Uncomfortable finding
The README is going stale: its front-page disavowal ("There is no application, executable, installer, or benchmark result yet") no longer fully describes the tree, because a real CLI exists. The unsafe constitution is already broken: the project's "non-negotiable" rule, all crates forbid unsafe, fails at the pin, where the FFI bridge crate ships real pub unsafe extern "C" fn functions with unsafe blocks, in the one crate whose whole job is a trust boundary. The "delivered retained Metal renderer" commits each changed exactly one file, the internal issue tracker, while the native renderer code lives in a sibling repository with no configured remote: a receipt for code nobody can audit. The named foundations are design fiction in the dependency graph: asupersync ("the sole orchestration foundation"), FrankenSQLite, and the native bridge have zero Cargo edges in the tree. And the documented architecture does not match the code: the "facade" crate is a 31,916-line feature-gated integration monolith, and the native bridge routes through the application crate. Two layering inversions in a project whose pitch is strict boundaries.