Architecture quirks

The two halves never speak

SafeMeet is split in two: the app you touch, and a separate safety worker that runs matching, moderation, and delivery. They share no API. Neither one can call the other — not even for something urgent.

Everything crosses through a durable outbox: the app writes an event into the database in the same transaction as the thing the event describes, a wake signal nudges the worker, and the worker picks the event up from there. Results flow back to your screen over a live event stream.

The payoff is that a message and its "moderate me" event can't disagree — they commit together or not at all. If the worker is down, events queue instead of vanishing. The moderation pipeline being structurally unbypassable starts here: there is no direct path to skip past it.

One stream carries everything

Your browser holds exactly one live event stream, and every kind of event rides it — match found, message delivered, safety notice, everything. There is no per-conversation stream anywhere in the system.

One stream means one place to authenticate, one place to reason about, one connection per person instead of one per conversation. Boring on purpose.

Broken events return "success"

When the safety worker receives a malformed event, it logs the failure loudly — and then reports success to the queue.

Backwards? Consider the alternative. A malformed event is malformed forever. Return an error and the queue dutifully retries it, gets the same failure, retries again — a poison message grinding in circles for eternity. So: humans get alerted, the queue gets told "handled", and the system moves on.

The schemas are deliberately loose

The event schemas at the worker boundary are written loose: unknown fields pass through, optional fields get defaults. In a strict-TypeScript codebase that looks like heresy.

The reason: at a queue boundary, a too-strict schema doesn't reject bad traffic — it silently drops real traffic the moment a producer adds an innocent field. What keeps the looseness honest is a suite of fixture tests pinning each schema to real captured payloads from the actual producers.

No account, still accountable

There is no sign-up. A guest identity is a signed token issued on arrival — no email, no password, nothing to breach. The quirk is that anonymity here does not mean consequence-free: sanctions attach to that same identity, and the one-door ban gate checks it like any other. Anonymous, but accountable.