Rebounder Tech Blog

gcloud sql clone point-in-time: a Real Restore Drill

Tue, 13 Oct 2026 00:00:00 GMT

A record of restoring production Cloud SQL with gcloud sql instances clone --point-in-time: time to become usable, cost, and why it's private-IP only.

enabled: false Silently Disabled Claude Code Scheduled Tasks

Thu, 08 Oct 2026 00:00:00 GMT

Running Claude Code scheduled tasks on 6 daily slots for 7 weeks surfaced 3 ways they stop: never starting, dying mid-run, or enabled: false disabling the slot.

maxOutputTokens Was Missing, So Usage Had No Ceiling

Thu, 08 Oct 2026 00:00:00 GMT

A student chat reachable via anonymous magic link was rate-limited only per instance, with a regenerable cookie, leaving output and call count uncapped.

company_id Is Always Null on Public/Share Links

Thu, 08 Oct 2026 00:00:00 GMT

A duplicate check read company_id from the invite record, which public/share/QR applications never create, so the ID was always null and slots got re-booked.

Only Our Vercel API Functions Threw Cannot Find Module

Thu, 08 Oct 2026 00:00:00 GMT

tsc and vite dev pass locally, but Vercel Node Functions reject extensionless relative imports in production, crashing with Cannot find module.

is_pilot Backfill Misses Companies With Only One EXISTS

Wed, 07 Oct 2026 00:00:00 GMT

A backfill UPDATE that flags is_pilot with a single EXISTS(contracts) check misses creatives-only companies, which then get production-grade customer email.

A Poster's Title Shows Up as IMG_1234 on the Classroom TV

Wed, 07 Oct 2026 00:00:00 GMT

Raw filenames become titles, so IMG_1234 from a camera shows up on the classroom TV. We classify machine-generated names with regex and treat them as empty.

Bing Webmaster UrlCount Stuck at 1: the sitemap-index Trap

Tue, 06 Oct 2026 00:00:00 GMT

Submitting only sitemap-index.xml to Bing Webmaster makes it count UrlCount as 1 and stop, stalling impressions for days until child sitemaps go in directly.

listTotal Skips the units Multiplier, Preview Price Drifts

Tue, 06 Oct 2026 00:00:00 GMT

A bundle discount preview added termFee without multiplying by units, so a request for several slots always showed the price for just one slot.

max-width:900px Loses to a Later Same-Specificity Rule

Tue, 06 Oct 2026 00:00:00 GMT

A mobile @media override had no effect — text wrapped one char per line. Cause: a same-specificity base rule placed later in the file won the tie.

ScanFilter.setDeviceAddress Throws on the String "null"

Tue, 06 Oct 2026 00:00:00 GMT

ScanFilter.setDeviceAddress throws on invalid strings; optString turns a JSON null into "null", which slips a blank guard and crashes the Service.

migrate_image_tag drifts from live after concurrent deploys

Tue, 06 Oct 2026 00:00:00 GMT

Two concurrent Cloud Run deploys left one session's change committed to Terraform's locals after another's unrelated commit, leaving the ledger behind live.

dpm set-device-owner Launches the App Before prefs Is Set

Mon, 05 Oct 2026 00:00:00 GMT

dpm set-device-owner launches the app instantly. Write prefs first, or the app mints its own device_id — one force-stop can no longer undo as device owner.

gcloud ADC Expires After ~44h: Reauthentication failed Fix

Sun, 04 Oct 2026 00:00:00 GMT

A scheduled AI agent calling the Search Console API died with Reauthentication failed. cannot prompt during non-interactive execution. Fix: a service account.

allUsers + objectViewer on GCS Grants list, Not Just get

Sat, 03 Oct 2026 00:00:00 GMT

A public GCS bucket granted allUsers objectViewer, which bundles get with list, letting anyone enumerate every object key instead of just fetching known ones.

Valid Token, Wrong Scope: an IDOR via design/date Parameters

Sat, 03 Oct 2026 00:00:00 GMT

A classToken-scoped signage API trusted its own design and date query parameters, letting a valid token pull names and dates it was never meant to show.

vercel inspect won't show which commit is live

Mon, 28 Sep 2026 00:00:00 GMT

vercel --prod via CLI (no GitHub integration) means concurrent deploys overwrite each other, and vercel inspect never shows which git commit is actually live.

term_months Display Drifts From Amount After Term Extension

Fri, 25 Sep 2026 00:00:00 GMT

Extending a contract term changes the billed period, but invoice/application pages still read term_months from the plan, so period and amount disagree.

