Nodes

A node identifies a meaningful participant: a computation, state owner, resource, boundary, record or composition. Its ports expose the contracts other participants can use. A node's visual card preserves that identity; its Kotlin implementation supplies behavior.

Start with feed ranking, sending messages, checkout recovery, nested navigation, offline edits and Shadow replay. Each task includes the surrounding decisions, authorities and failure paths.

Behavior, composition and domain roles

The forty source labels are a vocabulary, not forty mandatory runtime classes. A single implementation may have several roles: a media transform can be pure, stream frames, or own a native codec. Encode those laws in contracts and implementation bindings rather than inventing a cross-product of node classes.

Consolidation decisions

Use N15 as the adapter role, with N19 and N30 describing external API and opaque-boundary scope. Keep N16's allocation/lifetime contract explicit. Treat N17, N18 and N34 as domain labels over computation or effects. Model N03, N04, N06 and N08 as declared control compositions with ordinary Kotlin logic. N23 is a transaction composition around a named authority; N25 is a sync composition with a declared conflict policy. N38 does not need a privileged runtime node: a bounded visitor can be ordinary Kotlin code over a snapshot. N39 is inference plus proposal logic, and N40 is admitted lifecycle orchestration.

These consolidations remove mandatory classes, not semantic distinctions. Actor serialization, durable state authority, ephemeral view state and immutable records still require different laws. The present definition IR stores a string kind; these classifications are modeling guidance rather than a new enforced class hierarchy.

Concrete Reaktor mapping

Current runtime classes include BasicNode, ActorNode, StateInteractor, ControllerNode, ContainerNode and RouteNode. They do not implement a forty-case enum. RouteNode supplies routeBinding, navBinding, push, replace and back(return); Compose consumes the bindings. Service contracts expose request/response behavior, while platform adapters and FFI implementations define the qualified target boundary. Graph theory separates expressibility from implemented target support.

N01 · Pure computation — Rank a feed without fetching data

Which posts should appear first for this reader?

Domains and use cases: mobile, web, analytics.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A repository supplies candidate posts and a versioned preference snapshot. A pure Kotlin scorer returns ranked IDs; pagination and rendering consume the same result. Network retrieval and impression writes stay outside the scorer, so identical snapshots can be replayed in Shadow.

Concrete module/design guide · Definition JSON · revision 1e9696f9a12f

Laws and limits:

• No hidden effects; cache only against declared inputs and semantic version.
• Pure computation can be memoized only with all semantic inputs, including the ranking/model revision.

N02 · Effectful operation — Upload a profile photo

How does selecting a photo become a durable profile change?

Domains and use cases: messaging, commerce, services.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The upload operation owns the external write. It obtains an authorized object key, writes bytes, and updates the profile only after a storage receipt. A failed profile update leaves a named orphan for cleanup instead of pretending both services committed atomically.

Concrete module/design guide · Definition JSON · revision 8f69a886858d

Laws and limits:

• Effects and required grants are explicit; timeout does not imply no effect.
• Cancellation after upload does not undo a committed object; cleanup is a separately authorized effect.

N03 · Decision / pattern match — Choose the next onboarding screen

Should a returning user see home, consent, or profile setup?

Domains and use cases: navigation, auth, feature flags.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A decision evaluates the session, accepted terms version and profile completeness as data. Its three outcomes feed explicit destinations through RouteNode bindings. The decision has no hidden navigation effect; session expiry can select sign-in without granting any backend permission.

Concrete module/design guide · Definition JSON · revision 2618fb80e653

Laws and limits:

• Define exhaustive cases and defaults; guards are pure in the selected profile.
• Mutually exclusive branches need a declared exhaustive predicate; a drawn fork alone supplies neither condition nor exhaustiveness.

N04 · Loop / recursive region — Load more search results

How can scrolling fetch more results without looping forever?

Domains and use cases: analytics, workflows, compilers.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A cursor loop requests one page, appends unique results, and advances only when the server returns a new cursor. End-of-list and cancellation exit the region. The loop is ordinary Kotlin common logic rather than one graph node per iteration.

Concrete module/design guide · Definition JSON · revision 4cdd2b180633

Laws and limits:

• Specify continuation/state semantics and resource budgets; a cycle is not a schedule.
• Reject repeated cursors and impose a request budget; recursion in code is not a graph containment cycle.

