#16 · stacks/smakelo

Shipped: /admin. Not the built-in dashboard — that needs its own server and its own layout tree, and fighting it would have bought less than the two things an operator of this site actually needs.

Guard checks. Smakelo makes a few claims about itself: real businesses are listed and nothing more, no invented review carries a real restaurant's name, no real payment can be taken, no contact details were collected. Each is enforced somewhere in code, and each could be broken by a change three files away without anything failing. All six are now checked against what is actually stored, with a line saying what it would mean if one broke. A guard nobody can see the state of is one you find out about afterwards.

Curation, because the most likely message this demo will ever receive is a restaurant asking why it is listed. Taking one down removes it from search, the discover page, the map, its own page, and ordering. That last part needed a fix: deleted_at was on the model and nothing read it, so a hide would have been honoured by exactly one screen. Hidden rather than deleted, so it comes back if the request turns out not to be from the owner. Hiding an invented partner is refused, since that would empty the ordering, kitchen and courier screens the site exists to show.

Verified: hiding gjelina drops it from the search API and 404s its place page; restoring brings both back.

Not built: courier invites and market management. Neither means much without accounts, and inventing an invite flow for invented people would be theatre. Claim approvals already live at /claims (#5).