip without Query. The upper pane shows an EXPLAIN (FORMAT JSON, COSTS, VERBOSE) statement over messages JOIN user_profiles, banded DESIGN FIXTURE · ESTIMATED PLAN ONLY · ANALYZE REQUIRES SEPARATE EXECUTION POLICY, with a five-node plan tree where every node carries its own hedge: Limit rows=50 · estimate, Sort · created_at DESC / estimated spill risk · not observed, Hash Join · sender_id / estimated rows · not observed, Seq Scan · messages / estimated scan · index coverage UNKNOWN, Index Scan · user_profiles_pkey / estimated lookup · not observed. Beneath it an INFERRED PROPOSAL · create index candidate · requires catalog refresh + bounded rehearsal, qualified "estimated improvement is not fact · compile DataChange plan → test on synthetic data → review". The lower pane is MIGRATIONS · SOURCE DESIRED STATE + OBSERVED LEDGER · NEVER CONSOLE CLICKS with four rows — 0040 add kept_buds table / SOURCE · applied state UNKNOWN, 0041 partition analytics_events monthly / SOURCE · state UNKNOWN, 0042 ix_messages_circle_created / FIXTURE · NOT OBSERVED, 0043 backfill sender denorm / SOURCE DRAFT · approval not requested — over an eight-stage contract from refresh catalog to receipt.

Vision tie. Strong on evidence and it is the clearest application in the cluster of the DESIRED + OBSERVED dual plane that 13.03 establishes. The header literally names both planes and then admits the observed plane is empty for all four rows. NEVER CONSOLE CLICKS is a real architectural commitment stated as a design constraint.

Workflow tie. Opened on the day a migration ships and during the postmortem of a slow query. The audience is one senior engineer and whoever must approve. Today this is Flyway plus a pganalyze tab plus a Slack thread asking whether 0041 actually ran in production.

Agentic tie. Well-governed. INFERRED PROPOSAL is the correct truth class for an agent suggestion, and "estimated improvement is not fact" is an instruction to the agent as much as to the human. An agent can propose the index and cannot apply it; the eight-stage contract names independent approval explicitly. The gap is that there is no place for the agent to attach the rehearsal result once obtained.

Blueprint tie. The cook and package pipeline with the asset validator attached — migrations as ordered cook steps, each gated by a validator, none of which may be skipped by hand. The NEVER CONSOLE CLICKS rule is the direct analogue of forbidding hand-edited cooked content.

Replaces / augments. Flyway, Liquibase, Atlas, gh-ost and pt-online-schema-change, PlanetScale deploy requests, and pganalyze for the plan half.

Improvements.

1. Split the migration row's single state chip into two columns, Desired and Observed. The header promises both planes; the rows collapse them into one string, which is why 0042 reads FIXTURE · NOT OBSERVED while 0040 reads SOURCE · applied state UNKNOWN for what is the same underlying condition.
2. Add a Lock analysis column with an estimated lock duration and blocked-query class per row. The eight-stage contract names "impact/lock analysis" and no column shows it.
3. Add an Applied at and Applied by pair, empty with a reason, so the ledger has a shape to fill rather than a prose UNKNOWN.
4. Make 0043 backfill sender denorm show its row estimate and its resumability, since a backfill is the migration class that most needs both and the one where approval not requested matters most.
5. Add a Rehearsal slot on the INFERRED PROPOSAL card that holds the synthetic-data result, so the proposal accumulates evidence rather than staying an estimate.

Verdict. Strengthen.

09.06 · State · Data Evidence & History

On the board. Three stacked panes on the same six-tab strip. First, a query history banded DESIGN FIXTURE · QUERY TEXT + PARAMETERS REDACTED BY DEFAULT · AUDIT ADAPTER NOT CONNECTED, listing eight timestamped entries with a mixed principal column — @shibasis, @agent claude, @agent codex, budbot chain, cron — each with an operation and hash (read.query · hash q_8f41…, DataChange receipt #9 · statement + subject redacted, profile.read · hash q_0c3a… · sensitive projection redacted), a duration, a row count and a status (slow ⚠, ok, command, plan saved, ok · rag). Second, FIXTURE SLOW-QUERY LANE · REQUIRES PROVIDER QUERY RECEIPTS with two entries, one pointing to inferred index proposal · migration applied state UNKNOWN. Third, BACKUP / RESTORE · OBSERVED EVIDENCE REQUIRED with four fields all UNKNOWN, each carrying its own reason: snapshots UNKNOWN · backup adapter not connected, WAL archive UNKNOWN · archive lag not observed, PITR window UNKNOWN · provider retention not observed, last drill UNKNOWN · no verified restore drill receipt; and a Restore… (dry-run diff first) control gated by "staged validation, sealed target/count/hash, break-glass identity, independent approval and resumable receipt".

Vision tie. This is the atlas's honesty high-water mark and the clearest realisation anywhere of §1's closing principle that a NotWiredYet stating what is missing beats an invented number. Four consecutive UNKNOWNs, each naming the specific adapter or receipt whose absence causes it, is EmptyReason used correctly — in prose rather than as a component, but used correctly. last drill UNKNOWN · no verified restore drill receipt is a better answer than any number a competitor's dashboard would print there.

Workflow tie. Two distinct moments. The slow-query lane is opened weekly by whoever owns performance. The backup block is opened once a quarter under duress, when someone asks whether the restore path has ever been tested — and this board's answer, "no verified restore drill receipt", is the answer most organisations discover only during the incident.