N05 · Actor / statechart — Serialize messages in one conversation

How do concurrent sends preserve conversation state?

Domains and use cases: messaging, games, distributed systems.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A conversation actor serializes commands against its state. Admission checks precede mailbox entry, persistence produces a revisioned receipt, and subscribers observe the committed sequence. The actor is a state owner; it does not create global order across unrelated conversations.

Concrete module/design guide · Definition JSON · revision 8afef424feff

Laws and limits:

• Owns state and event ordering; hierarchy does not itself provide durability.
• Mailbox serialization is local to its activation; durable recovery and duplicate-command handling require journal and command-ID contracts.

N06 · Workflow / saga — Recover a checkout after payment fails

What happens when inventory is reserved but payment is declined?

Domains and use cases: onboarding, commerce, workflows.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The checkout saga records each completed step. A declined charge schedules reservation release; a timed-out charge enters reconciliation before any compensation decision. A confirmed charge schedules order confirmation. Compensation is an explicit later operation, and retries use the recorded command identity and receipts.

Concrete module/design guide · Definition JSON · revision a3ac3ef10f62

Laws and limits:

• Version durable continuations; make retries, unknown results and compensation explicit.
• A timeout is an unknown payment outcome; reconciliation must precede a new charge or refund.

N07 · Stream operator — Debounce search as someone types

How does a search box avoid sending one request per keystroke?

Domains and use cases: telemetry, media, IoT.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A stream operator normalizes terms, debounces input, and replaces the previous search request. A result carries its query generation so a slow old response cannot overwrite a newer one. Empty input clears the list without fetching.

Concrete module/design guide · Definition JSON · revision 53670509fc3a

Laws and limits:

• Specify demand, buffering, event-time policy, loss and cancellation.
• Debouncing changes timing; it does not preserve every input event or provide durable delivery.

N08 · Fork / join / scheduler — Build a dashboard from three services

Which data can load concurrently, and when is the page ready?

Domains and use cases: media, distributed systems, workflows.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A scheduler starts account, activity and recommendation reads concurrently. Account and activity are required for readiness; recommendations may produce a declared fallback. The readiness join is separate from the optional panel so one slow recommendation service does not block the whole screen.

Concrete module/design guide · Definition JSON · revision c572066d9399

Laws and limits:

• Choose all/any/quorum semantics, including failure and abandoned branches.
• Join failure and cancellation are explicit outcomes; parallel reads do not produce a consistent database snapshot automatically.

N09 · Timer / clock source — Expire an unpaid reservation

When does a held seat become available again?

Domains and use cases: workflows, games, IoT.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A deadline source emits an expiry candidate. The reservation authority compares the recorded deadline and revision before releasing the seat, because payment or renewal may have already changed it. A notification follows a release receipt.

Concrete module/design guide · Definition JSON · revision f044d54c3d08

Laws and limits:

• Distinguish logical, event and wall clocks; inject clocks for replay.
• A clock event is a hint to recheck authority; clock drift and duplicate delivery must not release a paid reservation.

N10 · Function / blueprint region — Reuse a conversation feature in two apps

How can the same feature run with different hosts?

Domains and use cases: mobile, web, composition.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A blueprint region exports open-conversation, send and message-state interfaces. Mobile and desktop bind their own presentation and transport adapters to that boundary. Internal repository ownership remains explicit instead of exposing every implementation node.

Concrete module/design guide · Definition JSON · revision 2760287d5cb4

Laws and limits:

• Stable exported interface; instantiate fresh owned state, not copied global identity.
• A blueprint definition is reusable; instances have separate runtime identities, subscriptions and lifecycle.

N11 · Surface / view component — Render loading, error and content states

How does a profile screen remain understandable while data loads?

Domains and use cases: mobile, web, desktop.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A Surface renders a sealed profile state and emits retry or edit intents. The interactor owns the loading transition and service request. Rendering can use Compose while the same common state and intents bind to a website presentation.

Concrete module/design guide · Definition JSON · revision 7bd2133dfe1d

Laws and limits:

• Interaction semantics are shared; native renderer behavior is qualified separately.
• A Surface is a presentation role, not a separate state authority or a guarantee that all targets implement identical widgets.

N12 · Route / navigation — Open a chat link and return an attachment

How does a deep link enter a nested screen and preserve the back result?

