diff --git a/pilot/arc.tpl.html b/pilot/arc.tpl.html
index 5685b65..2a67690 100644
--- a/pilot/arc.tpl.html
+++ b/pilot/arc.tpl.html
@@ -365,6 +365,7 @@ body:not(.fx) .bench{display:none}
       d.className = "slab";
       d.style.backgroundImage = "url(" + u.flat.src + ")";
       d.style.clipPath = "polygon(" + p.points.map(q => q[0] + "% " + q[1] + "%").join(",") + ")";
+      if (p.z) d.style.zIndex = String(p.z);
       u.scene.appendChild(d);
       return d;
     });
diff --git a/pilot/manifest-gitops.json b/pilot/manifest-gitops.json
index 344c757..6b880cd 100644
--- a/pilot/manifest-gitops.json
+++ b/pilot/manifest-gitops.json
@@ -6,6 +6,7 @@
    "name": "repo",
    "title": "The repository",
    "blurb": "Desired state lives here. The deploy button is a git commit; the audit log is git log.",
+   "z": 3,
    "points": [
     [
      13.7,
@@ -147,6 +148,7 @@
    "name": "engine",
    "title": "ArgoCD",
    "blurb": "Watches repo + path + revision, compares desired against actual, and syncs the difference.",
+   "z": 5,
    "points": [
     [
      48.29,
@@ -288,6 +290,7 @@
    "name": "sheets",
    "title": "Rendered manifests",
    "blurb": "What the repo's charts and manifests render to - build artefacts nobody hand-edits.",
+   "z": 2,
    "points": [
     [
      39.57,
@@ -397,6 +400,7 @@
    "name": "cluster",
    "title": "The cluster",
    "blurb": "Actual state. It pulls its own future - no CI system holds a credential that can touch it.",
+   "z": 1,
    "points": [
     [
      52.8,
@@ -535,13 +539,14 @@
      73.22
     ]
    ],
-   "dx": -20.96,
-   "dy": -19.23
+   "dx": -16.01,
+   "dy": -14.69
   },
   {
    "name": "shard",
    "title": "Drift",
    "blurb": "A hand-edited live object. selfHeal puts it back; what leaves git leaves the cluster.",
+   "z": 4,
    "points": [
     [
      80.04,
@@ -660,13 +665,14 @@
      94.73
     ]
    ],
-   "dx": -27.99,
-   "dy": -32.13
+   "dx": -13.61,
+   "dy": -15.62
   },
   {
    "name": "vault",
    "title": "The vault",
    "blurb": "Azure Key Vault in the worked example. Git carries the reference; the vault carries the value. Never absorbed into the pipeline.",
+   "z": 6,
    "points": [
     [
      56.07,
diff --git a/pilot/manifest-helm.json b/pilot/manifest-helm.json
index 7ca4e2e..c43fcd7 100644
--- a/pilot/manifest-helm.json
+++ b/pilot/manifest-helm.json
@@ -6,6 +6,7 @@
    "name": "press",
    "title": "The chart",
    "blurb": "A function with holes - the template owns every structural decision, and renders whatever fills it.",
+   "z": 0,
    "points": [
     [
      28.09,
@@ -155,6 +156,7 @@
    "name": "contexts",
    "title": "Values contexts",
    "blurb": "One small file per cluster - names, addresses, sizes. The cluster's whole voice, values only.",
+   "z": 0,
    "points": [
     [
      24.11,
@@ -280,6 +282,7 @@
    "name": "renders",
    "title": "The renders",
    "blurb": "Same framework, different numbers - one function, many clusters. Review the render, not just the template.",
+   "z": 0,
    "points": [
     [
      54.4,
@@ -373,6 +376,7 @@
    "name": "gate",
    "title": "The schema gate",
    "blurb": "values.schema.json + required: a context missing a value fails at render time, in the pipeline.",
+   "z": 0,
    "points": [
     [
      52.58,
diff --git a/pilot/manifest-supply.json b/pilot/manifest-supply.json
index fcc55de..14943bf 100644
--- a/pilot/manifest-supply.json
+++ b/pilot/manifest-supply.json
@@ -6,6 +6,7 @@
    "name": "image",
    "title": "The image",
    "blurb": "Course I's layers, shipped as one unit - the thing whose name we must say precisely.",
+   "z": 0,
    "points": [
     [
      8.03,
@@ -107,6 +108,7 @@
    "name": "registry",
    "title": "Upstream registry",
    "blurb": "The managed registry CI pushes to - Azure Container Registry in the worked example.",
+   "z": 0,
    "points": [
     [
      31.21,
@@ -216,6 +218,7 @@
    "name": "mirror",
    "title": "The mirror",
    "blurb": "zot, a pull-through cache: the fleet asks it, it asks upstream once, everything after is local.",
+   "z": 0,
    "points": [
     [
      48.51,
@@ -305,6 +308,7 @@
    "name": "core",
    "title": "The node",
    "blurb": "Pulls local. Boot, reschedule and recovery all lean on the mirror being there.",
+   "z": 0,
    "points": [
     [
      75.83,
@@ -430,6 +434,7 @@
    "name": "tag",
    "title": "The tag",
    "blurb": "A promise - a mutable pointer anyone with push rights can move, and nothing records that it moved.",
+   "z": 0,
    "points": [
     [
      26.2,
@@ -539,6 +544,7 @@
    "name": "digest",
    "title": "The digest",
    "blurb": "A fact - sha256 of the content. Same bytes, same digest, forever. The digest does the pulling.",
+   "z": 0,
    "points": [
     [
      49.82,
diff --git a/tools/slice-arc.py b/tools/slice-arc.py
index 16dbb7a..8ba28e5 100644
--- a/tools/slice-arc.py
+++ b/tools/slice-arc.py
@@ -74,6 +74,7 @@ def emit(name, tag, spec):
         poly = poly[::k]
         parts.append(dict(
             name=part["name"], title=part["title"], blurb=part["blurb"],
+            z=part.get("z", 0),
             points=[[round(float(x) / W * 100, 2), round(float(y) / h * 100, 2)] for x, y in poly],
             cx=round(float(np.mean(xs)) / W * 100, 2), cy=round(float(np.mean(ys)) / h * 100, 2)))
     ax, ay = next((p["cx"], p["cy"]) for p in parts if p["name"] == spec["anchor"])