Login worked, /me failed, and the browser blamed CORS. The real cause was three layers down: Swarm silently ignoring a short-form tmpfs key, which meant Starlette's outermost error middleware - the one layer that runs before CORS headers exist - was the one answering.
recompute() reads a stats row, decides what's new, then writes a fresh one back - with no lock between the read and the write. Two concurrent calls could disagree about what changed, or insert the same badge twice.
Picked once at onboarding, read from localStorage ever since - and gone the moment someone switched phones or cleared their browser. It was account state that had been living like a device preference.
One test in the suite fails only between midnight and 05:30 in India. It compares the machine's local date with a server that thinks in UTC. It's also a reminder to check a failure against the code before the change.
Adding an 'Add a note' action to a toast revealed that no toast button in the app had ever worked: the swipe-to-dismiss handler captured the pointer and stole every click.
A daily habit started on a Thursday showed a 0-week streak after ten straight days. The first week had been judged against seven days when only four existed.