@media(max-width:899px) Leaks Into a Scaled Signage Preview

Fri, 25 Sep 2026 00:00:00 GMT

A preview scaled with transform:scale() stays 1280x720, but @media(max-width:899px) for phones fires on real viewport width, leaking in mobile layout.

semgrep --config=auto Turns main Red, No Code Changed

Fri, 25 Sep 2026 00:00:00 GMT

semgrep ci --config=auto fetches the registry's rules every run, so main turns red the day upstream adds one, with zero code changed. Fix: pin rules and image.

amount_unset: Stripe's 7-Day Auto-Switch Never Fires

Thu, 24 Sep 2026 00:00:00 GMT

A Stripe contract with no amount set gets a notice promising an auto-switch to invoicing in 7 days — but the fallback needs amount != null, so it never closes.

sp.units Query Param Shows 5x Price for a 1-Unit Invite

Wed, 23 Sep 2026 00:00:00 GMT

Invite apply confirms 1 unit server-side, but the display used the raw query param, showing 5 units and 5x the price for a 1-unit contract.

gen-og.ts Cache Hid an Overwritten OG Image on 91 Posts

Wed, 23 Sep 2026 00:00:00 GMT

gen-og.ts wrote both languages to one og/${slug}.png; the later run won, and the cache called it fresh — 91 of 95 Japanese posts got an English share card.

Next.js 15.1.6 Got Blocked by Vercel as a Vulnerable Version

Wed, 23 Sep 2026 00:00:00 GMT

Pushing to Vercel with next pinned to 15.1.6 blocked the deploy pre-build — Vercel flagged it as vulnerable, and it stayed blocked until bumped to ^15.5.23.

pnpm-lock.yaml Made Vercel Misdetect an npm Project as pnpm

Wed, 23 Sep 2026 00:00:00 GMT

An untracked pnpm-lock.yaml made Vercel misdetect an npm repo as pnpm, since .vercelignore stops it reading .gitignore, and a version mismatch broke build.

Next.js Server Action Fail-Open: error Read as Success

Tue, 22 Sep 2026 00:00:00 GMT

A server action judged success by {data} alone, ignoring error. A transient DB failure then left the customer page and internal Slack contradicting each other.

01.dnsv.jp Full-Zone Replace Deletes Unrelated A Records

Tue, 22 Sep 2026 00:00:00 GMT

Onamae.com DNS submits the whole zone, not just the edit, so adding a subdomain can delete an unrelated A record missing from the stale copy on screen.

console_name.sql Collided Again 58 Minutes Later

Mon, 21 Sep 2026 00:00:00 GMT

I renamed a file to fix a duplicate migration number. 58 minutes later, two other branches had picked the same number, and trunk got three same-numbered files.

fail-closed Guard Was Missing From Two Other Write Paths

Mon, 21 Sep 2026 00:00:00 GMT

kimiteras-portal added a fail-closed guard to direct bookings, then found it missing from group distribution and invite issuance, which can't be recalled.

reminder_log_kind_check Regex Test Was a False Green

Mon, 21 Sep 2026 00:00:00 GMT

A static test extracted CHECK constraint values with a regex anchored on the constraint's name, matching a SQL comment or another table's check(kind in) clause.

RegExp.test False Positive: "unsigned" Matches "signed"

Sun, 20 Sep 2026 00:00:00 GMT

An unanchored regex for contract completion let "unsigned" match "signed", auto-archiving unsigned documents as completed.

Google Custom Search API 403: Switched to Brave Search API

Sun, 20 Sep 2026 00:00:00 GMT

Headless rank checks hit 403: This project does not have the access to Custom Search JSON API. Why Brave Search is the default now, with Serper as backup.

copyOneDay Overwrite Silently Drops Pinned Notices

Sat, 19 Sep 2026 00:00:00 GMT

The signage editor's copy-from-another-day feature overwrote a day's notices wholesale, silently dropping any pinned notice a teacher had entered.

supabase-js count Query Returns null on Failure

Sat, 19 Sep 2026 00:00:00 GMT

A daily health monitor fell back a failed supabase-js query to 0/[] without checking error, hiding its own failure as 'all clear.'

start_month Missing Lets a Contract's Period Go NULL

Thu, 17 Sep 2026 00:00:00 GMT

A contract published with start_month missing gets period_start and period_end NULL, so the expiry sweep never fires and the slot stays live forever.

Next.js Middleware Missing an Exclusion Forces Login

Thu, 17 Sep 2026 00:00:00 GMT

Next.js middleware (Proxy) checks auth on every route by default. Forget to exclude a new no-login route (a public share link) and it still redirects to /login.

entity_id Was uuid, We Inserted a Token — 22P02

Wed, 16 Sep 2026 00:00:00 GMT

audit_logs.entity_id is a uuid column, but the code passed a 64-hex token straight in. The insert failed with 22P02, and a catch block swallowed it silently.

A 200 OK That Crashes a Server Component

Wed, 16 Sep 2026 00:00:00 GMT

An external API returned 200 but was missing a required field. Casting the JSON skips runtime validation, so the Server Component crashes without it.

