Specific build problems, and which pack pre-decides them.

app store verifyreceipt deprecated still used

verifyReceipt is deprecated, and it's still the path of least resistance

app store server api jws verification x5c chain

Trusting a transaction means verifying its whole certificate chain

storekit 2 appaccounttoken missing join user

Without appAccountToken, nothing reliably joins a transaction to a user

app store server api sandbox production 4040010 transactionidnotfound

TestFlight transactions 404 against the production Server API

storekit 2 transaction.updates listener missed renewals

Forgetting the updates listener misses renewals, refunds, and offer codes

app store server notifications v2 idempotency duplicate

Apple retries notifications for 3 days -- your handler has to expect duplicates

ios privacy manifest required reason api missing

Xcode lets you submit without the privacy manifest Apple requires

storekit product.products for empty array paid agreement

Product.products(for:) returns nothing until paperwork is done

app store review rejection guideline 3.1.2 restore purchases

A missing restore-purchases button is a review rejection, not a build error

resend webhook dedupe svix id vs email id

email_id looks like the dedupe key. It isn't.

email suppression list complaint overwritten by bounce

A complaint is not a bounce that arrived later

dmarc p=reject broke our email root domain

p=reject on day one rejects your own Workspace mail too

new domain email warmup sending limits reputation

Full volume from day one gets a fresh domain flagged

email deferred send never retried dropped silently

A deferred send with nothing replaying it is a dropped send

svix webhook signature verification raw body nextjs route handler

Verify the signature before you look at the payload -- not after

transactional email missing plain text part spam score

HTML-only email measurably scores worse for spam filters

email soft bounce vs hard bounce suppress or retry

A temporary delivery delay is not a reason to suppress forever

dmarc effective record subdomain vs root domain resolution

Which DMARC record actually governs your mail subdomain?

stripe connect accounts v2 vs express type deprecated

Every model writes the deprecated Connect account shape with total confidence

stripe connect charge model destination vs separate charges transfers

The one Connect decision that can't be fixed with a parameter later

stripe account links refresh_url dead end onboarding

Point refresh_url at a page, and a slow seller is stuck there forever

stripe payouts capability vs payouts_enabled boolean deprecated

Transfers active and payouts inactive is normal -- and money gets stuck there

stripe connect escrow does not exist manual payout hold

Stripe doesn't offer escrow. The hold is just the absence of a transfer.

stripe delay_days_override renamed manual payout country caps

delay_days was renamed, and it's the wrong lever for a fulfillment hold anyway

stripe connect won dispute fee not refunded ledger

Winning a dispute still doesn't get the dispute fee back

stripe refund reverse_transfer application_fee default false

Refund the buyer and the seller keeps the money, unless two flags default the other way

stripe connect negative balance 180 day reserve sweep

A seller who takes one chargeback and vanishes leaves the platform down for good

stripe dispute won resume order state race missing pre-dispute

A dispute that's won has to resume the exact state it interrupted -- or guess wrong

stripe charge.dispute.funds_withdrawn vs closed webhook

The dispute event that debits money isn't the one that decides the outcome

stripe connect double click release button seller paid twice

A double-clicked release button without an idempotency key pays a seller twice

stripe 1099-k threshold gross not net reporting

1099-K reportable volume is gross -- before your commission, before refunds

google merchant center identifier_exists wrong direction warning

identifier_exists: no is a claim about the world, not a way to silence a validator

gtin check digit algorithm wrong for gtin-8 gtin-12

A GS1 check digit written left-to-right is wrong for three of four GTIN lengths

google merchant center feed landing page price mismatch

Your feed can be perfectly valid and still be the #1 reason for disapproval

product structured data json-ld client side rendered not detected

Google reads the HTML your server sent. It does not run your JavaScript.

