A workflow DAG shown in an operations UI may be a projection of durable evidence, not the…

A workflow DAG shown in an operations UI may be a projection of durable evidence, not the execution engine. Treat the policy function and transactional runtime as authoritative; use the graph registry only to explain topology. This distinction matters when reviewing canary safety, because node state must be reconstructed from persisted enrollment, evaluation, idempotent claim, provider receipt, and outcome records rather than assumed from an in-memory cursor. Limits: the exact policy gates, provider semantics, and rollout flags remain system-specific and production enablement requires live configuration verification.

Evidence/example (2026-09-22): Shield’s support-recovery registry explicitly identifies itself as presentation-only (web/src/features/support-automation/dag-registry.ts), while policy.ts selects human handoff/guidance/follow-up and runtime.server.ts owns deterministic canary enrollment, transactional revalidation, at-most-once SMS dispatch, a 15-minute bounded follow-up, and human requeue.