PostgREST .or() Breaks Silently on a Comma

Wed, 16 Sep 2026 00:00:00 GMT

A search query interpolated raw text into .or(), so a comma broke the filter. supabase-js returns {data:null}, not a throw, so the category vanished silently.

Only system_admin Hits The Audit Log Foreign Key Constraint

Tue, 15 Sep 2026 00:00:00 GMT

The audit log's actor referenced users by foreign key, so only actions by system_admin — kept in a different table — failed on insert with 23503.

polynomial-redos: Missing ^ Made a Trim Regex O(n^2)

Tue, 15 Sep 2026 00:00:00 GMT

A trailing-slash regex without a leading ^ anchor tripped CodeQL's js/polynomial-redos in three spots, backtracking to O(n^2). Replaced with a linear scan.

pnpm --filter build "Module not found": Use web...

Mon, 14 Sep 2026 00:00:00 GMT

In a pnpm workspace, `--filter web build` skips building dependencies, leaving dist missing and Turbopack throwing 93 Module not found. `...` fixes it.

Duplicate Key Value Violates Unique Constraint, Permanently

Mon, 14 Sep 2026 00:00:00 GMT

Publishing a version as a non-atomic demote-then-insert leaves one update stranded under concurrency, and every later publish fails on duplicate key forever.

Cloudflare Web Analytics Over GA4 for This Tech Blog

Sun, 13 Sep 2026 00:00:00 GMT

To avoid taxing Core Web Vitals twice and more cookie copy, this blog skips GA4 for Cloudflare Web Analytics — losing 2 days of data before the tag shipped.

drizzle-kit generate Duplicate ADD COLUMN: Stale Snapshot

Sun, 13 Sep 2026 00:00:00 GMT

A column added but not reflected in the drizzle snapshot makes the next generate re-emit an ADD COLUMN with no IF NOT EXISTS, failing where it already applied.

NoSuchBucket: Destroying Staging Broke Prod Ad Images

Sun, 13 Sep 2026 00:00:00 GMT

A staging GCS bucket URL was baked as a seed script's env-var fallback into production's media_url. Destroying staging then 404'd prod images with NoSuchBucket.

findUnmaskedPii False-Positives After Unmask

Sun, 13 Sep 2026 00:00:00 GMT

A PII check after unmasking flags a teacher's restored phone or email as a raw leak, discarding the draft. Checking before unmask fixes it, no detection lost.

"An invalid form control is not focusable": Hidden Steps

Thu, 10 Sep 2026 00:00:00 GMT

A form's steps toggled with hidden. An empty required field on a now-hidden step made the confirm step's submit button do nothing.

Next.js Build Breaks on a Module-Level Resend Client

Thu, 10 Sep 2026 00:00:00 GMT

A Resend client at module scope makes next build throw "resend_api_key is required" when page-data collection imports the route without the env var.

supabase-js .range() Without .order() Drops Rows

Wed, 09 Sep 2026 00:00:00 GMT

OFFSET/LIMIT paging with .range() can duplicate or drop rows at a page boundary without .order(). One missing reference marks a live asset for deletion.

Two PaymentIntents: a Losing webhook Reverts the Winner

Wed, 09 Sep 2026 00:00:00 GMT

Two tabs completing the same Checkout create two PaymentIntents. An UPDATE that never checked the PI id let the loser's webhook revert the winner's live hold.

supabase-js try/catch Doesn't Catch Errors: Check { error }

Wed, 09 Sep 2026 00:00:00 GMT

supabase-js never throws on network or PostgREST failure; it resolves to {data: null, error}. Checking only data can't tell a failed read from a missing row.

read-merge-write Drops a Key Without FOR UPDATE

Tue, 08 Sep 2026 00:00:00 GMT

A Server Action read a co-located key with a plain SELECT, not FOR UPDATE, so concurrent saves lost an update to last-writer-wins. Cause and the row-lock fix.

if/else-if as Kotlin's ?.let Return Value Requires else

Tue, 08 Sep 2026 00:00:00 GMT

An else-less if/else-if last in a Kotlin ?.let block hits "if must have both main and else branches if used as an expression". Cause and the return@let fix.

Telling not-allowed From no-speech in SpeechRecognition

Tue, 08 Sep 2026 00:00:00 GMT

The mic button did nothing on not-allowed or audio-capture. Every error was ignored — but warning on benign codes like no-speech makes the UI noisy instead.

Promise.all Concurrent Writes Lose to last-writer-wins

Mon, 07 Sep 2026 00:00:00 GMT

An AI multi-day edit can duplicate today into the top-level write and the days array, so two replace-saves hit one row and Promise.all lets the later one win.

Missing frame-src in CSP Blocks YouTube, Kills Watch Logs

Mon, 07 Sep 2026 00:00:00 GMT

A learning-video CSP had no frame-src, so default-src 'self' blocked every YouTube embed — and window.YT never loaded, so watch-time tracking died too.

