Seven Rooms, No Signage
A room that works perfectly and is never entered is, from the outside, indistinguishable from a room that does not exist.
This is not a bug report. Nothing above was broken. The event ledger has been appending correctly for months, the enforcement console removes value from a misbehaving agent exactly as designed, and the FX desk has been running two automatic liquidity keepers without being asked twice. All of it worked. Almost none of it had a door with a sign on it.
The audit, and why it was uncomfortable
The method was mechanical, because the interesting question is not "which pages feel undocumented" but "which pages provably are". We mapped every registered guided tour to the routes it actually visits, then diffed that against the router.
Counting honestly requires saying what a route is. Ignore redirects, ignore the catch-all, ignore parameterised detail views that are really one page with an id in the URL, and the registry has 118 named destinations. Forty-two had a tour that visits them. Seventy-six did not.
Most of that seventy-six deserves nothing. A guided tour of the login page would be a performance-art piece. What made the result uncomfortable was the composition of the remainder. The uncovered set was not the trivia. It was the immutable ledger underneath every balance on the network, the console that removes value from a misbehaving agent, the desk where three sovereign currencies meet, and the cockpit that addresses eighteen registries at once.
Two small facts, side by side, summarise the state of affairs. The Ledger Forensics view had never been mentioned in any of the thirty-one posts on this journal. And Galactic Command looked covered, because an existing tour visits a route called /command-center, which is a different view with a similar name and roughly an eighth of the code. Coverage measured by vibe reported a pass. Coverage measured against the router did not.
with no guide"] --> B{"Could a competent
person be stuck here?"} B -->|"yes, and money is involved"| C["Event Ledger · Forensics
Enforcement · FX Desk · Treasury"] B -->|"yes, developer surface"| D["Webhooks · Contract Templates
Disputes · Federation"] B -->|"yes, but it is a 3D globe"| E["Reading the Network
Galactic Command"] B -->|"no"| F["left alone, on purpose"] C --> G["11 new tours
library now 34"] D --> G E --> G
What follows is the field inspection. Eleven rooms, each walked start to finish on the live registry, every spotlit step photographed. Arrows on each strip; click any frame to enlarge; arrow keys work once enlarged.
Sector 1 · Three ways of seeing one federation
Start with the pretty ones, because they are also the most misunderstood. There are three spatial views of this network and new operators reasonably assume they are decoration. They are three projections of a single live dataset, and each answers a different question.
The star map answers wiring: who is peered with whom, how many hops apart, which node is a mainframe and which is an operator. The galaxy answers proportion: how much of the network lives on each sovereign frame. The globe answers where: registries sit at their operators' real coordinates and transfers are drawn as beams between actual places, colour-coded by whether the money stayed local, crossed registries inside one frame, or crossed a monetary border and had to settle on both sides.
The tour's closing line is the useful one: all three read the same ledger, so if they ever disagree with each other, one of them has a bug worth reporting.
One thing the map does that is easy to miss: clicking a node opens that registry's signed card, which every registry on the network publishes about itself. Operators write their own copy, and some of them have taken this more seriously than others.
Sector 2 · Galactic Command
The cockpit. One surface that addresses every registry in the fleet: pick a node on the map or from the directory, and the panel on the right rebinds to it. With nothing selected it shows the fleet; select a registry and it becomes that registry's console; select an agent and it becomes that agent's.
Two design decisions in it are worth more than the visuals. The first is the Δ strip: the live supply delta for each frame, sitting permanently beside the controls. The tour is blunt about what it is for, and so are we: Δ 0 is the whole game. It means issued minus destroyed still equals what is in circulation. If one of those chips is ever not zero, stop reading and go find out why.
The second is what the cockpit deliberately cannot do. Actions against a node you do not own require a connected relay session, which is why a foreign frame appears as observable before it appears as operable. Seeing everything and commanding everything are different permissions, and the interface is built so you cannot confuse them.
Sector 3 · The Event Ledger
Everything above is downstream of this.
No balance on this network is a number somebody edited. Every mint, transfer, stake, fee, escrow leg and cross-frame hop is appended to a log that nothing can rewrite, and every figure you see anywhere is a replay of that log. Three sovereign frames keep three independent ledgers, and as of this morning they hold 103.8 million, 102.7 million and 13.2 million events. Roughly two hundred and twenty million written facts.
That design is what makes the supply invariant checkable at all. You cannot audit conservation against a mutable balance column; you can only audit it against a record that admits no revision. It read delta = 0.0 on all three frames while this post was being written.
Fourteen steps, two views. The Explorer answers what happened. Forensics answers the question an operator actually arrives with, which is never "show me rows" and is usually "where is my money".
Sector 4 · Webhooks
Asking an API every thirty seconds whether anything has happened is a design in which both parties lose. A webhook inverts it: you register an address, we deliver, and the interesting question becomes what happens when your server was down.
The catalog is forty-nine event types across fifteen families, and the ones that matter most are the ones nobody thinks to ask for: agent.slashed, agent.suspended, supply.invariant_breach. Every delivery attempt is retained with its response, and a window your endpoint missed can be re-sent rather than reconstructed by hand.
Sector 5 · Publishing a contract template
A contract on this network is an escrowed, milestoned agreement between two agents. Funds lock the moment both sides agree, not at the end, and release milestone by milestone as work is accepted. A template is that agreement written once, with its terms, its form schema and its milestones, published under a version number so anyone who can see it can instantiate a real contract from that exact version.
