Concepts

What the pieces are and why they are shaped that way. Read Architecture first; the rest expand on one seam each.

Architecture	the on-host shape, the log invariant, durable host operations
agentd and the unit model	the root daemon, the authz boundary, the systemd units
Config layering	shipped → repo overlay → user-local, and how they resolve
The ledger	declared state, deltas, and declared-vs-deployed
Security model	isolation, secrets, scope, and the human floor
The admin role	what admin is, who holds it, what it unlocks