# Visual architecture tour

These diagrams describe implemented v0 behavior unless a caption says otherwise. The interactive cockpit is the public Open MCT surface. Its D3/canvas netwalk renders a stable, inspectable map of semantic planes, curve spaces, cryptopointers, mailboxes, cryptofabrics, signed directories, swarms, and observed transport endpoints.

## Start from the left Open MCT tree

Open **Cursors Operations → Start a Guided Netwalk** at any time. Tours are ordinary Open MCT objects, so the introduction is restartable instead of disappearing after a one-time welcome prompt.

- **What’s New: Persistent Bodies** connects Self, admission, optional Cloudflare, SQLite, and resurrection.
- **Lua + SQLite Machine Lab** turns one restricted Lua source artifact into an inspectable continuation graph and a real leased SQLite transaction.

The Machine Lab deliberately looks like an instrument panel rather than a code playground. Its four panels preserve the path `source → compiled graph → body → transactional readback`, while the status line reports only what the flight measured. Open [its guide](cursor-machine-cockpit-lab.md) for the proof boundary.
- **Read a Peer’s Locality** explains device, LAN, direct, relay, mailbox, and unknown evidence.
- **Trace a Local Message** uses the working local curve/mailbox instead of simulated network traffic.
- **Resurrect a Dry Network** follows a signed release head through independent retrieval and storage paths.

![The territorial netwalk keeps operational machinery stable while locality evidence moves peers between explicit regions](images/locality-territories.svg)

## One execution graph, several replaceable bodies

![A genesis cursor fans out to Ember and Mirror, survives Ember's loss, resumes on Mirror, and joins on Cedar](images/cursor-graph.svg)

The body changes explicitly while the north branch retains its parent and state reference. The join names both result parents; no history is rewritten.

## Five planes over interchangeable hosts

![Worlds, dataspace, cursor and capability machines, mailbox fabric, and host boundary](images/system-planes.svg)

Objects say what exists. Cursors say how execution advanced. Capabilities say who may act. Dataspaces say what is currently asserted or wanted. Mailboxes move signed intent and references.

## The universal operation

![Seven execution stages from wake to publication, with an explicit uncertain-effect path](images/execution-lifecycle.svg)

Outputs become durable before their child cursor is published. External effects go through stable keys and receipts. A body loss before publication retries from a parent; an uncertain effect is queried or surfaced rather than guessed.

## Authority becomes smaller

![A root grant split into conserved allocations and a narrowed recovery grant](images/authority-flow.svg)

The split is one signed allocation vector, not unrelated copies. Reforging narrows scope, rights, time, and budgets. A verifier chooses trusted roots and checks the entire chain.

## Discovery cannot become identity

![Replaceable discovery hints crossing a cryptographic verification boundary toward a pinned Self key](images/discovery-trust.svg)

DNS, DHT, LAN, invitations, and relays answer where to try. Signed monotonic manifests and end-to-end keys answer whom to trust.

## Explore the territorial cockpit

Run:

```sh
npm run serve
```

Open <http://127.0.0.1:4173>. The visualization is intentionally territorial rather than force-directed: the concepts stay put long enough to become a mental map, while the radar sweep preserves the old mission-control scanning rhythm.

- Click the local mailbox to inspect its channels, saved envelopes, and local delivery boundary.
- Click a cryptopointer to see the portable resolution request it carries without mistaking it for authority.
- Click a cryptofabric to distinguish carrier, relay, store, and body compatibility from identity.
- Click the curve address in the masthead to create a local, relative, or invitation-only meeting projection.
- Pin any inspected exchange into Open MCT My Items, copy a deep link, or open its full public guide.
- Use browser back and forward to move through inspected objects without losing the cockpit.

Trust, device, LAN, direct, relay, mailbox, storage, and unknown territories are stable backplanes. Peer nodes enter a locality territory only when the observer has supporting evidence. A glowing circuit photon means “non-zero activity observed here,” never “authorized.” Mailbox and fabric nodes remain explicit even when remote service state is **not deployed**; that is a visible unknown, not a fabricated connection.

Fork links carry only references and provenance. Before the fork can boot, the page asks whether to trust the stated issuer or discard the fork and start clean from the latest cockpit release. The gate does not turn the issuer label into verified identity.

On phones, inspection becomes a bounded bottom drawer and the curve address stays in the masthead. The underlying canvas remains pannable and zoomable while HTML controls preserve accessible tap targets.

Capture policy: screenshots checked into the repository must come from the running implementation and state which scenario step they show. Concept art must be labeled as concept art. The founding commit supplies resolution-independent diagrams while the cockpit itself remains the authoritative interactive view.