Agentic tie. The strongest agentic surface in the cluster, because the history pane treats @agent claude, @agent codex and budbot chain as first-class principals alongside humans and cron. That is §1's "agents as first-class operators" rendered concretely: agent activity is audited in the same ledger as human activity, with the same redaction policy. An agent reading this board sees its own footprint.

Blueprint tie. Unreal Insights plus the autosave and backup recovery panel — a trace store of what ran, joined to a recovery surface. The analogy is apt including the fact that in Unreal, too, the backup panel is the one nobody exercises until the day it matters.

Replaces / augments. pganalyze, pgBadger, Datadog Database Monitoring, the AWS Backup and RDS PITR consoles, and the query-audit half of a SIEM.

Improvements.

1. Add a Principal class filter (human · agent · service · cron) to the history pane. The board already carries the distinction in its data and offers no way to slice by it.
2. Give the four backup fields a target column beside the UNKNOWN, so the pane states the intended RPO and RTO next to the unobserved actual. An unknown against a stated target is actionable; an unknown alone is only honest.
3. Add an Authority badge to each history row naming which store served it, connecting this board to 09.04's authority model.
4. Escalate last drill UNKNOWN into a finding with an owner rather than a field. It is the highest- severity fact on the board and it renders identically to the other three.
5. Add a Reads served from projection marker on rows whose data came from ClickHouse or Memgraph, since a slow query against a read model has a different remedy from one against the authority.

Verdict. Keep. This board is doing its job and should be cited as the standard for the rest of the atlas.

STATE · Composer · 1 of 5 · Product Intent

On the board. A left SYSTEM COMPOSER stepper (1 Product intent … 5 Bootstrap review) over a static TARGETS rail reading Android · iOS · Web / Workers · JVM server / Postgres · D1 · ClickHouse / Memgraph · R2 · Pub/Sub. The centre is headed "Define product intent" with the contract "Every decision becomes a semantic graph delta, generated artifact, validation finding, and sealed plan", chipped DRAFT · NO SIDE EFFECTS, above GENERATED SYSTEM GRAPH · PROPOSED marked SOURCE with four cards — Interface 3 apps · 18 routes, Runtime 7 services · 12 workers, State 6 engines · 42 schemas, Delivery 8 targets · 14 gates, each with Open in Graph ↗ — and EXACT BOOTSTRAP PLAN 0 / 5 executed listing 01 Validate contracts ready, 02 Generate GraphSpec + source ready, 03 Dry-run providers blocked, 04 Apply approved plan blocked, 05 Verify + issue receipt blocked. A right rail holds GOVERNANCE & EVIDENCE (Truth SOURCE, Maximum effect LOCAL WRITE, Permission APPROVAL REQUIRED), PENDING DECISIONS · 2 (Data residency · asia-south1, Rollback window · 15 minutes) and a RECEIPT PREVIEW reading Plan not sealed, Actor local human, Revision spec@8f41c2, Target workspace only, Rollback not applicable.

Vision tie. The framing sentence is the vision stated well — a decision becoming a graph delta and a sealed plan is exactly the thesis. The board then contradicts it. This is step one, "Product intent", before any input has been given, and it already asserts 3 apps · 18 routes, 7 services · 12 workers, 6 engines · 42 schemas and 8 targets · 14 gates, marked SOURCE. The output is fully specified before the first input exists. If the diagram and the system are the same object, a diagram of a system nobody has yet described is the one thing the thesis forbids.

Workflow tie. Opened once, ever, per product. That is the honest weight of a "new system" screen, and it argues against spending five boards on it. Today this is rails new, create-next-app, or a Backstage software template.

Agentic tie. Hostile in an interesting way. There is no visible input control anywhere on the board — no text field, no picker, nothing that accepts intent. An agent reading it cannot determine what it is being asked to supply. Commit is the only action, and PENDING DECISIONS · 2 names two decisions with no control to decide them.

Blueprint tie. Unreal's new project wizard with its template gallery. The comparison is unflattering: Unreal's wizard is one screen with thumbnails, a blueprint-or-C++ toggle and a target platform picker, and it produces a running project. This is five screens that produce a summary.

Replaces / augments. create-next-app and rails new, Terraform and Pulumi init, Backstage software templates, the Firebase and Amplify project-creation flows.

Improvements.

1. Put an input on the input step. A product-intent step needs a name, a one-line description, a domain and a template picker, and none of the four exists.
2. Empty the GENERATED SYSTEM GRAPH cards until something generates them. At step one every card should read — · awaiting intent, not a specific count marked SOURCE.
3. Change the four cards' truth chip from SOURCE to PROPOSED · derived from template once a template is chosen. SOURCE asserts these counts came from real source, which is a stronger and falser claim than fixture.
4. Turn PENDING DECISIONS · 2 into two controls with defaults and an owner, since a decision the user cannot make is a label.
5. Collapse the stepper into a progress control on a single Composer board — see the verdict.

Verdict. Merge into a single STATE · Composer board with the stepper as a control.

STATE · Composer · 2 of 5 · Product Graph

On the board. Byte-identical to step 1 except for six lines: the title, three breadcrumb echoes, the headline "Shape the semantic product graph", the Next: resolve 3 graph findings line, and the footnote "Draft graph · base revision spec@8f41c2". The stepper, targets rail, generated-graph cards, bootstrap ledger, governance rail and receipt preview are unchanged.