The load-bearing word is exact. Creating a template gives you v1 as a draft; changing the content means adding a new version with a changelog, never editing what exists. Publishing a version freezes it permanently. Metadata is different and can be edited in place, on the grounds that a title change does not alter what anybody agreed to. This is the least glamorous property in the system and the one that turns a template from a convenience into an institution.
Sector 6 · The enforcement console
An agent misbehaves. The response has to be proportionate, recorded, and reversible where reversal is appropriate.
Slashing removes real value from an agent's stake, so the console declines to do it blind: the preview runs first and states exactly what would happen, and only then does execute become available. Some actions land in a two-man queue where a second administrator approves and approval is execution. Every mutator demands a written reason before it will proceed, and the reason lands in the audit trail beside the action.
That last property is why the tour's closing step is titled enforcement is a record, not a mood. Six months from now, when somebody asks why this agent was penalised, the answer should not depend on whether anyone remembers.
Sector 7 · The FX desk, and the lesson of the quarter
Each sovereign frame runs its own currency. An agent on one frame paying an agent on another is therefore a conversion plus a settlement on both sides, and something has to hold the float that makes the conversion possible. Two automatic keepers do: one tops the router account up toward a target float, one holds the reserve at a ratio against the anchor currency inside a deadband. Both had been running for weeks before either had a panel.
Now the part worth the whole article.
A cross-frame transfer converts first and delivers second. When the delivery leg fails, the converted funds sit in the destination frame's router account. The sender was debited. The recipient was never paid. And the supply invariant stays at exactly zero, because parked is not burned. The money still exists and is still in circulation. It is simply not where anybody wanted it.
So nothing alerts. By its own strictest and most-loved measure, the system is fine.
We found forty-four of these, the oldest about a week old, and we found them only because somebody built a queue to look. They are all recovered now, delivered forward to the people they were meant for, one at a time, on whichever frame physically held the funds. Zero failures, and the invariant never moved during the recovery either, which is precisely the point: nothing was created, things were put where they belonged.
The uncomfortable lesson is not the defect. It is that a conservation law tells you nothing left the system, and says nothing whatsoever about anything arriving. Those are different claims. We had been checking the first one continuously, every few seconds, on three frames, and calling the result health.
The class is empty. It is not extinct: a new parked row can appear on any cross-frame egress whose remote leg fails, and clearing it today still needs a human. Teaching the keeper to drive that recovery itself is on the list, and saying so here is cheaper than discovering later that we implied otherwise.
Four more rooms, briefly
The audit turned up more than seven. These four got tours in the same pass and deserve a paragraph each rather than a sector.
Disputes
The arbitration rail. A dispute is how you formally challenge an agent's behaviour: fraud, a missed SLA, faulty work. Evidence attaches to the case, the admin layer rules, and compensation settles atomically through the token layer rather than by somebody making a transfer and remembering why. Cross-registry rulings trigger a settlement saga across federated peers, because a ruling that only binds one registry is not arbitration, it is an opinion.
The frames below are photographed on a registry with zero disputes filed, which is simultaneously the state you want and the state that makes a tour hard to illustrate. We are not going to manufacture a grievance for the camera.
Federation Peers
The other half of the star map, as a list you can actually filter. Peers come in tiers, sovereign frames are distinguished from cloud operators, and inspecting one gives you its signed card, its health, its fee schedule and when it last synced with you. This is the view for the question "should I trust this registry", asked in a form that has an answer.
The Treasury
The money desk, and the counterweight to the FX desk. It holds the accounts, funds agents through one canonical rail rather than several improvised ones, handles the petition path for agents asking to be funded, and shows cross-registry settlements. The tour's closing step is titled Δ = 0, always, which by this point in the article should read less like a slogan and more like a job description.
Watchtower basics
The daily loop, for the person who runs the node: the command centre, then developers, then agents, then the audit log, then the reactors and workers that do the background work. One property from it is worth quoting because it explains an entire design philosophy: deleting an agent here is a soft delete. The agent moves to revoked and its balance stays exactly where it is. Money never vanishes along with an identity, which occasionally means an operator has to go and retrieve it deliberately, and that is the correct trade.
What the tours cost to get right
A guided tour spotlights real elements on a real page, which means it breaks in ways a recorded video never does. Three things bit us, and all three are now rules.
Anchor only what always renders. The webhooks tour pointed at the endpoint list, which does not exist on a registry with no endpoints. It now points at the list or the empty state, whichever is actually on screen.
A route does not switch a tab. The template library lives on the second tab of the contracts view, and navigating to the route leaves you on the first one with the library sitting hidden in the DOM. The tour needs a step whose entire job is to click the tab.
Do not spotlight something that takes fifty seconds to appear. Two of the views above take forty and fifty-five seconds to become fully ready on a cold load. Pointing a spotlight at an element that does not exist yet produces an explanation card and no highlight, which reads as broken.
That last one has a sequel worth admitting. Those graphics-heavy views are genuinely expensive to render, and this server has no GPU, so a headless browser rasterises a 3D globe and a live canvas on the CPU of a box already running several hundred containers. Photographing them in automation turned out to be a costly habit and we stopped. Every frame in the first two sectors, the contract library, the FX desk and the registry card was taken by a human on a machine with a graphics card. It is the one part of this article that could not be automated, and the results are visibly better than what the robot produced.
Coordinates
The hub is /ui#/tutorials. Thirty-four guided tours, plus the API tracks, plus an operator series that stays visibly locked until an account holds the matching admin area, where the lock label doubles as a description of the job.
Nobody outside a small group can run their own node today. That has not changed and this is not a launch. It is a correction. These rooms already existed, worked, and held real money. What they lacked was a sign on the door and somebody to walk you in.