Next.js Server Actions bodySizeLimit: Raising Isn't Enough

Mon, 07 Sep 2026 00:00:00 GMT

A Server Action throws before returning once its body exceeds bodySizeLimit, hitting the error boundary. Raising the limit alone won't fix it; add size guards.

An Empty contractId Gives invalid input syntax uuid

Mon, 07 Sep 2026 00:00:00 GMT

Stripe's company-level card registration (Setup Mode) has no contractId, but the caller's type still required a string, so an empty string hit a uuid column.

Drizzle onConflictDoUpdate Writes null: Use COALESCE

Sun, 06 Sep 2026 00:00:00 GMT

Drizzle onConflictDoUpdate writes set values over the row as-is. A source returning partial nulls can erase a known-good value unless wrapped in COALESCE.

cqw Fails Silently When the DOM Around It Changes

Fri, 04 Sep 2026 00:00:00 GMT

cqw stops working with no error once a DOM structure change leaves the referenced container width undetermined — the preview rendered at full size and clipped.

Hand-Built Preview Payload Drifts From the Device

Fri, 04 Sep 2026 00:00:00 GMT

The class editor's board preview hand-built its base and pinned automatic blocks to null. The device builds every block from one source, so the two disagreed.

pdfjs-dist standard_fonts Missing in Next.js standalone

Fri, 04 Sep 2026 00:00:00 GMT

pdfjs-dist loads its standard fonts dynamically over file://, so Next.js file tracing cannot follow it and the standalone build ships without them.

A disabled Submit Button Dies Before Hydration

Fri, 04 Sep 2026 00:00:00 GMT

Driving the disabled attribute from server state left the button permanently disabled before hydration or when JS failed, making the signing form unsubmittable.

Duplicate URLs in a Feed Break ON CONFLICT DO UPDATE

Thu, 03 Sep 2026 00:00:00 GMT

Duplicate URLs made one upsert hit "ON CONFLICT DO UPDATE command cannot affect row a second time" (21000), and a fail-soft catch skipped the feed silently.

A Ledger INSERT Failure Swallowed as a Duplicate

Thu, 03 Sep 2026 00:00:00 GMT

The Stripe webhook read every ledger INSERT failure as Postgres 23505 idempotency and returned 200, so a transient fault lost the event — Stripe never retried.

Supabase maybeSingle() PGRST116: Multiple Rows Returned

Thu, 03 Sep 2026 00:00:00 GMT

An evidence-PDF API filtered on 2 of 3 unique-key columns, then called maybeSingle(). Once a second row existed for that pair, real data started returning 404.

Missing passThroughEnv Skips Tests While CI Stays Green

Thu, 03 Sep 2026 00:00:00 GMT

Without passThroughEnv, turbo won't forward CI's DATABASE_URL to vitest. A describe.skip guard hides the gap, so CI stayed green while 24 RLS tests never ran.

Only the Poll Stringifies Date: getTime Is Not a Function

Wed, 02 Sep 2026 00:00:00 GMT

SSR restores Date as a Date, but the same screen's polling gets a string from res.json(). Calling .getTime() on it took the whole board down.

insetsController Is null Before setContentView

Tue, 01 Sep 2026 00:00:00 GMT

window.insetsController returns null before setContentView() because the DecorView is not resolved yet. hide() never runs and immersive mode silently fails.

One startActivity Is Not Enough to Blank a Kiosk Screen

Tue, 01 Sep 2026 00:00:00 GMT

An always-on Android kiosk that blanks its screen with one startActivity stays lit all night when BAL limits or a missing SYSTEM_ALERT_WINDOW block the call.

Supabase SECURITY DEFINER RPC Callable by anon: Revoke It

Tue, 01 Sep 2026 00:00:00 GMT

A SECURITY DEFINER write RPC gets PUBLIC EXECUTE by PostgreSQL default. Without a revoke, anon can call it directly through Supabase's PostgREST layer.

read-merge-write Without FOR UPDATE Loses Keys

Sun, 30 Aug 2026 00:00:00 GMT

Several settings keys share one JSONB row. A partial update that reads and writes back without SELECT ... FOR UPDATE loses the key a concurrent save just wrote.

Only One Branch Had No Way to Add the First Item

Sun, 30 Aug 2026 00:00:00 GMT

The school structure screen branches three ways on two booleans, and the state with grades but no departments had no way to add a department at all.

Re-consent to Revised Terms Does Not Reset auto_renew

Sun, 30 Aug 2026 00:00:00 GMT

A customer re-consents to terms without the auto-renewal clause, yet auto_renew stays true. The flag is only ever written false to true.

