# Architecture

## Boundary

```text
FakeRealtimeSource now / KaptanDataSource later
  → EventEnvelope validation
  → stream ordering and event-ID deduplication
  → bounded immutable DataPlane journal
  → mission reducer
  → projections and selectors
  → useSyncExternalStore
  → React presentation

React intent
  → DataPlane.preview
  → authority + safety checks
  → operator confirmation
  → DataPlane.submit
  → DataSource.send
  → receipt event
  → journal and mission projection
```

`main.tsx` is the composition root and the only presentation-side file that
chooses the simulation runtime. UI features receive a `DataPlane`; they cannot
import the fake source, transport, or virtual clock.

## State ownership

| Category | Owner | Persistence |
| --- | --- | --- |
| Mission truth | DataPlane projection | Source/replay service in a future release |
| Derived fleet/task/selection views | Pure selectors | Never |
| Local UI state | React feature state | Never unless promoted to preference |
| Operator preferences | `PreferenceStore` schema v2 | Local storage |
| Audit/event journal | DataPlane, bounded to 1,000 raw envelopes | Replaceable journal port |

Telemetry is updated in the data plane and subscriber notification is batched
to a projection cadence. React does not own a second authoritative mission
copy. The 50 markers use CSS transforms and the fake source uses scenario-level
ticks instead of component timers.

The map is a local raster demonstration asset with DOM/SVG overlays. Spatial
values are simulated percentages and must not be interpreted as surveyed
coordinates, navigation truth, or a safe route.