Architecture

src/main.osl is the composition root. It imports platform modules, handles init/use, loads configuration, declares shared in-memory state, imports subsystems, verifies attachment storage, seeds memory, runs migrations and rate-limit state, mounts routes, and starts the HTTP/WebSocket server.

WebSocket path

1. src/api/index.osl parses a frame as a JSON object. Malformed frames stop at Invalid message format.
2. handleCmd applies the shared authentication and command-permission gate, then lets plugins wrap dispatch.
3. dispatchCmd selects one handler by msg.cmd. Unknown commands return [].
4. The handler validates input, normalizes it once, calls helpers/storage, and returns object[].
5. onMessage copies listener to each direct response. For global: true, it removes the marker and sends visibility-filtered channel broadcasts.
6. Link embed reconciliation may schedule follow-up responses after the handler result.

Module boundaries

Area	Responsibility
src/api/handlers/<resource>/	One protocol operation per snake-case file
src/api/helpers/	Authorization, validation, serialization, and shared domain operations
src/db/	Loading, file layout, persistence, queries, and rollback-safe mutation
src/attachments/, src/assets/	Storage backends and HTTP delivery
src/slash/	Built-in slash definitions
src/plugins/	Dispatch and feature extension hooks
src/pages/	Rendered HTTP pages
src/utils/	Response envelopes, broadcasts, refresh, heartbeat, rate limits

Keep startup wiring in main.osl; do not make it a feature module. Main is the only top-level .osl file.

Shared state

Users, roles, channels, thread index, webhooks, live connections, rate-limit timestamps, attachment upload times, voice peer state, slash registrations/calls, and plugin registrations are process memory. Persistent modules update both disk and memory. A restart reconstructs durable state, while ephemeral connection/voice/call state starts empty.