Twelve traces.
Real files.

A form submission reaches src/proxy.ts, which redirects unauthenticated requests but performs no authorization. The server action then calls auth() and checks the role, parses the FormData with a Zod schema, and consumes a rate limit. Each of those three steps can short-circuit to a typed error state without writing anything. On success the action calls a module workflow, which calls the repository that owns this transaction through Drizzle. The action finishes with revalidatePath, and the server re-renders the affected route.

A server component marked force-dynamic awaits auth(), then calls a module query as an ordinary imported function. The query calls ensureDatabaseReady and runs a Drizzle select in the same process, and the component streams HTML back. Alongside the spine, an aside notes the only three route files in the application: the Auth.js catch-all, the health probe, and the authenticated built-in queue API. Server-rendered page data stays on the direct query path; the queue is the explicit client-polled exception.

A caller in src/app imports from a module's public surface: commands, queries, or workflows. Inside the module boundary sit four internal folders that callers must not import directly: repositories, adapters, schemas, and types. A forbidden-import edge is drawn piercing the module boundary straight into repositories. Below the boundary, target modules expose explicit public.ts facades and a repository validator rejects production cross-module imports into repository or adapter internals.

The searchIndexersWorkflow orchestrator awaits eight phases in order: request-validation, indexer-selection, credential-resolution, indexer-execution, normalization, filtering-scoring, persistence, and audit. Beside it, three examples of how consistently the pattern is applied across the repository: search-indexers with eight phase files behind a thirty-three line index, import-completed-downloads with thirteen phase/helper files in the same shape, and season-fulfillment which is a single file with no phase folder at all.

tini is PID 1 and starts container-supervisor.mjs, which forces NODE_ENV to production and then runs the worker bundle once with --migrate-only, awaiting its exit so migrations complete before any long-lived process opens SQLite. It then spawns two long-lived children: the Next.js web server and the background worker. Separate storage-probe children are disposable; each performs one bounded refresh and exits. If the web process exits, the supervisor shuts the whole container down. If the worker exits or its persisted heartbeat stops advancing, it is restarted with exponential backoff starting at one second and capped at thirty seconds. Normal termination first asks the worker to drain its active pass.

A fifteen second timer starts one worker pass. Three filesystem lanes run serially in order: download-import, then media-title-delete, then media-library-scan. Maintenance then runs alone with no other lane overlapping it. Finally four network and AI lanes run concurrently through Promise.allSettled: watch-history-sync, recommendation-run, missing-content-search, and metadata-refresh.

Claiming a job selects due candidates whose lease is free, then issues a conditional UPDATE that re-asserts the same predicate in its WHERE clause. If that update reports more than zero changed rows, this worker owns the job. A heartbeat every thirty seconds then extends the five minute lease for as long as the job runs.

The engine runner peeks the next queued row by priority, then checks live capacity with a real statfs for that single release; if there is not enough room it marks the row waiting and defers it so smaller releases can still run. It claims the row by compare and swap into the fetching state, losing the race means deferring to the next row. It clears the work directory for a fresh start, transfers every segment over pooled NNTP connections writing each decoded yEnc part at its byte offset, classifies the outcome with transport failures checked before content failures, and finalizes. The loop then repeats until no candidate remains.

Finalization runs eight steps in order: deobfuscate files by magic bytes, verify and repair with par2, inspect archives against an extraction quota before extracting anything, extract into an isolated staging directory, verify and merge the staged tree with path traversal guards, rescue unnamed media, remove par2 artifacts, and finally move the work directory to the output directory in one sequential copy.

A row starts queued and moves to fetching. From fetching it branches to either repairing or extracting, and both converge on completed. Fetching can also move to paused, either by user intent or because the transfer was parked, and paused returns to queued. Failure from an active state moves to failed. Assembly itself happens while the row is fetching.

Fifty tables grouped by owning domain: five for identity and access, nine for the media library, seven for downloads, six for indexers, six for recommendations, three for watch history, eight platform tables covering stable instance ownership, service connections, storage snapshots, jobs and notifications, one for the download engine, and five for YouTube sources, selections, videos, membership, and downloads. Auth.js keeps encrypted JWTs in browser cookies while each token must also match an unexpired auth_sessions row and the user's current monotonic authentication generation.

In the web process, enqueuing an NZB calls readDownloadCapacity, which reads two rows from the storage_snapshots table rather than probing the filesystem, and refuses the request if the snapshot is older than two minutes. Inside the worker boundary, a disposable probe child runs the only scheduled statfs against both storage roots and writes the result back to storage_snapshots, which the web process then reads. Separately the engine runner performs a real live statfs immediately before claiming a row, asking only whether this one release can run now, so an oversized release is deferred rather than blocking every smaller one.

Four security boundaries. Stored credentials derive a key with HKDF-SHA256 from the secret box key, falling back to AUTH_SECRET, and seal values in a versioned AES-256-GCM envelope that supports key rotation. Outbound requests resolve the hostname first and classify the resolved address, then pin those addresses into the dispatcher so the socket cannot re-resolve. Filesystem paths are canonicalized with realpath and compared against approved roots, with an isolated variant that canonicalizes in a child process so a wedged mount times out. Abuse controls use fixed-window counters in the rate_limits table, and forwarding headers are trusted only when explicitly enabled.

The env module parses its schema eagerly at import, which is why the Dockerfile injects a throwaway AUTH_SECRET at build time. Every repository calls ensureDatabaseReady, which probes cached state stored on globalThis so it survives development hot reload, opens the connection and applies four pragmas including WAL journaling and foreign keys, compares the raw contents of drizzle/meta/_journal.json against the cached signature and runs migrations only when they differ, then applies compatibility repairs for drifted columns and asserts the schema before returning.