Vision tie. This is the step that should carry the entire weight of §1 — the semantic product graph is the framework's central object — and it shows no graph. The pane where a user would shape nodes and ports is occupied by the same four summary cards shown on every other step. The board names the vision and depicts none of it.

Workflow tie. The one step in the wizard that would genuinely take an afternoon, given eight lines of screen. Today this is a whiteboard photo, and the honest observation is that 04.02 · Map · Semantic Graph Editor already exists in this atlas and is where this work belongs.

Agentic tie. Next: resolve 3 graph findings is the most agent-relevant string on any Composer board — three specific findings an agent could triage — and the findings are never listed. An agent gets a count and no payload.

Blueprint tie. This should be the Blueprint graph editor itself and instead it is the project-settings summary page. That is the sharpest instance in the cluster of the Blueprint analogy being invoked and not honoured.

Replaces / augments. Nothing, as drawn. As intended, it overlaps 04.02 and the schema-design half of Terraform module authoring.

Improvements.

1. Embed the graph canvas from 04.02 as this step's body rather than repeating the summary cards. The Open in Graph ↗ controls already point at it; the step should host it.
2. List the three findings with severity, node and a resolve control. A count with no list is the board's central failure.
3. Show a node and port inventory that changes as the graph is edited, replacing the frozen 3 apps · 18 routes.
4. Add a Port type identity validation row to the findings list. Defect D-6 — string-built ports carrying a null class and connecting to anything — is a graph-authoring defect that this step is the natural place to catch, and it is exactly the class of finding the composer should refuse to proceed past.

Verdict. Merge into 04.02 · Map · Semantic Graph Editor, which already does this properly.

STATE · Composer · 3 of 5 · Targets & Capabilities

On the board. The most-diverged of the five steps, and the only one re-authored in the V2 chrome — its header reads composer: 3 / 5 and draft · no side effects where the others read surface: and projection: designed, its revision chip reads spec@8f41c2 rather than 8f41c2, and its footer reads policy not evaluated rather than policy required. Its capability content in full is four strings: the headline "Select targets and capability packs", the chip DRAFT · CAPABILITY CHECK, the line Next: confirm target capability coverage, and a footer reading Source projection · 8 targets · 4 capability gaps · no side effects. Its footnote is "Targets proposed · provider access not exercised." The body is the same generated-graph cards and bootstrap ledger as every other step.

Vision tie. This is where §1's adapter-and-capability model must live, and it is absent. Four capability gaps are asserted and not one is enumerated. The word tier does not appear on this board; across the whole atlas it appears on three boards, none of them this one. The word degradation, in any form, appears zero times in all 104 boards — so the vision's sentence "degradation is designed, not discovered" has no representation anywhere in the product atlas, and this is the board whose title promises it. There is also a category error in the TARGETS rail, which mixes platforms (Android · iOS · Web) with services (Postgres · R2 · Pub/Sub) on one list; a platform lacks biometric auth, a datastore lacks transactions, and one axis cannot tier both.

Workflow tie. This is the step that determines what the product can never do on one of its targets, which makes it the highest-consequence screen in the wizard and the one most likely to be clicked past. Today the answer is discovered six months later when a feature ships broken on web.

Agentic tie. The most valuable possible agentic surface in this cluster and currently the emptiest. A capability matrix is a machine-checkable contract: an agent could verify that no node branches on platform, propose a degradation route for an absent cell, and refuse a plan whose target set has an undesigned gap. As drawn, an agent reads the number 4 and nothing else.

Blueprint tie. Unreal's platform settings and device profiles — per-platform feature support with scalability tiers and explicit fallbacks. Unreal's version is a real matrix with real tiers, and this board is the label of that matrix without the matrix.

Replaces / augments. Unreal device profiles, caniuse and browser support matrices, Expo's config plugins, LaunchDarkly when it is misused as a platform-capability switch.

The pane to build: Capability Matrix. Platforms down one axis, capabilities across, a tier in each cell.

• Rows split into two blocks, because they tier differently: Devices (Android, iOS, Web, Desktop) and Services (Workers, JVM server, Postgres, D1, ClickHouse, Memgraph, R2, Pub/Sub).
• Columns are capabilities declared by the graph's adapters, not invented for the board: biometric-auth, background-push, secure-enclave, filesystem, websocket, transactions, full-text-search, geo-query, blob-range-read, cron.
• Cells carry one of five tiers: FULL, PARTIAL, EMULATED, ABSENT, and — the honest default given §2 — UNKNOWN · adapter not probed. Most cells in this product are UNKNOWN today and the matrix should say so rather than fill itself in.
• The empty cell is the point. Every ABSENT or PARTIAL cell must name its degradation route and its owner: Web × background-push = PARTIAL · service worker only · degrades to in-app banner · owner @platform. A cell with no route renders as a finding, UNDESIGNED DEGRADATION · product code will branch on platform. That single cell state turns the vision's sentence into an enforceable lint, and the count of such cells is the honest replacement for the bare 4 capability gaps, which should read 4 gaps · 2 undesigned.
• Column footer carries consumers · N nodes branch on this capability and a branches on platform · N violations counter, each violation opening the offending node via the Open in Graph ↗ control the board already has. This is the direct, computable check that product code branches on capability and never on platform — the rule §1 states and no board enforces.
• Row footer carries the target's coverage and whether any capability it lacks is required by a committed feature, which is the fact that should block the bootstrap plan.

