Engineering a Dual-Path Commerce & Consultation Platform for AstroKraft

We worked feature-by-feature rather than as one large rewrite, verifying each change against the live database and a production build before it shipped. For the CSP and catalog bugs, we traced each issue to its root cause the catalog fix turned out to be an update path that only ever wrote the `price` field, leaving the rest of the tier's columns untouched on every edit and fixed the underlying logic rather than patching symptoms. For consultation booking, we moved pricing from the astrologer record onto a new `price` column on `consultation_categories`, made `consultations.astrologer_name` nullable, rewrote the customer-facing booking flow to stop at category selection, and built a new astrologer-assignment screen in the Expo admin app so staff could assign the right astrologer after the fact. For the Search Console findings, we added locale-redirect logic in middleware, added targeted `robots.txt` disallow rules for parameter-based crawl variants, and traced the soft-404s to `notFound()` calls returning HTTP 200 under ISR fixed by setting `dynamicParams = false` on the locale layout so invalid params genuinely 404 instead of silently rendering. For the Vercel cost issue, instead of guessing at caching changes, we used the Observability dashboard's Functions and Runtime Logs views to identify a crawler hitting nearly every page every 60–90 seconds, landing just past each page's 1-minute revalidation window and forcing near-constant regeneration. We raised `revalidate` from 60 to 300 seconds on the four highest-CPU routes, which matched the crawl cadence without weakening freshness for real catalog/pricing changes. For testimonials, we designed the feature the way a security-sensitive public write path deserves: a new `platform_reviews` table with RLS restricting writes to the service-role API route, a honeypot field, and after review an atomic Postgres function (`create_platform_review`) using a transaction-scoped advisory lock to rate-limit submissions per IP without a TOCTOU race, mirroring an existing pattern already used for purohit bookings. We added DB-level and schema-level length limits, a moderation queue in the admin app, and a homepage marquee component that auto-scrolls approved testimonials continuously (pausable on hover and keyboard focus, and disabled under `prefers-reduced-motion`).