09 — Design-Gap Audit

Compares each architectural addition against intended architecture. Legend: aligned / partially aligned / design missing / implementation ahead of design / design ahead of implementation / risky inconsistency.

Area	Status	Gap
Dynamic drill	partially aligned	Works for grouped/curated paths; v1 contract still routes high-count AX-PXT nodes to a mismatched substrate (doc 05). No full-population invariant guard.
Axis registry	design ahead of implementation	axis_registry exists as the intended registry, but the render contract ignores it (H1). 3/5 axes not registered. The registry is built but not used for rendering.
Final substrate	partially aligned	fn_rp_node_substrate resolves 85/87. But AX-PXT final_substrate_ref points at a gap-ledger, not the object population — substrate ref ≠ substrate rows.
Process discovery	aligned (observe) / design missing (act)	Excellent census/orphan/candidate layer. Missing: an executor that drains the candidate→birth pipeline (all owner-gated, but no runnable loop even for the safe steps). Heavy view sprawl (birth_readiness v2–v6, candidate_status v3–v6) = no canonical "current" view.
Trigger axis (AX-TRIGGER)	design ahead of implementation	11 read-only surfaces built; AX-TRIGGER not in axis_registry; host triggers excluded from the 525 universe. Canon blocked on owner (Dieu-39). Implementation surfaces exist without the governing axis row.
Process×Trigger (AX-PXT)	risky inconsistency	AX-PXT is a derived lens presented as a top-level axis with count_status=ledger_backed static literals, NEEDS_GROUPING-but-SHOW_SUBSTRATE conflict (H8), and counts that overlap AX-PROCESS+AX-TRIGGER (non-additive). It is the least-aligned construct.
Topic axis (AX-TOPIC)	aligned (as candidate)	Cleanly registry-driven (axis_assignment from iu_metadata_tag), CANDIDATE status honest. The model AX-TOPIC follows (data-row axis, no island tables) is the pattern AX-PXT/AX-TRIGGER should adopt.
Count reliability	partially aligned	No silent wrong counts, but dual-contract divergence, ledger literals, partial-as-total triggers, stale digests.
Source adapters	aligned (build) / partially aligned (coverage)	16/16 built and live; host-trigger + KB-SOP partial; orchestrator unproven.
Governance/birth flow	aligned (safety) / design missing (actuation)	Birth-free, fail-closed, no-fake — the safety design is fully realized. The forward flow (ownership→approval→canon→official) has 0 throughput because authority hasn't acted; engineering handlers exist but governance_object_ownership is empty.

Cross-cutting design gaps

G1 — Registry-driven rendering is designed but not wired (the master gap)

axis_registry + axis_assignment + workflow_discovery_source_registry are the intended "everything is a registry row" backbone. The render contract bypasses it with a hardcoded UNION. This is implementation behind design for the render path and the root cause of the auto-scale score (38). Fixing this one thing lifts auto-scale, hardcode, and sync scores together.

G2 — Version sprawl with no canonical pointer

131 RP/wf/axis views including: proof_matrix + _v2; ui_acceptance_dashboard + _v2; universal_node_ui_contract + _v2; birth_readiness v2/v3/v4/v5/v6; candidate_status v3/v4/v5/v6; residual_evidence_hardening v3/v4; census/orphan/coverage + _v2. There is no _current/_canonical alias telling consumers (and the UI) which to read. This is the operational risk behind the v1/v2 divergence (doc 04 C4). Design debt: adopt a "one canonical view per concern, version behind a stable name" rule.

G3 — Derived lenses presented as governed axes

AX-PXT and AX-TRIGGER are analytical lenses (joins/ledgers) wearing the costume of governed axes. Intended architecture (per the AX-TOPIC pattern and the no_hardcode_absolute / five-layer-sync guardrails) is that an axis is a registry row with assignments. AX-PXT/AX-TRIGGER skip that. Either promote them to real registry rows (with SYNTHETIC/DERIVED status) or label them as lenses.

G4 — Observe-heavy, actuate-light

The system has world-class observation (census, drift, orphan, proof, ledger) and near-zero actuation (no orchestrator fire proven, no queue drain, fail-closed handlers). This is intentionally safe but means RP is currently a read-only mirror, not a supervision control surface. The design should state this explicitly so it isn't oversold.

Net

The safety and observation architecture is largely realized and aligned. The registry-driven-rendering and actuation architecture is designed but not wired. The single highest-leverage design fix is G1 (make the contract iterate axis_registry); the single highest-leverage hygiene fix is G2 (canonical view aliases). Both are T1-fixable without authority.