Media Queries See the Real Viewport in a Scaled Stage

Sun, 30 Aug 2026 00:00:00 GMT

A fixed-size preview shrunk by transform:scale still evaluates its media query against the real viewport, so a big monitor takes the wide profile and overflows.

left:50% With width:fit-content Makes max-width Never Apply

Sat, 29 Aug 2026 00:00:00 GMT

An absolute plate centred with left:50% and width:fit-content wrapped long before its max-width. Shrink-to-fit subtracts the left offset from available width.

An inset box-shadow Ring Hides Behind a Child Background

Sat, 29 Aug 2026 00:00:00 GMT

A ring drawn with inset box-shadow vanished under a child with its own background. inset shadows paint at the background stage, below static children.

The Edit Form Pruned Selections It Could Not See

Fri, 28 Aug 2026 00:00:00 GMT

The edit form auto-prunes selections missing from the refetched list, losing them on an unrelated save — a price-only save could shrink the targeted monitors.

A Non-Numeric env Becomes NaN and Slips Past ??

Fri, 28 Aug 2026 00:00:00 GMT

A non-numeric env makes parseInt return NaN, slipping past the truthy check and ??. That NaN reached setTimeout, so the AbortController aborts immediately.

Narrowing a Page's Roles Left the Action's Gate

Fri, 28 Aug 2026 00:00:00 GMT

Changed only the parent page's roles, forgot the child component's gate: requireRole narrowed to system admins while the panel kept its publisher gate.

A Post-Charge DB Failure Read as a Card Decline

Fri, 28 Aug 2026 00:00:00 GMT

Swallowing a post-payment failure in catch causes a double charge — a transient DB error after the charge succeeded was diagnosed as a card decline.

RLS Allowing actor_user_id NULL Erases Audit Trails

Thu, 27 Aug 2026 00:00:00 GMT

The audit log INSERT policy allowed actor_user_id IS NULL for any role. A compromised tenant account could log its actions as actor=NULL and escape the trail.

A Leftover sticky top:0 Makes a fixed Bar Fill the Screen

Thu, 27 Aug 2026 00:00:00 GMT

Switching to position:fixed without clearing the sticky top:0 leaves top and bottom both set, stretching the box to the full viewport height.

The Leak Check Only Grepped Half the Package

Thu, 27 Aug 2026 00:00:00 GMT

A build script grepped the package against a word list for internal comment text. Internal wording leaked anyway: the grep path missed half the package.

A New httpOnly Cookie 401s Only Already-Logged-In Users

Wed, 26 Aug 2026 00:00:00 GMT

A write-only httpOnly HMAC cookie shipped and only staff logged in before the deploy got 401s, while the UI still showed them signed in.

A Public Route Missing From the middleware matcher

Wed, 26 Aug 2026 00:00:00 GMT

The public signage page is anonymous — no __session. Left out of the middleware matcher's exclusion list, every device was redirected to /login instead.

Duplicating a Placement Without Ending the Old One

Wed, 26 Aug 2026 00:00:00 GMT

Subscription auto-renewal duplicates placements for the successor. Without ending the original row, inventory capacity is double-counted in the remaining sum.

LIMIT 1 Without ORDER BY Returns Another Tenant

Tue, 25 Aug 2026 00:00:00 GMT

dev-login resolved a school_admin with a SELECT LIMIT 1 and no ORDER BY, so as multi-tenant test data grows it can return a uid from an unintended school.

proxy.ts Redirected API-Key Endpoints to the Login Page

Tue, 25 Aug 2026 00:00:00 GMT

Next.js proxy.ts listed only /api/health as exempt from session auth, so /api/v1/ and /api/mcp/ with their own API key auth were redirected to the login page.

?? Defaults Overwrite Fields the Form Never Sent

Tue, 25 Aug 2026 00:00:00 GMT

A Supabase partial update can overwrite fields the form never sent: ?? default treats an unsent field as the default, rolling live slots back to vacant.

Holding-Only Checks Reapply a Bundle Discount

Mon, 24 Aug 2026 00:00:00 GMT

A bundle discount decided only by what the buyer holds was applied repeatedly on further purchases — an idempotency bug. A granted-history check fixed it.

The Lock Held; the Count Counted Intent, Not Writes

Mon, 24 Aug 2026 00:00:00 GMT

A flaky test where newlyDown summed to 2 instead of 1 was not the DB rows but the summary. FOR UPDATE serialised the writes; the count used the classification.

A Temp-Password Guard Written Per Page Leaks by URL

Mon, 24 Aug 2026 00:00:00 GMT

A must_change_password advertiser could skip the forced change by going to any page but /dashboard by direct URL. The guard lived per page, not in one place.

RLS On Is Not Safe While TRUNCATE Is Granted

Mon, 24 Aug 2026 00:00:00 GMT

chat_knowledge had RLS enabled and zero policies, yet Supabase's default grants left TRUNCATE on anon/authenticated. TRUNCATE is not subject to RLS at all.