Improvements. Build the matrix above as the step's body; split the TARGETS rail into devices and services; make the rail a selector rather than a caption, since the headline says "Select" and no control selects; replace 4 capability gaps with the gap list; and re-author steps 1, 2, 4 and 5 into this board's V2 chrome so the wizard speaks one grammar.

Verdict. Rebuild. This is the one Composer step that earns its own board, and it is currently the emptiest.

STATE · Composer · 4 of 5 · Policies

On the board. Six lines different from step 1: the headline "Define policies, budgets and gates", the chip VALIDATING · POLICY ONLY, the line Next: resolve 2 policy decisions, and the footnote "Simulation is pure · no policy has been applied." No policy, budget or gate is shown anywhere on the board; the body remains the generated-graph cards and the bootstrap ledger.

Vision tie. None as drawn. The footnote "Simulation is pure · no policy has been applied" is a genuinely correct and well-stated position — it is the same claim 09.03 earns with its simulator — but here it describes a simulation that has no visible subject.

Workflow tie. This is where residency, retention, budget ceilings and approval gates are set for the life of the system, which in practice happens in a Terraform variables file six weeks later.

Agentic tie. Next: resolve 2 policy decisions refers to the same PENDING DECISIONS · 2 shown on all ten Composer boards — Data residency · asia-south1 and Rollback window · 15 minutes. Those two decisions never resolve; they persist unchanged into Provisioning · Complete. An agent tracking them would observe a system reach verified completion with its policy decisions still pending.

Blueprint tie. Unreal's project settings tree. The analogy is fine and the board does not honour it: project settings has hundreds of leaves and this has none.

Replaces / augments. Terraform variable files, OPA bundle authoring, LaunchDarkly's approval settings, cloud organisation policy consoles.

Improvements.

1. Show the policy list. 09.01 already draws exactly the right component — Policies · 7 with a name, a value and an + Add policy control — and this step should reuse it rather than show nothing.
2. Add a budget block with concrete ceilings per target, since the headline promises budgets and nothing on the board mentions cost.
3. Make the two pending decisions resolvable here and have them disappear from the governance rail once resolved, which is the only way the rail's count becomes meaningful.
4. Add a gate list mapping each gate to the bootstrap step it blocks, connecting this step to the blocked states in the ledger that no board explains.

Verdict. Merge into STATE · Composer, reusing 09.01's policy list component as its body.

STATE · Composer · 5 of 5 · Bootstrap Ready

On the board. Six lines different from step 1: the headline "Review the complete bootstrap plan", the chip PLANNED · AWAITING APPROVAL, the line "Plan hash changes if targets, policy or revision drift", the footnote "Receipt will bind plan, actor, approver, targets and verification", and one substantive change in the governance rail — Maximum effect escalates from LOCAL WRITE to REMOTE REVERSIBLE.

Vision tie. Two genuinely excellent lines. "Plan hash changes if targets, policy or revision drift" is the fingerprint idea from §2's verification program applied correctly to a plan, and it is one of only two places in the atlas where fingerprinting appears at all. "Receipt will bind plan, actor, approver, targets and verification" is a precise statement of what a receipt is for. The escalation of Maximum effect at the moment of approval is the right control at the right step.

Workflow tie. The approval moment: two people at one screen, one of whom is accountable. This is the step that most deserves to exist as its own board.

Agentic tie. Well-governed in principle. A plan hash that changes on drift is exactly what prevents an agent replaying a stale approval, and the board says so. What is missing is the hash itself — no plan hash is shown on this board, though Provisioning · Running displays plan 05e2…a91f, so the artefact exists one board later and not on the board that reviews it.

Blueprint tie. The package and cook confirmation dialog before a build is submitted. Apt.

Replaces / augments. terraform plan output, Pulumi preview, PlanetScale deploy requests, GitHub environment protection rules.

Improvements.

1. Show the plan hash. The board's entire argument rests on it and it is not displayed.
2. Show the full ordered plan with per-step effect class, not the same five-line summary as step 1. A review step must render the thing being reviewed.
3. Fix RECEIPT PREVIEW, which still reads Target workspace only and Rollback not applicable while Maximum effect on the same rail now reads REMOTE REVERSIBLE. Those cannot both be true.
4. Add an Approver field distinct from Actor local human; the footnote promises the receipt binds an approver and the preview has no slot for one.
5. Add a diff against the previous plan hash, so re-approval after drift shows what drifted.

Verdict. Strengthen. This is the one wizard step that should survive as its own board.

STATE · Composer · Provisioning · Running

On the board. The headline is "Provisioning the approved system", chipped APPLYING · NON-PROD WRITE, with Maximum effect REMOTE REVERSIBLE, a ledger header reading 3 / 5 executing, a status line "Step 03 · provider changes in progress · cancellation available", and a footnote run_0182 · plan 05e2…a91f · evidence streaming. The five ledger rows themselves read 01 Validate contracts ready, 02 Generate GraphSpec + source ready, 03 Dry-run providers blocked, 04 Apply approved plan blocked, 05 Verify + issue receipt blocked.

