# Behavior traces — pallets/werkzeug

> Canonical page: https://codevetter.com/unpack/werkzeug/behavior-traces

# Behavior traces — pallets/werkzeug

Scanned commit 594452f6a4fe4de38a544962fbf04bfc9d37fbc2 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The investigation followed development startup, URL creation and persistence, short-link resolution, multipart parsing, file serving, and test-client execution through their actual call sites. Each trace records execution order and meaningful failure branches. These are source-level walkthroughs, not runtime observations. The Redis-backed example provides the clearest complete application flow.
- Startup: Shortly.create_app constructs Shortly, optionally wraps wsgi_app with SharedDataMiddleware, then its __main__ block calls run_simple with debugger and reloader enabled. — [examples/shortly/shortly.py#L126-L139](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L126-L139)
- Server startup continues through run_simple → optional DebuggedApplication → make_server → socket inheritance and WERKZEUG_SERVER_FD assignment → run_with_reloader or serve_forever; threaded plus multiple processes is rejected. — [src/werkzeug/serving.py#L930-L952](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/serving.py#L930-L952) [src/werkzeug/serving.py#L1084-L1131](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/serving.py#L1084-L1131)
- Create-link flow: Shortly.__call__ → wsgi_app → Request → dispatch_request → bind_to_environ → match → on_new_url; valid POST input calls insert_url and redirects to details, while an invalid scheme re-renders the form. — [examples/shortly/shortly.py#L57-L67](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L57-L67) [examples/shortly/shortly.py#L107-L123](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L107-L123) [src/werkzeug/routing/map.py#L636-L683](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/routing/map.py#L636-L683)
- Persistence flow: insert_url first reads reverse-url:<url>; an existing mapping is reused, otherwise Redis INCR last-url-id → base36_encode → SET url-target:<id> → SET reverse-url:<url> establishes the new mapping. — [examples/shortly/shortly.py#L18-L26](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L18-L26) [examples/shortly/shortly.py#L93-L101](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L93-L101)
- Follow-link flow: routing calls on_follow_short_link → Redis GET target → NotFound if absent, otherwise INCR click-count → redirect; dispatch_request turns NotFound into error_404 and Response emits the final WSGI output. — [examples/shortly/shortly.py#L69-L91](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L69-L91) [examples/shortly/shortly.py#L107-L120](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L107-L120) [src/werkzeug/wrappers/response.py#L580-L592](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wrappers/response.py#L580-L592)
- Upload flow: Request.form → _load_form_data → _parse_form_data → FormDataParser.parse → _parse_multipart → MultiPartParser.parse → MultipartDecoder events; files become FileStorage and parser failures close streams through its context manager. — [src/werkzeug/wrappers/request.py#L388-L394](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wrappers/request.py#L388-L394) [src/werkzeug/wrappers/request.py#L445-L457](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wrappers/request.py#L445-L457) [src/werkzeug/formparser.py#L285-L309](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/formparser.py#L285-L309) [src/werkzeug/formparser.py#L367-L378](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/formparser.py#L367-L378)
- Download flow: send_from_directory → safe_join → regular-file check → send_file → open/stat → wrap_file and Response → apply_conditions → apply_range; conditional-processing errors close the response before propagating. — [src/werkzeug/utils.py#L580-L593](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/utils.py#L580-L593) [src/werkzeug/utils.py#L404-L420](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/utils.py#L404-L420) [src/werkzeug/utils.py#L483-L490](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/utils.py#L483-L490) [src/werkzeug/utils.py#L536-L546](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/utils.py#L536-L546)
- Test-client flow: Client.open obtains a Request from EnvironBuilder, calls Client.run_wsgi_app to attach and update cookies, constructs TestResponse, and optionally follows redirects while closing intermediate responses and detecting loops. — [src/werkzeug/test.py#L989-L1002](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/test.py#L989-L1002) [src/werkzeug/test.py#L1108-L1159](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/test.py#L1108-L1159)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)