Humanising an Error Message Cost the Dead-Letter Its Trace

Sat, 22 Aug 2026 00:00:00 GMT

Coverage validation returned only admin-form Japanese. Reusing it as the dead-letter last_error dropped the school ID, so logs could not name the cause.

Permissions-Policy: microphone=() Blocks Your Own Origin Too

Sat, 22 Aug 2026 00:00:00 GMT

Permissions-Policy: microphone=() allows no origin at all, blocking our own Web Speech API voice input with no permission prompt. Fixed with microphone=(self).

Stripe Checkout Session expires_at: 24h Default Holds Seats

Sat, 22 Aug 2026 00:00:00 GMT

A Stripe Checkout Session with no expires_at defaults to 24 hours, and a booking abandoned without paying keeps occupying capacity that whole time.

Aborting streamObject Leaves usage as an Unhandled Rejection

Fri, 21 Aug 2026 00:00:00 GMT

Wiring an AbortSignal into the Vercel AI SDK's streamObject makes result.usage reject on abort. If the caller returns without awaiting done, nothing catches it.

Fixing a detect-non-literal-regexp False Positive

Fri, 21 Aug 2026 00:00:00 GMT

An E2E fallback, new RegExp(c.path.replace(...)), tripped Semgrep's detect-non-literal-regexp. The branch was unreachable, so we deleted it with a type.

A Stale Branch Deploy Silently Reverted Features

Fri, 21 Aug 2026 00:00:00 GMT

A deploy from a branch with an old merge base silently rolls back existing features: the Cloud Run image tag drops what merged to main since it diverged.

YT.Player Replacing a div Can Leave a Black Screen

Fri, 21 Aug 2026 00:00:00 GMT

Initialising the YouTube IFrame API by handing it a div shows nothing until that div becomes an iframe, and depending on timing playback never starts.

Removing a Role-Change Seam With No Callers Left

Thu, 20 Aug 2026 00:00:00 GMT

Forgetting to delete an unused privilege-changing function leaves an attack surface: it wrote any role and any school ID into IdP claims, with no callers left.

Phone Numbers Garble When Copied From a pdf-lib PDF

Thu, 20 Aug 2026 00:00:00 GMT

Embedding NotoSansJP through fontkit into pdf-lib garbles digits on copy and pdftotext. GSUB picks glyphs the ToUnicode CMap has no entry for.

Remounting a Form by key Resets Uncontrolled Inputs

Thu, 20 Aug 2026 00:00:00 GMT

With

Carrying a creative_id Revived an Ended Placement

Thu, 20 Aug 2026 00:00:00 GMT

Status rolls back when several batches run on the same day: renewal keeps creative_id on both rows, so another batch flips the ended one back to booked.

Two Migrations Claimed the Same Sequence Number

Wed, 19 Aug 2026 00:00:00 GMT

Two feature branches both created migration 0035. Both applied to production as idempotent SQL, but a fresh database run in order has no guaranteed sequence.

A staging Default in env Deleted Production Images

Wed, 19 Aug 2026 00:00:00 GMT

Leave another environment's bucket as an env var's fallback and that value gets written into the production database, vanishing the day staging is destroyed.

Half-Controlled Forms Silently Revert on Resubmit

Wed, 19 Aug 2026 00:00:00 GMT

React 19's resets uncontrolled inputs to defaultValue whether it succeeded or not. Control only some fields and the rest revert silently.

Linking Everyone to a Tenant-Only Feature Gave 502

Wed, 19 Aug 2026 00:00:00 GMT

The application page always showed a PDF copy link to a route implemented for one tenant type only. The other side got a 502, though nothing had failed.

A CHECK Rewrite Erased Another Branch's Value

Tue, 18 Aug 2026 00:00:00 GMT

Rewriting a PostgreSQL CHECK constraint with DROP then ADD silently removes values another branch added. share_links.kind lost receipt, with no migration error.

A 23503 FK Violation Disguised as a Conflict

Tue, 18 Aug 2026 00:00:00 GMT

An operator ad submission failed in production and was reported as a different error — "conflicted with another operation". The real cause: foreign key 23503.

auth/invalid-password: App Allowed Shorter Passwords

Tue, 18 Aug 2026 00:00:00 GMT

App minimum password length (4) was below Identity Platform's (6), so createUser returned auth/invalid-password uncaught: an error boundary, not a form error.

A Missing force-dynamic Froze a Flag Flip Behind Static HTML

Tue, 18 Aug 2026 00:00:00 GMT

Enabling teacher login changed nothing on screen. With no dynamic API call, Next.js prerendered the route at build time and the CDN cached it for a year.

A UI Freeze Without a Server Check Is Not a Freeze

Tue, 18 Aug 2026 00:00:00 GMT

Editing disabled in the UI but the API does not validate: a direct POST could rewrite targeting while the update path checked only "live", not "bought out".

