Composition notes

• Question: where does our AI traffic go, and is any of it going somewhere nobody approved? Endpoints are network destinations (ruled 2026-09-01; c21's "endpoints" were devices and live in People). This is inventory: the allowlist is decided in the policy pages, so allowlisted is a quiet column and the approve affordance is a ghost that links out.
• Verdict line from endpointsVerdict(world) (derived/endpoints.ts, a fold-in for verdicts.endpoints): destinations reached, allowlisted of n, and each exception with its why — the unreviewed MCP server that lives there, a large pull, blocked attempts. Every fragment derives from the row's own facts.
• Framing band = the brief's five claims; the first three are filter buttons (findings-regroup-v2 idiom), connections and bytes are plain claims because filtering by them means nothing. Not-allowlisted is the one attention device and names the loudest host. Numbers cross-foot with the rows.
• Spine is policy-config-egress-allowlist's pending-destinations block re-read as inventory: host · connections · why-line · approve. "Agents" became installs, counted once per destination and never summed across hosts (c67: per-agent egress counts double-count shared hosts). Block is not this page's verb and is gone.
• Table is the raw UxTableList family so ?id= can pre-open a row. Rows from endpointRows(world), pre-ranked not-allowlisted first by connections, then connections — pastebin at 2 connections outranks api.anthropic.com at 41k because unapproved beats big. Search rides the Host header (host + category). Port / TLS is a column only when a destination differs from the rest; when every row agrees the footer says so once and the table gives the width back to Host and Category. The approve affordance is a ghost in the expand, not on the row — a governance control does not belong inside an inventory row; the row carries the amber text only.
• Expand = three sections: header (pills, 30-day stats, the why-line and ghost approve, an honest "view details →" stub — no destination detail page exists in Phase 1), reached by (install rows with person, device, monitored pill, and the MCP server behind the host with its flag and a session witness count), sessions that hit it (on record, labelled 7d where it applies; the empty states say why — detected-only installs have no session telemetry, blocked connections never became sessions).
• Fabrication, flagged: the world stores no MCP server → destination edge. MCP_SERVER_ENDPOINT in derived/endpoints.ts is an explicit id map marked TODO(reconcile), resolved through the current-state world (so browser reads reviewed in all-clear) and checked against session co-occurrence, which prints beside it.
• Open: bytes are the collector's count for the whole host, not per install — no per-install split is printed. A destination detail page (per-install connection breakdown, a 30-day connection series) is Phase-2 territory; the stub says so.