The composed modules and who depends on whom Diagram

Order is asserted

• apps/flagship/registry.go owns construction order; an unknown name is a boot failure
• modules.include in a client overlay chooses; the registry orders

Contracts, not internals

• A consumer takes an interface from the provider's contracts/ as a Deps field
• scripts/check_imports.sh fails an import of another module's internal/

Events tie the rest

• audit subscribes to every event; notification, file and auth to their own
• An unpromised event, or a subscription nobody emits, refuses to boot