90x System Architecture Diagram

Request path

Every request meets the proxy first: session refresh, /admin lock, maintenance switch
Pages read; server actions write via Drizzle, every query scoped to the viewer (WHERE user_id); browser has no Data API
Admin approval gates new accounts; email goes out through Resend

AI stays behind one gate

aiGate() runs before Coach, feed grading and weekly reviews
Past a spend line the Coach drops from the smart to the fast model
Daily, monthly, per-user and lifetime caps live in Redis; cards, Today and Library work without AI
Provider and models are env settings (DeepSeek fast and smart by default)

Scheduled and offline

QStash calls two signed job routes; hourly does rollover, reminders and weekly reviews
The pipeline runs on the owner's machine and publishes into Supabase, Vector and R2
GitHub Actions also runs CI and the nightly encrypted backup (see delivery diagram)