# Keeping diagrams true

> What a sync preserves, what the shape outlines mean, and how new resources reach the diagram.

Once a scope has been discovered, Continuum puts the results on a canvas and mints a stratum for every resource it found.

## Shapes and strata

Resources the layout draws become shapes, nested inside the boundaries that exist in the source: accounts, regions, VPCs and subnets, resource groups.

Resources that describe relationships rather than occupy space get a stratum with no shape. Route tables, security groups, network ACLs, IAM and KMS are filed under a `(Context)` folder in the Files sidebar and cross-linked from the resources they affect.

A resource collapsed into a group shape, such as Auto Scaling members or a Lambda name family, also gets a stratum with no shape of its own. Those sit alongside the drawn resources rather than under `(Context)`.

A Continuum stratum's body tab is labelled `Continuum` rather than Overview. It holds a Resource table, a Details table, per-type tables, Tags, links to related strata, and the full payload in a collapsed `Raw data` disclosure. A Terraform drift tab joins it where state is reconciled.

## What a sync preserves

> [!IMPORTANT]
> After the first draw, the canvas you saved is the authority on geometry. Your positions, sizes, labels, styling, groups, notes and connector routes are kept. Only new shapes are laid out.

Containers can grow to make room for additions without moving what is already inside them. Where a container is boxed in by authored content, Continuum places the addition in free canvas space and keeps its resource membership rather than moving your work.

A label or membership you have not customised follows the source. Anything you overrode wins. Managed shapes you deleted stay deleted once the diagram has recorded a refresh baseline. Older diagrams without that baseline preserve customisations conservatively, because a deletion made before the baseline cannot always be inferred.

## New resources wait for you

A resource discovered after the first sync is not added to the diagram straight away. It is drawn on the notes layer with a green outline, and the settings cog's menu shows a running delta such as "+3 new".

Choose `Promote N new resources` from the cog to move them onto the blueprint layer. Until then they sit alongside the diagram rather than in it.

## What the outlines mean

| Outline | Meaning |
| --- | --- |
| Default | Active |
| Red | The source reports the resource offline |
| Dashed grey | Pending removal |
| Red solid, on the notes layer | Removal confirmed |
| Red dashed, on the notes layer | Referenced from outside the scopes you sync, labelled "out of scope" |
| Yellow dashed, on the notes layer | In Terraform state but not found in the cloud, labelled "in tf, not in aws" |
| Green, on the notes layer | Newly discovered, awaiting promotion |
| Amber | Live configuration has drifted from Terraform state |

Drift takes precedence over lifecycle. These outlines come from cloud discovery only. A linked monitoring platform never changes a shape.

## Changing the reading direction

Reading direction is not a control on the tab. Ask the AI assistant to reorder the diagram top down or left to right. It proposes the change and applies it only after you confirm.

> [!IMPORTANT]
> Confirming lays out every managed shape again and discards the positions you moved them to. It is the one action on this page that does. Ordinary syncing, additions and promotion all preserve your layout.

## Version restore is refused

Once a blueprint carries Continuum-managed content, restoring an older version of it is refused. A version snapshot never captured the connections and bindings behind those tabs and strata, so a restore would delete them with nothing to rebuild from. Remove the Continuum component and unbind those strata first.

## Binding one shape instead

A shape you drew yourself can be tied to a single live resource. Add a stratum to it, open `+ Add tab` and choose `Continuum`, then pick a connection, a region or location, and one resource. `Pull now` re-reads it.

AWS and Azure connections can both be bound. A Terraform-state connection cannot: "Only AWS and Azure connections can back a live stratum."

The control appears only for a signed-in editor on a Teams plan or above, on a rich stratum in a saved blueprint. Binding also needs `cloud_connections.manage` on the organisation or team that owns the connection; without it the picker reports no usable connections. Readers never see it.