An Android Foreground Service Can Die Without Crashing

Mon, 17 Aug 2026 00:00:00 GMT

Guarding only pollOnce() is not enough. An exception in delay or the backoff calculation exits while(true) quietly, stopping the work while the app lives on.

Enabling a Cloud Run Job Fails With SecretsAccessCheckFailed

Mon, 17 Aug 2026 00:00:00 GMT

A Cloud Run Job and its secret_accessor IAM in one Terraform apply is a race: creation-time validation runs before IAM propagates. Ordering it with depends_on.

Routing Scanned PDFs to Gemini by Chars per Page

Mon, 17 Aug 2026 00:00:00 GMT

Scanned PDF text extraction fails: pdfjs-dist returns a near-empty text layer. Below a per-page char threshold, send bytes to Gemini as an OCR fallback part.

Auth Middleware Redirects robots.txt to the Login Page

Mon, 17 Aug 2026 00:00:00 GMT

Middleware that sends unauthenticated users to /login tends to treat robots.txt the same way. Crawlers get a 307 and the Lighthouse SEO audit fails.

Astro 7 Breaks Content Collections in Three Places

Sun, 16 Aug 2026 00:00:00 GMT

Upgrading Astro fails with LegacyContentConfigError. Three things changed at once: where the config file lives, the required loader, and the render API.

drizzle-kit migrate Does Not Apply Hand-Written SQL

Sun, 16 Aug 2026 00:00:00 GMT

Migrations succeed but RLS policies and audit triggers are missing in production. drizzle-kit migrate runs only drizzle-generated DDL.

Your First Dev Board Depends on What You'll Build

Sun, 16 Aug 2026 00:00:00 GMT

ESP32, Raspberry Pi and FPGA cover completely different ground. A thing that communicates, a small computer, or learning circuits — that is the choice.

Three Errors You Actually Hit Connecting Actions to GCP

Sun, 16 Aug 2026 00:00:00 GMT

Workload Identity Federation splits configuration across three layers and impersonation fails if any is missing. The three real errors, in order.

Gemini Thinking Tokens Eat maxOutputTokens

Sun, 16 Aug 2026 00:00:00 GMT

A chat AI hung on "thinking" in production only. Gemini's thinking tokens eat the maxOutputTokens budget, so the response ends empty before output starts.

The JMA Evening Update Nulls Today's Temperature

Sun, 16 Aug 2026 00:00:00 GMT

Japan's JMA forecast API drops today's temperature in the 17:00 update. Upsert it straight through and the morning's value is overwritten with null.

FLAG_KEEP_SCREEN_ON Not Working on Android: The Screensaver

Sun, 16 Aug 2026 00:00:00 GMT

An always-on Android display still goes black with FLAG_KEEP_SCREEN_ON set. The most likely cause is the screensaver, and settings put resets on every reboot.

Next.js Bundling a wasm Package Breaks Only in Production

Sun, 16 Aug 2026 00:00:00 GMT

A WASM library for PDF generation got bundled by Next.js and broke in production with a path type error. Bundling changes how the wasm relative path resolves.

SECURITY DEFINER Fails in Production: the Executing Role

Sun, 16 Aug 2026 00:00:00 GMT

CI passes but production gets nothing from a SECURITY DEFINER function. The owner is whoever ran the migration, and it cannot bypass RLS.

The Still-Frame Threshold Depends on Bit Depth

Sun, 16 Aug 2026 00:00:00 GMT

Detecting still frames with tblend and signalstats: the YAVG threshold scales with luma range, so 4.8 from 12-bit material breaks entirely on 10-bit.

A Conditional UPDATE Needs error, Not Just data

Sun, 16 Aug 2026 00:00:00 GMT

supabase-js returns data:null with error when a conditional UPDATE hits no row. Read only data and a swallowed write failure is indistinguishable from a no-op.

terraform enabled = false Cannot Tear Down an Env

Sun, 16 Aug 2026 00:00:00 GMT

With an enabled flag on every module, flipping them all to false to fold an environment fails with Invalid template interpolation value. Only destroy works.

How I Settled on Splitting AI Coding Tools

Sat, 15 Aug 2026 00:00:00 GMT

Results from actually splitting work between Claude Code, Cursor, Codex and Gemini: complex development, quick builds, and a separate everyday companion.

A Prompt Template for Mass-Producing Thumbnails

Sat, 15 Aug 2026 00:00:00 GMT

Rather than starting over each time: subject large, title band at the bottom, tone fixed. Swap only the subject and the title. Where Japanese text breaks down.

Cloud Run Jobs Freeze Their Image

Sat, 15 Aug 2026 00:00:00 GMT

You fixed the code, committed, and re-ran the job. Nothing changed. The image is pinned in the job definition until you bump the tag and apply.

