HerbLeaf — Store, content and community for indoor growing

Payment and advertising platforms' robots read the storefront: home, store, product, cart, checkout and institutional pages. A list of terms can't appear in any field there, whether text, meta, alt, structured data, slug or seed. The rule lives in three layers: a CI lint scans the public code; the backend rejects, with a 422 error pointing at the field path, any admin write to the storefront tables; and a migration fails if the production database still holds the term. The backend rejects instead of rewriting because silently rewriting would hide from the editor that their text changed. Editorial content follows a different rule, about content rather than vocabulary, so it stays out of that sweep.

The design export is the source of truth and doesn't get altered. It has no phone screens, so mobile is derived from desktop by written rules (grids going from 4 to 2 to 1 column, a sidebar that becomes chips, a hero that stacks) and approved in preview. The only change allowed without asking is one that doesn't alter the visual result, such as swapping a clickable span for a button with an accessibility label. Colors and sizes come from tokens, never loose hex in a component, and a fidelity review of all 63 screens fixed the high and medium divergences. The rest is recorded in design notes.

The front end never talks to the database. The order reaches the API, which recalculates prices, shipping and coupon and only then creates the preference on Mercado Pago. The webhook checks the signature, queries the Mercado Pago API to confirm the payment, and is idempotent: stock is deducted exactly once, even if the notice arrives twice. Shipping uses Melhor Envio through OAuth, with automatic token renewal.

Text with sale or trade intent doesn't publish, whether in the feed, a comment or a private message. The same expression runs in the browser, which warns instantly, and on the server, which is the one that counts; changing one without the other would make the screen promise what the server refuses. Each person's first post goes into a queue, and the admin has approval, removal, bans and reports.

News and events arrive through an automation that adapts the text to the house voice. Each item is identified by its source URL so it isn't duplicated, goes through the same compliance gate, and always lands as a draft in an admin queue to publish, edit or delete. The source's cover image isn't copied because of licensing: the article uses an editorial-section cover, and using the source image is left to the editor.

With standalone Docker, a container marked unhealthy stays as it is, and only Swarm restarts it. A watchdog scheduled in systemd, every 5 minutes, checks the containers, restarts the ones that hung, watches memory and disk, and tests the public endpoint from outside, which catches tunnel problems even when the container is healthy. Every container has a memory ceiling, so a leak kills the container instead of taking down the machine. In the pipeline, a deploy that fails to boot rolls itself back to the previous image.