# MoonAtlas Feasibility Findings

Source snapshot: `poc/data/snapshot-2026-08-20-all.json`

Oracle analysis: `poc/data/snapshot-2026-08-20-all-analysis.json`

Reproduction:

```powershell
python .\poc\analyze_snapshot.py .\poc\data\snapshot-2026-08-20-all.json
```

## Finding 1: one direct edge can hide a large transitive blast radius

**Evidence:** `mizchi/brotli` has 1 direct dependent (`mizchi/font`) but 29
transitive dependents. Its direct-dependent rank is 444, while its blast-radius
rank is 29, a gain of 415 ranks.

**Metric:** reverse-graph reachability excluding the package itself.

**Why Mooncakes pages do not directly show it:** the manifest exposes the
outgoing dependency declaration of each consumer, but not the transitive union
of all packages that eventually depend on `mizchi/brotli`.

## Finding 2: a two-edge entry point reaches a 37-package downstream region

**Evidence:** `mizchi/layout` has only 2 direct dependents (`mizchi/crater-layout`
and `mizchi/tui`) but a blast radius of 37. It ranks 243rd by direct dependents
and 16th by blast radius.

**Metric:** direct in-degree versus reverse-reachability cardinality.

**Why Mooncakes pages do not directly show it:** the result requires joining
and traversing manifests across the entire registry.

## Finding 3: PageRank identifies a structurally important low-in-degree package

**Evidence:** `tonyfettes/nat` has one direct dependent (`tonyfettes/c`) and
therefore ranks 535th by direct-dependent count. Its PageRank is
`0.0028836911831947635`, rank 16, and its blast radius is 19. The downstream
set includes `tonyfettes/uv`, `tonyfettes/tree_sitter`, `tonyfettes/ssl`,
`tonyfettes/lua`, `yj-qin/llhttp`, and other consumers reached through
`tonyfettes/c`.

**Metric:** PageRank with damping `0.85`, plus reverse reachability.

**Why Mooncakes pages do not directly show it:** a direct count treats all
single dependents equally; PageRank incorporates the structural position of
the dependent and its outgoing choices.

## Finding 4: ecosystem dependency use is highly concentrated

**Evidence:** `moonbitlang/x` has 427 direct dependents and
`moonbitlang/async` has 361. Together they receive 31.37% of all 2,512 valid
dependency edges. The top ten packages receive 41.28%. In-degree Gini is
`0.911559721870425`; in-degree HHI is `0.0522577614710536`. The union of
reverse-reachable packages for the top ten blast-radius packages covers 774
packages, 37.54% of all registry nodes.

**Metric:** edge-share concentration, Gini, HHI, and union reverse reachability.

**Why Mooncakes pages do not directly show it:** these are distribution-level
properties requiring all modules and all dependency edges.

## Finding 5: no current multi-package dependency cycle

**Evidence:** directed SCC analysis produced 2,062 SCCs for 2,062 nodes;
largest SCC size is 1 and multi-node SCC count is 0.

**Metric:** Tarjan SCC in the Python oracle; the MoonBit spike independently
proves SCC implementation feasibility with Kosaraju.

**Interpretation:** this is a useful negative result for the captured latest
versions. It must not be advertised as a permanent ecosystem guarantee.

## Value Gate

**PASS**. Blast radius, PageRank rank shifts, and concentration each reveal
information not reducible to a plain direct-dependency count. At least two
required structural categories are satisfied.