Domains and use cases: mobile, web, deep links.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The link resolver validates a conversation ID, an access check selects sign-in or chat, and RouteNode exposes routeBinding and navBinding to Compose. The attachment picker returns a selected asset to chat through back(return), rather than writing a global navigation store.

Concrete module/design guide · Definition JSON · revision f081f5bb3cd1

Laws and limits:

• Make route state, permissions and unsupported destinations explicit.
• Route permission controls presentation; the messaging service must independently authorize every sensitive request.

N13 · Input / interaction source — Turn drag gestures into an edit

When does moving a graph card become a saved layout change?

Domains and use cases: mobile, desktop, games.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Pointer samples update a local drag preview. Pointer-up creates one layout proposal against the starting revision; cancellation discards the preview. The save authority validates that revision before producing a receipt.

Concrete module/design guide · Definition JSON · revision c989304765f9

Laws and limits:

• Declare focus, sampling, ordering and host lifecycle behavior.
• High-frequency samples are transient; a preview is not a persisted graph mutation.

N14 · Form / validation region — Validate a signup form before creating an account

Which errors belong beside a field and which come from the server?

Domains and use cases: mobile, web, editors.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The form combines field validators into an accepted input. Local errors feed the Surface immediately; valid input invokes account creation. A server conflict becomes a distinct field error without losing the entered values.

Concrete module/design guide · Definition JSON · revision e39deb4c95f8

Laws and limits:

• Keep draft/invalid state saveable; effects require separately accepted values.
• Client validation improves feedback; the server repeats validation and uniqueness checks at its authority boundary.

N15 · Device / platform adapter — Ask for camera permission and capture a photo

How does common logic handle denied or unavailable device access?

Domains and use cases: mobile, robotics, IoT.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A platform adapter exposes permission and capture contracts. The controller chooses capture, settings guidance, or a file-picker fallback. Android and Darwin adapters implement the same declared outcomes without hiding platform permission transitions.

Concrete module/design guide · Definition JSON · revision db06cfadee31

Laws and limits:

• Native implementation is bounded by OS permissions, affinity and installed capabilities.
• The adapter names unavailable, denied and interrupted outcomes; a common declaration does not establish target parity.

N16 · Native resource / engine — Encode video across a native boundary

Who owns the codec handle and frames while encoding runs?

Domains and use cases: media, games, FFI.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A codec resource owns the native handle. A session transfers frames under an ownership contract, receives encoded chunks, and drains before releasing the handle. Kotlin/common orchestration can bind through FFI; ABI, codecs and lifetime support must be qualified for each target.

Concrete module/design guide · Definition JSON · revision 5073fc9119da

Laws and limits:

• Resource owner and release callback survive async calls; opaque internals stay declared.
• Passing an ownership label through JSON does not transfer a native allocation; the FFI adapter must enforce it.

N17 · Media transform — Create thumbnail and preview variants

How does an uploaded image produce several assets safely?

Domains and use cases: media, mobile, web.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A media transform decodes one source and produces bounded thumbnail and preview variants. Upload operations persist the outputs, then a manifest names the accepted digests. A failed variant is recorded explicitly rather than publishing an incomplete manifest as complete.

Concrete module/design guide · Definition JSON · revision 1afc887b1dd6

Laws and limits:

• Specify memory domain, mutability, format and synchronization; zero-copy is conditional.
• Media transform is a domain role; pure/effectful, memory and streaming behavior belong in its contracts.

N18 · Model inference — Generate a cited answer with a model

What separates retrieved evidence, model output, and a publishable answer?

Domains and use cases: AI, mobile, analytics.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A model consumes an authorized evidence cut and prompt. Citation validation compares its draft with the retrieved section identities before presentation. Tool execution is a separate admitted path, so generated text cannot silently invoke system operations.

Concrete module/design guide · Definition JSON · revision ce8f77e65d18

Laws and limits:

• Pin model artifact and preprocessing; quality requires task-specific evidence.
• Inference is a domain role, not inherently pure or trustworthy; citations and authorized tool effects require separate checks.

N19 · Tool / external API adapter — Send a notification through an external provider

How does a provider outage affect a user notification?

