Route, DTO, service, repository, schema — one folder per table, always the same five files.

Business rules never touch HTTP or SQL, so a module is testable with no server and no database, and a new developer can guess where anything lives.

The model speaks the business’s language, and invariants live with the aggregate that owns them.

When a rule changes, it changes in one place. Scattered validation is how two endpoints end up disagreeing about what a valid order is.

A module is declared once in a manifest; routes, menus, permissions, schema, and CRUD are generated from it.

Hand-writing the same eight files per table is where drift enters. Generate them and every module is identical by construction.

Header and lines update together: existing rows update by id, new rows insert, removed rows soft-delete, totals recompute.

The naive version deletes everything and re-inserts, which throws away ids, history, and anything that referenced them. Reconciling is the only version that survives an audit.

Services publish what happened; whoever cares subscribes. No service calls another to tell it to update.

Adding a consumer never means redeploying the producer, and a slow downstream cannot stall the write that triggered it.

Anything slow — exports, PDFs, SMS batches, imports — leaves the request through a Postgres-backed queue.

The request returns in milliseconds and the work still happens, with retries and a record of every attempt. No extra broker to keep alive.

A read hands back the row’s version; the update sends it back, and a stale one is refused with a 409.

Two people editing the same record no longer means the second save silently erases the first. The version travels as a header, so no update schema changes.

Every create, update, and delete writes one structured diff — field, old value, new value — never prose.

The sentence is rendered at read time, so relabelling a field or fixing wording reaches rows written years ago. Frozen prose could never be corrected.

Roles grant endpoints; scope narrows rows. A franchisee sees their branch, not a filtered copy of everyone’s.

Filtering in the dashboard is not access control — it is a UI convenience that a direct API call walks straight past.

Redis in front for reads that repeat, PgBouncer in front of Postgres so connections are borrowed, not opened.

A fleet of services each opening their own pool will exhaust a database long before traffic does.

Static and live checks that each make a whole class of bug impossible to merge, wired into the pre-push hook.

A convention nobody can violate beats a convention written in a README. Every guardrail exists because that bug shipped once.

Cloudflare Tunnel to Caddy to PM2-managed services, with no inbound port open on the host.

The origin has no public attack surface at all, and TLS renews itself. Thirty-five services, one predictable shape.