Vision tie. "Evidence streaming" attached to a named run with a plan hash is the right idea. It is contradicted immediately below by a ledger in which step 03 — the step the status line says is in progress — is marked blocked, and steps 01 and 02, which must have completed for 03 to be running, are marked ready. The one widget that could show live state shows the pre-execution state.

Workflow tie. The screen someone stares at for four minutes while infrastructure changes. Its entire value is per-step progress, and per-step progress is the one thing it does not have.

Agentic tie. An agent watching this cannot determine which step is executing except by parsing the prose status line, because the structured ledger disagrees with it. cancellation available is stated with no cancel control shown.

Blueprint tie. The cook progress dialog and its message log. The comparison is precise and damning: Unreal's cook log is a live per-asset ledger with a result on each line, which is exactly the component this board needs and lacks.

Replaces / augments. terraform apply output, Pulumi's update view, an Argo rollout view, a GitHub Actions run page.

Improvements.

1. Make the ledger live. Per-row states must include done, running, blocked, failed, skipped and rolled back; today all five rows are frozen at ready/blocked in every one of the five provisioning states.
2. Add per-row elapsed time and a provider name, since a provisioning run's cost is concentrated in one or two steps and the board cannot show which.
3. Add the cancel control the status line promises, with its own effect class and confirmation.
4. Change Truth from SOURCE to OBSERVED on all provisioning boards. A run in progress is observation; SOURCE is the truth class of the plan, not of its execution.
5. Attach the streaming evidence to a visible target — a log pane or an evidence count — so "evidence streaming" is a state rather than a claim.

Verdict. Strengthen into the single canonical provisioning board, parameterised by run state.

STATE · Composer · Provisioning · Complete

On the board. Eight lines different from Running: the headline "Bootstrap verified", the chip VERIFIED · RECEIPT ISSUED, the ledger header 5 / 5 verified, the status line "All postconditions passed · graph and source reconciled", and the footnote receipt_0182 · verified · rollback window 15m.

Vision tie. "Graph and source reconciled" is the thesis stated as a postcondition, and it is the correct thing to verify. The board then fails to show a single reconciliation. Worse, 5 / 5 verified sits directly above three rows marked blocked and two marked ready — not one row says done. And the right rail, unchanged from step 1 of the wizard, still reads Plan not sealed, Target workspace only, Rollback not applicable and PENDING DECISIONS · 2, on a board whose footnote says a receipt was issued with a fifteen-minute rollback window. The screen contradicts itself in four places simultaneously.

Workflow tie. The screenshot pasted into Slack. That is its real function, which raises the stakes on its accuracy rather than lowering them.

Agentic tie. Actively dangerous for an agent. An agent parsing this board for completion state finds 5 / 5 verified in the header, blocked in three ledger rows, not sealed in the receipt, and verified in the footnote. Any automation built on it would key off whichever field its author happened to read.

Blueprint tie. The cook-succeeded dialog. Unreal's version reports assets cooked, warnings and errors as counts; this reports a summary with no counts behind it.

Replaces / augments. The tail of terraform apply, a green Actions checkmark.

Improvements.

1. Mark all five ledger rows done with timestamps, which is the minimum for the header claim to be true.
2. Fill the receipt: Plan sealed 05e2…a91f, Target naming the real provider set, and Rollback available until T with a live countdown against the fifteen-minute window.
3. Clear PENDING DECISIONS · 2 or explain why a verified system still has pending decisions.
4. Show the postcondition list. "All postconditions passed" is a claim with no enumerable subject; each postcondition should be a row with its check and its evidence.
5. Add a Verify re-run control, since verification of a live system is repeatable and its result ages.

Verdict. Merge into Provisioning · Running as its terminal state.

STATE · Composer · Provisioning · Failed

On the board. Eight lines different from Running: the headline "Provisioning failed safely", the chip FAILED · RECOVERY AVAILABLE, the ledger header 3 / 5 failed, the status line "No optimistic success · observed state is Unknown until reconcile", and the footnote run_0182 · failed · partial effects reconciled.

Vision tie. "No optimistic success · observed state is Unknown until reconcile" is the single best sentence on any Composer board and one of the best in the atlas. It is the correct distributed-systems position, stated more precisely than most production tools state it, and it is exactly §1's evidence principle applied to a failure. Everything below it then betrays it: no ledger row is marked failed, the header says three of five failed while rows 01 and 02 read ready and 03 through 05 read blocked, and "partial effects reconciled" in the footnote directly contradicts "observed state is Unknown until reconcile" in the status line — one says reconciliation has happened, the other says it has not.

Workflow tie. The most important board of the ten. A half-provisioned system across Cloudflare, GCP, Postgres, ClickHouse and Memgraph is the genuinely hard operational state, and it is the state this board is named for.

Agentic tie. An agent's correct behaviour on partial failure is to reconcile before acting, and the status line tells it so. It then has nothing to reconcile against, because no per-resource state is shown anywhere.

Blueprint tie. A cook failure with its message log. Unreal's message log names the asset, the error and the file; this names none of the three.

Replaces / augments. A terraform apply failure with a partial state file, which is precisely the situation this board should be better at than Terraform.

Improvements.