Domains and use cases: commerce, agents, integrations.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: An adapter maps a typed notification command to the provider API, records provider receipts, and classifies retryable failures. A retry schedule shares the original idempotency key. Permanent failures enter a review queue instead of looping indefinitely.

Concrete module/design guide · Definition JSON · revision ede6175468a9

Laws and limits:

• Treat credentials and external outcomes separately from local graph transactions.
• A successful API receipt may mean accepted, not delivered; provider-specific delivery evidence stays explicit.

N20 · Human decision / approval — Approve a destructive deployment

Which exact plan did a human approve?

Domains and use cases: workflows, releases, moderation.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The human participant receives a fingerprinted deployment plan and its effects. Approval is bound to that fingerprint and principal. Execution checks both again; a changed plan returns for review, and the receipt records the admitted operation.

Concrete module/design guide · Definition JSON · revision f34d27962f33

Laws and limits:

• Human identity, scope, policy version and expiry are part of the decision.
• A chat confirmation or old approval does not authorize a different plan or principal.

N21 · Database / state authority — Prevent selling the last item twice

Where does stock mutation linearize?

Domains and use cases: data, commerce, messaging.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: An inventory authority owns the stock version. Two checkout attempts compete through conditional reservation calls; the accepted receipt identifies the winning revision. A stock-change event is emitted after commit and cannot replace the authoritative comparison.

Concrete module/design guide · Definition JSON · revision 9cdcae8f2f99

Laws and limits:

• Actual store profile determines isolation and durability; rows are not architecture nodes.
• The database or serialized authority supplies atomicity; two lines into a node do not prove concurrency safety.

N22 · Query / materialized view — Search a materialized order history

How fresh is a query view after an order changes?

Domains and use cases: data, analytics, search.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: An order projection consumes committed events with sequence positions. Search reads its indexed state and returns the applied source cut. The UI can show that lag or wait for a required position rather than presenting an eventual view as the authority.

Concrete module/design guide · Definition JSON · revision 7eeb9c520b19

Laws and limits:

• Declare source cut, freshness and dependency coverage; no unsound negative inference.
• Projection sequence and source revision are freshness evidence; receiving an event is not proof that all earlier events were applied.

N23 · Transaction / unit of work — Commit an order and its outbox event together

Which writes share one transaction authority?

Domains and use cases: commerce, data, messaging.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A unit of work commits the order row and outbox row within one Postgres authority. A separate dispatcher publishes committed outbox entries and records delivery progress. Pub/Sub and payment providers stay outside the atomic scope.

Concrete module/design guide · Definition JSON · revision 3c32ae9cfdb9

Laws and limits:

• Atomicity applies only to the named authority and enlisted qualified resources.
• A transaction profile must name one authority and isolation behavior; external publication remains retryable and separately acknowledged.

N24 · Queue / log / pubsub resource — Deliver an order event to billing and analytics

Why do consumers need separate subscriptions?

Domains and use cases: distributed systems, IoT, messaging.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The topic resource retains the event under its broker profile. Billing and analytics have independent subscriptions and acknowledgement positions. One slow consumer does not borrow the other consumer's receipt or imply its work completed.

Concrete module/design guide · Definition JSON · revision 80137400be06

Laws and limits:

• Delivery, retention, offset, deduplication and redelivery laws belong to the provider.
• Topic, subscription and consumer are distinct identities; exactly-once delivery configurations do not make external business effects atomic.

N25 · Cache / replica / sync agent — Sync offline profile edits without losing changes

What happens when two devices edit the same profile?

Domains and use cases: mobile, web, distributed systems.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A sync agent keeps a local versioned draft and pending operation IDs. The server compares the base revision; a conflict is merged or shown explicitly before a new attempt. Accepted state updates the cache and pending queue together under their local storage contract.

Concrete module/design guide · Definition JSON · revision 43c098fc5be4

Laws and limits:

• Specify merge/conflict policy and deletion semantics; not every invariant permits CRDT merge.
• A sync role does not choose a conflict algorithm; deletion, retries and server authority need explicit contracts.

N26 · Blob / buffer / asset store — Download a large attachment in resumable chunks

How can a client resume without trusting partial bytes?

Domains and use cases: media, AI, Shadow.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The object store supplies ranged bytes for an immutable digest and size. A downloader records verified chunks and only publishes the attachment when the whole digest matches. Local chunk storage and presentation are separate resources.