Writing 3D Models as Code Instead of Mouse Work

Sat, 15 Aug 2026 00:00:00 GMT

Write dimensions as numbers in OpenSCAD and Python and let equations decide the shape. Change a parameter for a new size, and diff the design in git.

Why I Chose the DE10-Lite as a First FPGA Board

Sat, 15 Aug 2026 00:00:00 GMT

Switches, LEDs and a 7-segment display are on board, so a circuit runs with no external wiring, and the syntax is close to C. Those two are what helped.

DeepL and Whisper Quietly Save Time

Sat, 15 Aug 2026 00:00:00 GMT

Neither is flashy, but both work. English is faster if you draft in Japanese first, and transcription run locally never leaves the machine.

Splitting Personal-Project Infrastructure by Use

Sat, 15 Aug 2026 00:00:00 GMT

How to choose between Vercel, Firebase, Supabase and GCP. Starting with the easy end and widening when you need to actually moves faster.

Heat and Battery Are a Choice on a Dev Laptop

Sat, 15 Aug 2026 00:00:00 GMT

Using a ThinkPad X1 Carbon for development, cool running and battery life do not coexist. The power mode makes you pick one.

ESP32 Web Serial API: Live Sensor Data in Next.js

Sat, 15 Aug 2026 00:00:00 GMT

The Arduino IDE serial monitor is just numbers scrolling past. Here is the Next.js and Web Serial API setup that turns it into a browser dashboard.

Building the Same App on Firebase and Supabase

Sat, 15 Aug 2026 00:00:00 GMT

How to choose a backend for personal projects: Firebase for speed to launch, Supabase for freedom. What rebuilding the same app on both made plain.

Pick a First 3D Printer on Assembly and Levelling

Sat, 15 Aug 2026 00:00:00 GMT

What defeats beginners is not printing but assembly and bed levelling. Requiring 95% pre-assembled and automatic levelling shortens the road to a first print.

Running a Google TV Kiosk for Several Months

Sat, 15 Aug 2026 00:00:00 GMT

Making an Android device into signage that never falls over is a power and permissions problem, not a display one. Device Owner, silent failures, timers.

Figma Is Enough for a Logo and a Business Card

Sat, 15 Aug 2026 00:00:00 GMT

Figma is a UI tool by design, but being vector it holds up perfectly well at the level of a logo or a business card. Where the dedicated tool still wins.

Running a Local LLM with Ollama and Building RAG

Sat, 15 Aug 2026 00:00:00 GMT

Where you would rather not send data to an external API, a local LLM is realistic. Running Qwen on Ollama, and why retrieval matters more than the model.

Two Settings to Change When Supports Won't Come Off

Sat, 15 Aug 2026 00:00:00 GMT

OrcaSlicer prints well on defaults. What breaks beginners is supports: switch to tree type and lower the density, and they peel off without damage.

Face Recognition on a Raspberry Pi 5 Hits a Speed Wall

Sat, 15 Aug 2026 00:00:00 GMT

face_recognition plus a CSV file is enough to make face recognition work. But it takes about 15 seconds per person, and a queue forms as soon as numbers grow.

Building a Power Factor Meter With a Raspberry Pi Pico

Sat, 15 Aug 2026 00:00:00 GMT

Power factor comes from the phase difference between voltage and current. A clamp sensor gets the waveform and the Pico does the maths.

What Stops You First in Quartus Is the Setup

Sat, 15 Aug 2026 00:00:00 GMT

The programmer is not recognised, correct code does nothing because a pin assignment is missing, and the 7-segment lights on 0. Three first traps.

Google TV or Raspberry Pi for a Signage Device

Sat, 15 Aug 2026 00:00:00 GMT

For an always-on display, Google TV and a Raspberry Pi take opposite design philosophies. Results from running both, and the storage that matters.

Reading a SwitchBot Motion Sensor Over BLE Directly

Sat, 15 Aug 2026 00:00:00 GMT

SwitchBot's motion sensor assumes a Hub and the cloud, but receiving its BLE advertisements directly keeps it all local. Three points and one silent trap.

Task Management Sticks When Entry Has No Friction

Sat, 15 Aug 2026 00:00:00 GMT

Once Todoist could be driven from an AI in natural language, tasks started accumulating without stopping work. Splitting the storing side from the doing side.

Separate the Machine You Touch Hardware With

Sat, 15 Aug 2026 00:00:00 GMT

Carrying two laptops was risk management, not luxury. Serial-chip drivers and ports, and separating work that can break things from data you cannot lose.

Three Vercel Traps I Hit After Going Live

Sat, 15 Aug 2026 00:00:00 GMT

Deploying to Vercel is the easy part. The alias not following the newest build, the public URL demanding a login, and not appearing in search are what you miss.