Architecture

Payload 3 runs inside the Next.js App Router, so the admin and the site are one app and one deploy. Both languages go through next-intl (/en, /zh).
Pages are statically generated and refresh hourly as a fallback; saving content in the admin expires the pages, the sitemap and the search cache at once.
Supabase is used only as Postgres, with the Data API turned off. The anon and authenticated roles have no privileges on the site's tables, and every table has RLS on.

Deployment and verification

Branch protection requires a single CI check. It runs type checking, unit tests and a key check across the two languages' copy, then compares the database the migrations build with the schema the code defines, on a throwaway Postgres. Finally it seeds sample data, builds, starts the site and runs a smoke test.
After every production deploy, and once a day, the same smoke script requests the live pages, including paths that should return 404 and every internal link.
Migrations are written by hand. Dropping a column takes two steps: ship the new structure with the old column still there, and drop it separately once that's confirmed.
Without --apply, a script that writes to production only prints what it would change.

A query without a locale falls back to Chinese, so Chinese text showed up on English pages. That happened three times.
Comments used to take two requests, a bot check and then the write, with nothing tying them together, so skipping the first one still wrote a comment. Now both happen in one request.
While a post was still a draft, its 404 response carried its title. Since the fix, the CI smoke test creates a draft and checks that it returns 404 in both languages with no trace of the title.