Concrete module/design guide · Definition JSON · revision c6cd726a58f8

Laws and limits:

• Graph stores descriptors and controlled references; large payloads remain in their owner.
• A blob reference identifies bytes and access policy; it does not prove they are loaded, intact, or safe to decode.

N27 · Runtime host / executor — Run the same service locally and remotely

What changes when a service is hosted in another process?

Domains and use cases: mobile, web, FFI.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A runtime host binds the common service contract to a local implementation or a serialized remote endpoint. The request handler and owned resources share an activation lifecycle, while client deadlines and authority cross the adapter boundary explicitly.

Concrete module/design guide · Definition JSON · revision e2dfba2262bf

Laws and limits:

• Expose an installed capability descriptor and lifetime; target name alone is insufficient.
• A host node describes execution placement and lifecycle; an inspected definition does not establish a live healthy activation.

N28 · Placement / resource pool — Place replicas across failure domains

Which replicas may run together?

Domains and use cases: distributed systems, cloud, robotics.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A resource pool offers candidate hosts with capacity and zone identities. A placement plan selects hosts for service replicas while separation constraints exclude correlated failure domains. Admission checks capacity and compatibility before activation.

Concrete module/design guide · Definition JSON · revision 16200a70f926

Laws and limits:

• Hard constraints precede optimization; placement is not proof of current availability.
• Placement and separation constraints neither start replicas nor establish replication consistency.

N29 · Factory / dynamic instance — Create one actor per active conversation

How are dynamic instances created and retired?

Domains and use cases: games, tenancy, actors.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A factory maps a conversation key to one admitted actor activation. Duplicate open requests resolve the same active lease; idle expiry drains the instance and releases its resources. Definition identity remains stable while activation identities change.

Concrete module/design guide · Definition JSON · revision 61b71779bd3d

Laws and limits:

• Separate reusable definition from dynamic instance identity and bounded registry visibility.
• A factory must fence competing activations; a key-to-definition mapping is not an exactly-one-live-instance proof.

N30 · External system boundary — Handle a payment webhook

How does a foreign event become an internal command?

Domains and use cases: integrations, FFI, IoT.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The external boundary identifies provider ownership, signature and API version. Verification rejects invalid webhooks before idempotent payment reconciliation. Accepted state emits an internal event; foreign payloads remain linked as evidence rather than becoming trusted application state.

Concrete module/design guide · Definition JSON · revision ad6db07e9590

Laws and limits:

• Expose integration coverage honestly; graph visibility does not sandbox external code.
• A boundary makes opaque implementation explicit; it does not make foreign behavior reconstructible or trustworthy.

N31 · Schema / contract definition — Evolve a service response without breaking old clients

Which clients accept a new field or changed representation?

Domains and use cases: services, FFI, data.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A contract definition binds schema revision, compatibility policy and codec artifacts. The compatibility check compares the proposed contract with supported client decoders before a release. Source linkage is distinct from operational health.

Concrete module/design guide · Definition JSON · revision 1cb04023d4d6

Laws and limits:

• Represent as a node when independently referenced; otherwise keep it a typed value/facet.
• Contract equality by string is only an identifier check; semantic compatibility needs a versioned verifier and target evidence.

N32 · Capability offer / requirement — Choose an available video encoder

What can this host actually encode?

Domains and use cases: mobile, AI, platforms.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Capability offers list formats, dimensions and resource limits. A requirement selects an offer compatible with the task and host. The selected implementation is then bound to the encoding request; discovery does not grant camera or file access.

Concrete module/design guide · Definition JSON · revision 3ae088e87c3a

Laws and limits:

• Availability and suitability do not confer authority; selection is context-scoped.
• Capability, implementation choice and authority are separate; an advertised format still needs a qualified adapter.

N33 · Policy / principal boundary — Authorize a private conversation read

Which conversation may this principal inspect?

Domains and use cases: auth, agents, tenancy.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The policy evaluates principal, workspace and conversation membership for the specific read. A grant names the allowed resource and revision scope; retrieval filters before returning evidence. A reduced graph view uses that result but cannot replace service-side enforcement.

Concrete module/design guide · Definition JSON · revision 58610d9eb5cd

Laws and limits:

• Secrets stay out of graph payloads; current effect-time authority is rechecked.
• Principal identity is data; the policy is a decision/authority role. Neither should become an ambient universal visibility flag.

