Guardrail: Strict adherence to the Tagging Workflow. Everything defaults to #private. Only notes explicitly tagged #share pass through the publishing filter. Use clear folder structures to separate sensitive data that should never touch the publishing pipeline.
Have this for blog posts, separate folder and explicit status for publishing. A published garden first as a separate folder of cloned notes, then as tagged for publication? Needs a 'touching' process to see diverging note/clone.