1. Add the pane the board exists for: a partial-effects table with one row per provider resource, each carrying created, not created, orphaned or unknown, its provider, and its reconciliation action. Without it "failed safely" is an assertion.
2. Mark row 03 failed with its error and provider, and rows 04 and 05 skipped, not blocked.
3. Resolve the reconciliation contradiction: either the footnote reads partial effects NOT yet reconciled or the status line drops "until reconcile". As drawn the same screen makes both claims.
4. Add a Reconcile control as a first-class action beside recovery, since the status line makes it the precondition for everything else.
5. Name what the failure blocks downstream — which of the eight targets are now unusable — since that is the decision the operator must make in the next minute.

Verdict. Strengthen. This board needs the most work and would deliver the most value.

STATE · Composer · Provisioning · Retry

On the board. Eight lines different from Running: the headline "Prepare a fingerprint-bound retry", the chip PLANNED · RE-APPROVAL REQUIRED, the ledger header 3 / 5 retained, the status line "Retry is a new plan; old approval cannot be replayed", and the footnote retry_0183 · new nonce · awaiting independent approval.

Vision tie. "Retry is a new plan; old approval cannot be replayed", together with new nonce and fingerprint-bound, is the correct and non-obvious security position on retry, and fingerprint is one of only two occurrences of that word in the entire atlas — the keystone primitive of §2's verification program, appearing here almost by accident. The ledger header 3 / 5 retained implies a resumability model that no row expresses, since all five rows are identical to every other provisioning board.

Workflow tie. Five minutes after the failure, with someone else needed for the second approval.

Agentic tie. The strongest governance statement in the cluster: an agent explicitly cannot replay an approval, and the retry requires an independent approver. This is what §1 means by governed, permissioned interfaces. There is no visible control by which an agent or human requests that approval.

Blueprint tie. Re-cooking only failed assets. Unreal shows which assets are being retried; this shows a count.

Replaces / augments. terraform apply after a failure, a GitHub Actions re-run-failed-jobs button — and the board is right that both of those are unsafe by comparison, because both replay an old approval.

Improvements.

1. Show which three steps are retained and which two re-execute, per row, since 3 / 5 retained is the board's core claim.
2. Show the old and new fingerprints side by side with the drift that forced a new plan. A fingerprint-bound retry should display both fingerprints.
3. Add the approval request control and an approver field, since awaiting independent approval currently has no path to being satisfied.
4. Show what changed between run_0182 and retry_0183 beyond the nonce.

Verdict. Merge into Provisioning · Failed as its recovery pane.

STATE · Composer · Provisioning · Rollback

On the board. Nine lines different from Running, and the only Composer board whose environment chip reads PROD rather than LOCAL. The headline is "Recover through a governed rollback", chipped ROLLING BACK · VERIFIED STEPS, ledger header 4 / 5 recovery, status line "Rollback is a new operation with its own evidence and receipt", footnote rollback_0184 · restored snapshot · verifying.

Vision tie. "Rollback is a new operation with its own evidence and receipt" is correct and important — it refuses the common fiction that rollback returns a system to a previous state for free. Against that, this board is marked PROD while its receipt preview, unchanged from every other Composer board, reads Target workspace only and Rollback not applicable. A production rollback board asserting that rollback is not applicable is the sharpest single contradiction in the cluster.

Workflow tie. The worst hour of someone's quarter, in production, probably at night.

Agentic tie. Correctly framed — a rollback as a new governed operation is something an agent can be permitted to propose and forbidden to execute — but the board carries Permission APPROVAL REQUIRED identically to the draft steps, so the permission model does not escalate for a production recovery.

Blueprint tie. Restoring from a backup and re-cooking. restored snapshot · verifying is the right shape; the verification has no visible subject.

Replaces / augments. terraform state surgery, a Pulumi refresh-and-destroy, a database PITR console — and it connects naturally to 09.06's backup block, which is where the snapshot's provenance lives.

Improvements.

1. Fix the receipt rail for PROD: real target, Rollback applicable, sealed plan, and a break-glass identity field matching the one 09.06 requires for restore.
2. Show which steps are being rolled back and in what order, since rollback order is the substance of the operation and 4 / 5 recovery conveys none of it.
3. Link the restored snapshot to its record in 09.06, where snapshot provenance currently reads UNKNOWN · backup adapter not connected — the two boards must agree on whether a snapshot exists.
4. Escalate the permission chip beyond APPROVAL REQUIRED for a production recovery, and show the break-glass path.
5. Show what remains un-rolled-back — the effects that cannot be undone — which is the one fact an operator most needs and no board in the atlas states.

Verdict. Strengthen. Rollback is legitimately a distinct operation with its own plan and receipt, and the board is right to exist.

On the Composer as onboarding

Five steps plus five states is the wrong weight, and the boards prove it themselves. Nine of my sixteen boards are one wizard; a tenth, 02.01 · Create · New System Composer, is a duplicate of step 3, carrying the identical strings "Select targets and capability packs", DRAFT · CAPABILITY CHECK, "Next: confirm target capability coverage" and "Targets proposed · provider access not exercised." Eleven boards, roughly a tenth of the atlas, are spent on a screen a user visits once per product. The variation across them is six to nine lines out of 119. Four of the five wizard steps have no step-specific body content of any kind — the same four summary cards and the same five-row ledger appear on all of them. The correct shape is one STATE · Composer board with the stepper as a control, plus one genuinely distinct step (Targets & Capabilities, rebuilt around the matrix above), plus the approval review, plus one run board parameterised by state.