N34 · Build / compiler pass — Compile one common graph for two targets

Which generated bytes belong to which source revision?

Domains and use cases: build, compilers, code push.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The compiler pass consumes common Kotlin and contract references, then produces Kotlin/JS and native artifacts through target toolchains. Target checks attach evidence to each digest. Compilation and adapter qualification remain distinct claims.

Concrete module/design guide · Definition JSON · revision 00095a6f3fda

Laws and limits:

• Key caches by semantic inputs and toolchain; preserve source maps and qualification profile.
• A common source path does not prove native and JS codec, FFI or runtime behavior is equivalent.

N35 · Artifact / release manifest — Publish a reproducible release manifest

How can a deployment identify the exact code and contracts?

Domains and use cases: releases, code push, cloud.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The manifest binds artifact digests, definition revision, state schema and target evidence. Admission reads those identities and rejects missing required evidence. A release name alone cannot stand in for its bytes or activation receipt.

Concrete module/design guide · Definition JSON · revision dcce999bf046

Laws and limits:

• Stable identity differs from content digest; exclude cosmetic layout from semantic identity.
• Manifest completeness and signed provenance are separate from a successful runtime activation.

N36 · Test / Shadow scenario — Reproduce a failed send with Shadow data

What can a debugger replay without contacting production?

Domains and use cases: testing, debugging, Shadow.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A Shadow scenario binds a captured request, its state cut and adapter responses to a selected flow. Replay uses isolated effect adapters and produces a comparison finding. The debugger can inspect source-mapped steps while any live effect needs new admission.

Concrete module/design guide · Definition JSON · revision ab49dfe4c73f

Laws and limits:

• Record assumptions, capture gaps and runner; no generic green-check guarantee.
• A replay result is bounded by capture coverage and substituted adapters; it is not proof of all production behavior.

N37 · Claim / evidence record — Explain why a release is considered qualified

Which observation supports the claim, at what scope?

Domains and use cases: verification, telemetry, releases.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Evidence records target, revision, command, time and coverage. The qualification claim cites that evidence and its assumptions. A dashboard shows stale or partial records directly; it cannot turn a missing result into a green health indicator.

Concrete module/design guide · Definition JSON · revision 2f11fc1d4525

Laws and limits:

• Evidence is claim-indexed, not a universal ordered strength score.
• Evidence and claims are records with distinct meanings; support is not implication beyond recorded assumptions and coverage.

N38 · Observer / query / visitor — Measure the latency of sending a message

Which spans belong to one product flow?

Domains and use cases: inspection, telemetry, debugging.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A bounded visitor selects client invocation, service handling and storage receipt observations linked by context. It reports duration, missing segments and clock assumptions. The visitor reads a cut; enabling new instrumentation is a separate admitted change.

Concrete module/design guide · Definition JSON · revision 758feebe1681

Laws and limits:

• Inspection cannot mutate implicitly; coverage and authority limit conclusions.
• A graph dependency walk is not automatically a causal trace; missing context and clock uncertainty must remain visible.

N39 · Agent / change proposer — Propose a safe graph edit from an agent

How does a suggested change become a reviewable patch?

Domains and use cases: agents, development, review.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: An agent consumes an authorized definition snapshot and produces a typed patch with a base revision. Normalization and validation build a fingerprinted plan. Approval and execution use the same path as human changes; model output alone carries no mutation authority.

Concrete module/design guide · Definition JSON · revision 57f3d4859e85

Laws and limits:

• Drafts are not deployment; effective tool/OS authority must be controlled or disclosed.
• Agent is a domain role composed from inference and proposal logic, not a privileged kernel node class.

N40 · Deployment / migration controller — Replace a service without losing in-flight work

When is a candidate activation safe to receive traffic?

Domains and use cases: releases, code push, distributed systems.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A deployment controller prepares the candidate, checks schema and target evidence, drains the old activation, and switches a fenced route. A failed migration leaves a recorded state and may require forward repair; old code availability alone is not rollback safety.

Concrete module/design guide · Definition JSON · revision 268c43c78bf9

Laws and limits:

• Durable reconciliation; monotonic fencing epochs and explicit mixed-version policy.
• Lifecycle, state migration and route fencing are separate contracts; a drawn controller does not implement universal code push.