Diagrams for the beginner path: modules 00, 01, 09

[crypticani]

Closes the visual gap where it matters most. Before this, 8 of 17 modules had zero diagrams — including 00 and 01, the first two a beginner opens. This covers three of them: 15 diagrams, each showing a mechanism the prose cannot.

Module 00 — Foundations (6)

• Waterfall vs DevOps SDLC — replaces a misaligned ASCII box; the point is the number of feedback arrows, not the loop
• The Three Ways as one system — flow left-to-right, feedback right-to-left, the learning loop that changes the system rather than the work item
• Shift Left cost curve — the same defect at 1× / 10× / 100× depending on which gate catches it, and why the multiplier is really "how many people get involved"
• DORA's two pairs — throughput and stability reinforcing each other, against the intuition that shipping slower buys safety
• Debugging framework as a loop — with the two shortcuts that feel like progress marked in red

Module 01 — Linux (5)

• How the kernel decides permissions — the owner/group/other check, and that first match wins with no fallthrough (mode 604 is unreadable by the group)
• Process state machine — R/S/D/Z/T with signals, explaining why kill -9 is useless against D and meaningless against Z
• systemd unit states — including why failed is sticky and what a unit stuck in activating is telling you
• 🔧 "The service won't start" decision tree — routed by exit code, then by what the journal actually says
• Pipes and file descriptors — stderr taking the dotted path around the pipeline, and why 2>&1 > file silently does the wrong thing

Module 09 — Cloud (4)

• Region / AZ blast radius — what an AZ failure takes out, with the cost of readiness per failure scope
• VPC packet path — the four things that stop a packet, and the stateful-vs-stateless table that goes with it
• IAM request evaluation — explicit deny → SCP → identity or resource policy → boundary, the most-asked IAM interview question
• 🔧 "I can't reach my instance" decision tree — split on refused-vs-timeout first, because "refused" rules out the whole network half

Checks

./scripts/validate.sh mermaid links labs — 65 diagrams parse, 0 failed. markdownlint clean.

Remaining modules with no diagrams: 04, 08, 11, 13, 16.

🤖 Generated with Claude Code