Winnow — Architecture Snapshot

September 7, 2026 · revision 0d7090a. This diagram records the inspected version. Read the build specification for current behavior and module boundaries.

Winnow — Runtime Architecture An architecture diagram generated by Archify. Metadata & Update APIs · IGDB · Steam Web · steamcmd.net · Architecture component Metadata & Update APIs IGDB · Steam Web · steamcmd.net Storefront Sign-in · login.steampowered.com · Architecture component Storefront Sign-in login.steampowered.com Enrichment Clients · Winnow.Enrich.* · Covers · Your machine — no server, no accounts › Winnow process · .NET 10 generic host · Polly · soft-fail Enrichment Clients Winnow.Enrich.* · Covers Polly · soft-fail Embedded Sign-in · Winnow.Auth.WebView · Your machine — no server, no accounts › Winnow process · .NET 10 generic host · off-the-record Embedded Sign-in Winnow.Auth.WebView off-the-record Secret Store · DPAPI-encrypted rows · Your machine — no server, no accounts › Winnow process · .NET 10 generic host · refuses plaintext Secret Store DPAPI-encrypted rows refuses plaintext Launcher Files · Steam · Epic · GOG · Your machine — no server, no accounts › Store-owned files · read-only · never written Launcher Files Steam · Epic · GOG never written Running Game Processes · OS process table · Your machine — no server, no accounts · matched on the tree Running Game Processes OS process table matched on the tree Ingest Readers · Winnow.Ingest.* · Your machine — no server, no accounts › Winnow process · .NET 10 generic host · 2s install refresh Ingest Readers Winnow.Ingest.* 2s install refresh Entity Resolver · Winnow.Resolve · Your machine — no server, no accounts › Winnow process · .NET 10 generic host · no fuzzy auto-merge Entity Resolver Winnow.Resolve no fuzzy auto-merge SQLite Library · Winnow.Data · Dapper · Your machine — no server, no accounts › Winnow process · .NET 10 generic host · %LOCALAPPDATA%\Winnow SQLite Library Winnow.Data · Dapper %LOCALAPPDATA%\Winnow Session Monitor · Winnow.Monitor · Your machine — no server, no accounts › Winnow process · .NET 10 generic host · 5s poll · event exit Session Monitor Winnow.Monitor 5s poll · event exit Recommender · Winnow.Recommend · Your machine — no server, no accounts › Winnow process · .NET 10 generic host · repositories only Recommender Winnow.Recommend repositories only Avalonia UI · Winnow.App · MVVM · Your machine — no server, no accounts › Winnow process · .NET 10 generic host · reads DB, sends commands Avalonia UI Winnow.App · MVVM reads DB, sends commands read-only scan CandidateOwnership works · releases sessions HTTPS · rate-limited cached metadata user-present sign-in access + refresh token API key · client secret reads buckets signals in · feed out process tree Your machine — no server, no accounts Winnow process · .NET 10 generic host Store-owned files · read-only

Ingest and identity

  • • Steam VDF/ACF, Epic .item manifests and GOG Galaxy are read, never written
  • • Readers emit CandidateOwnership only; they never write works or releases
  • • StorefrontParserLimits caps input at 64 MiB and 64 nesting levels per file
  • • Hard external-id joins auto-merge; soft title matches queue for a human
  • • Work, Release, Ownership and PlayRecord stay four distinct layers

Background work and external calls

  • • SessionWatcherService: 5s discovery, event-driven exit, 60s debounce
  • • Install refresh polls the manifest inventory every 2s while the app is open
  • • Entitlement backfill on a 6-hour timer; snapshots keep the longitudinal playtime
  • • IGDB v4 via Twitch client-credentials (~4 rps); gamesdb.gog.com routes Epic titles
  • • Every client is Polly-throttled, cached and off the first-paint path

Trust boundaries

  • • No server and no Winnow account; state stays in the local data directory
  • • Sign-in runs in an in-memory WebView; Winnow never sees the password
  • • Exactly two secrets at rest from sign-in: the access and refresh tokens
  • • A host that cannot DPAPI-encrypt refuses to store rather than write plaintext
  • • Unattended calls are limited to finalizelogin, transfer_info and one token mint