Architecture

TanStack Start renders public routes and TanStack Router owns route-level loading, metadata, and navigation. Authenticated screens resume after Convex Auth resolves in the browser.

Indexed queries provide reactive reads. Mutations enforce validation, tenancy, and roles at the function boundary rather than trusting the client.

Provider callbacks terminate at signed HTTP actions. Idempotency ledgers and durable workflows separate acknowledgement from retryable domain work.