The provisioning states are honest in prose and dishonest in structure. Their captions are excellent, and better than most shipping tools manage: "No optimistic success · observed state is Unknown until reconcile", "Retry is a new plan; old approval cannot be replayed", "Rollback is a new operation with its own evidence and receipt". Somebody with real distributed-systems judgment wrote those sentences. But the five-row bootstrap ledger beneath them is byte-identical in all five states — 01 ready, 02 ready, 03 blocked, 04 blocked, 05 blocked — so Complete claims 5 / 5 verified above three blocked steps, Failed claims 3 / 5 failed with no failed row, and Rollback claims 4 / 5 recovery with nothing rolled back. The one widget capable of expressing partial failure never changes. The claims about partial failure are made in captions and refuted by the only structure on the screen. The same is true of the receipt rail, which is identical across all ten boards including Complete and Rollback, producing the not sealed / receipt issued and PROD / workspace only contradictions noted above.

The output is not credible given the audit, and the boards never say so. The plan promises Dry-run providers then Apply approved plan across Cloudflare, GCP, Postgres, D1, ClickHouse, Memgraph, R2 and Pub/Sub, with fingerprint-bound retry, nonce replay protection and governed rollback. The audit says there is no CI, that the distributed plane has no queues at all and every pipeline is waitUntil fire-and-forget, and that notifications have no idempotency. A provisioning engine with exactly-once retry and rollback semantics across eight providers is strictly harder than an idempotent notification send, and the notification send does not exist. Nothing on any of the ten boards marks the provisioner as unbuilt. Truth: SOURCE is doing that work implicitly, but SOURCE means "this is the designed state", which reads as a statement about the system rather than about the board. Compare 09.06, two clusters away, which simply writes backup adapter not connected and is immediately understood. The Composer needs the same sentence: provisioning adapter not connected · no provider access exercised. Its step-3 footnote already says "provider access not exercised", so the vocabulary exists on the board and is applied to targets rather than to the engine.

On data authority

09.04 makes authority legible and is close to the only board in the atlas that does. A developer can read directly off it that Postgres is AUTHORITY, ClickHouse is an ANALYTICS PROJECTION, Memgraph is a GRAPH PROJECTION, D1 is EDGE AUTHORITY, Durable Objects hold INSTANCE STATE and ObjectDatabase is a LOCAL WORKING SET. That vocabulary is consistent, it is placed on the store card where it is unmissable, and the SQL comment "Postgres-only draft; Memgraph join requires an explicit federated plan" shows the seam between two of them rather than hiding it. 09.05 extends this correctly into time with SOURCE DESIRED STATE + OBSERVED LEDGER, and 09.06 extends it into evidence with four honest UNKNOWNs.

Three things a developer still cannot determine. First, authority is marked per store, not per datum, so the board cannot express that user identity is authoritative in Postgres while presence is authoritative in the Durable Object and a friendship edge is authoritative in Memgraph — which is exactly the granularity at which the audit established authority. Second, two stores carry an authority badge (Postgres · AUTHORITY and D1 · EDGE AUTHORITY) with no stated rule for disagreement and no Conflict finding, though the atlas defines that component on 13.03. Third, and most consequentially, the read model's lag is invisible: the phrase eventually consistent appears zero times across all 104 boards, and neither projection card carries a staleness figure. A developer reading 09.04 learns that ClickHouse is a projection and learns nothing about how far behind it is, which is the only fact that determines whether they may use it for the question they are asking. That is the gap between marking authority and making authority usable.

Cluster findings

Missing panes.

• 09.07 · Decision Record — the reference monitor. One real request, its verdict, the rules that fired, and a Checks not performed column with a callsite census. Nothing in the atlas explains a permit; S-1 is a permit-by-default and is therefore unrepresentable today. (§2, S-1.)
• 09.08 · Resource Graph & Membership. Principals and resource instances with the relationship edges between them — who is in which room, who owns which profile. RBAC by resource class cannot hold instance-scoped rules, and membership appears on four boards atlas-wide, none of them in the identity cluster. (§1 typed port graph; §2 S-1.)
• Identity · Providers. The identity tab strip promises it on three boards and no board builds it. It is also the only place S-4's shape — FCM endpoints stolen by re-registering a token — could live, since token registration is provider configuration and nothing else in the atlas owns it. (§2.)
• Identity · Audit. Promised by the same tab strip, never built. 09.06 audits data access; identity events — grants, role changes, revocations, break-glass — have no home. (§1 evidence.)
• Capability Matrix. Platform by capability by tier, with a degradation route in every non-full cell. degradation appears zero times in 104 boards and tier on three, none of them the board titled Targets & Capabilities. (§1 adapter + capability.)
• Read-Model Freshness. Projection lag per store, with the staleness budget each consumer tolerates. eventually consistent appears zero times atlas-wide while the audit establishes the read model is eventually consistent. (§2.)
• Negative Authorization Tests. 01.02 states Source finding · negative authorization tests required and 09.01 promises "run negative tests" in prose; no board shows the suite, its coverage, or which resources have zero negative tests. This is the L1/L2 rung of the verification program applied to authorization. (§2.)
• Composer · Provider Preflight. Credentials, quotas and permissions checked per provider before 03 Dry-run providers — the step whose absence explains why 03 is blocked on every board and which the audit implies has no implementation. (§2.)

Seams.

• The identity tab strip promises six destinations and the atlas builds four. Providers and Audit are dead links on 09.01, 09.02 and 09.03 alike, while Security and Simulator share one board.
• The state tab strip differs between siblings. 09.04 has seven tabs beginning with Query; 09.05 and 09.06 have six and drop Query, so navigating from the console to the plan loses the console. The Data tab is listed on all three and depicted on none.
• 01.02 is ahead of the boards it should feed. The chat.membership authorization gap, the Principal → token → resource decision → repository → audit evidence path, 12 findings · 3 blocking and negative authorization tests required all live on the North Star board. The three working identity boards carry none of them, and 09.03 contradicts the finding count outright with High-risk findings 1.
• 02.01 and STATE · Composer · 3 of 5 are the same screen, string for string. The atlas contains eleven Composer boards for a once-per-product flow.
• The Composer speaks two grammars. Step 3 alone carries V2 chrome (composer: 3 / 5, draft · source, policy not evaluated, revision spec@8f41c2) while steps 1, 2, 4, 5 and all five provisioning boards carry V1 chrome (surface:, projection: designed, policy required, revision 8f41c2). One wizard, two design systems.
• Revision does not survive. 09.x boards read main@8f41c2; Composer boards read main@8f41c2 in the breadcrumb and spec@8f41c2 in the receipt, and step 3 reads spec@8f41c2 in the header while its own breadcrumb still reads main@8f41c2. The Symphony Contract promises revision survives every movement.
• Chrome does not respond to state. Every one of the sixteen boards ends policy required and performance · unmeasured, including Provisioning · Complete, which claims a verified system with an issued receipt, and including 09.03, whose subject is policy. Inspect evidence and Evidence & execution ⌘J appear on all sixteen and no board shows what either yields.
• The Composer never links to the identity cluster. A wizard that provisions Postgres, sets a data-residency policy and issues receipts has no path to 09.01's policy list, 09.04's store authority or 09.06's backup evidence, though it creates the subjects of all three.

Honesty audit.

• 09.01 is the cluster's worst offender and one of the atlas's worst. Roughly twenty numbers — 89k, 41k, 11k, 4, 22, 184, 142k, 31k, 42 perms, 36, 24, 14, 10/min, 30/min, 4 ranges, 24h, 4h, 12 char, 90d, Policies · 7 — with no fixture mark, no adapter note and no truth component anywhere on 268 lines. Last change 3m ago by @shibasis is a freshness claim with no FreshnessStamp. Unlike its two siblings it does not even mark in prose, which places it in §3's forty-nine. The honest version marks the whole IDENTITY PLANE rail FIXTURE · identity adapter not connected, and replaces the permission matrix's confident C R U D grid with a grid that distinguishes granted from enforced.
• 09.03 asserts a security posture that contradicts known ground truth. High-risk findings 1, Medium 3, Healthy 8, MFA adoption 62% · goal 90%, SECURITY POLICIES · 12, last rotated 142d ago, last 38d ago, all unmarked. The audit found twelve security findings including a critical authorization bypass; 01.02 in the same atlas says 12 findings · 3 blocking. The board reports one high-risk finding and eight healthy policies. This is not merely unmarked data — it is data that is wrong by an order of magnitude against a known figure that another board in the same file states correctly. The honest version reads 12 findings · 3 blocking · S-1 critical and marks the posture block no scanner wired. Run security scan should likewise name the scanner or be disabled, since no CI exists.
• 09.02 marks in prose and then contradicts its own mark. Sessions — 42,118 active · across 142 countries sits one line above session adapter not connected. Four provenance strings on the board make it one of the better-marked boards in the atlas and none of them covers the header. The honest version reads Sessions — UNKNOWN · session adapter not connected, demotes 42,118 into the fixture band with the region counts, and binds all four marks to components so the atlas query can see them.
• The ten Composer boards assert a generated system before anything generates it. 3 apps · 18 routes, 7 services · 12 workers, 6 engines · 42 schemas, 8 targets · 14 gates appear identically on all ten, chipped SOURCE, including on step 1 before any input exists. SOURCE is a stronger and falser claim than FIXTURE would be. 4 capability gaps is asserted and never enumerated. PENDING DECISIONS · 2 persists into Provisioning · Complete. The honest version empties the cards until a template or an intent populates them, and marks the provisioning engine provisioning adapter not connected · no provider access exercised, reusing the sentence pattern that 09.06 already uses well.
• The five provisioning states assert run outcomes over a frozen ledger. 5 / 5 verified, 3 / 5 failed, 3 / 5 retained and 4 / 5 recovery all sit above the same five rows reading ready, ready, blocked, blocked, blocked. Complete claims receipt_0182 · verified beside Plan not sealed and Rollback not applicable; Rollback is chipped PROD beside Target workspace only. The honest version drives every ledger row and every receipt field from the run state, so the four headline fractions are computed from the rows rather than typed above them.
• 09.04, 09.05 and 09.06 are the model and should be cited as such. FIXTURE DRAFT · UNPREPARED, no provider query receipt · design specimen, row count / p95 UNKNOWN, estimated spill risk · not observed, SOURCE · applied state UNKNOWN, AUDIT ADAPTER NOT CONNECTED, and last drill UNKNOWN · no verified restore drill receipt are what §1's evidence principle looks like when someone actually applies it. Every board in the identity cluster should be re-authored against the standard these three already meet — and they sit in the same cluster, under the same shell, three boards away.