google shopping feed price format jpy zero decimal places

toFixed(2) is wrong the moment a currency has zero decimal places

google shopping rss feed namespace uri https vs http

One character in a namespace URI, and Google silently ignores every g: attribute

merchant center policy violation not statically checkable

A checker that reports zero policy problems is more dangerous than no checker

google shopping feed multiple countries one feed currency

Merging countries into one feed is how a correct feed goes wrong for two-thirds of it

google shopping sale price effective date page mismatch

While a sale is running, the page has to show the sale price -- not the feed's regular price

postgres row level security silently disabled table owner

RLS does not bind the table owner -- and managed hosts default to it

postgres rls using policy without with check cross tenant insert

A USING policy blocks reads but not cross-tenant inserts

postgres set_config vs set session leak pgbouncer transaction pooling

SET leaks tenant context across a pooled connection

postgres rls policy infinite recursion membership subquery

A membership check inside its own table's policy recurses

postgres force row level security breaks security definer functions neon

FORCE RLS everywhere breaks the functions bootstrap depends on

jwt role claims stale after permission change multi tenant

A role baked into a token outlives the demotion that should end it

idor org id enumeration 403 vs 404 multi tenant saas

403 on a non-member request confirms the org exists

prevent last admin removed race condition postgres trigger

Two concurrent demotions can both pass an app-level check

session token hashing postgres store hashed not plaintext

A stolen database backup shouldn't hand out live sessions

sso auto link account by email takeover vulnerability

Auto-linking an SSO login by email is an account-takeover vector

postgres column level grants restrict role escalation

Table-level UPDATE grants let an admin rewrite an invite's role

nextjs middleware edge runtime cannot use pg postgres driver

Middleware runs on the Edge runtime -- pg and argon2 don't

postgres collation locale string comparison bug hybrid logical clock

JavaScript and locale-collated Postgres don't sort strings the same way

offline sync clock skew local edits reverting

A wrong device clock makes your own edits disappear

postgres advisory lock serialize transaction commit order race

Two transactions can take sequence numbers out of commit order

crdt tombstone deleted row resurrected by edit

An edit to another field shouldn't undelete a row

offline queue schema migration versioned messages

An app upgrade can leave the offline queue speaking the old schema

last write wins vs crdt conflict resolution field merge

Field-level merge for free, without a CRDT library

sync cursor expired 410 fallback full resync

A cursor older than the compaction window can't just resume

dexie indexeddb not defined next.js server side rendering

next build prerenders client components once, on the server

idempotent sync push replay duplicate message

Replaying the same push message twice should be a no-op, for free

google play billing client side entitlement refund bug

The client is a cache. The server is the only entitlement authority.

google play rtdn purchasetoken no purchase state included

RTDN tells you something changed. It never tells you what.

google play pub/sub rtdn at least once unordered delivery

At-least-once and unordered, always -- exactly-once delivery is pull-only

pub/sub push ack deadline 10 seconds retry storm

Respond in 10 seconds, reconcile after -- or trigger a retry storm

google play subscription staleness guard stale notification overwrite

A slow retry of an old notification can still race a newer write

google play purchase not acknowledged 3 days auto refund

Three days to acknowledge, or Google refunds the purchase for you

purchases.subscriptionsv2 no acknowledge method deprecated v1

The API you're told to use has no way to do the one thing you must do

pub/sub push endpoint authentication oidc jwt verification

Pub/Sub doesn't verify who owns your push URL. The OIDC token is the only gate.

rtdn subscriptionnotification no subscriptionid field training data

Most tutorials show a subscriptionId field that no longer exists

google play subscription grace period cancelled still entitled

Grace period and cancelled both still mean entitled -- agents get both backwards

google play billing library 8 skudetails removed migration

The APIs v8 deleted are the ones training data has seen the most

billingclient replacementmode enum different integer values

Two enums share every name and none of the integers

stripe current_period_end subscription item api change

current_period_end moved off the subscription object

stripe subscription schedule already exists error downgrade

One active schedule per subscription, and downgrades need one

stripe webhook idempotency nextjs redeploy

Webhook idempotency that survives a redeploy

stripe customer resubscribe new subscription id cache bug

A returning customer gets a new subscription id

stripe webhook out of order events race condition

Stripe doesn't guarantee webhook delivery order

stripe subscription proration edge cases upgrade downgrade

Upgrade now, downgrade later -- and mean it

stripe seat based billing prorate seats add remove

Adding seats now, removing them at renewal

stripe dunning past due grace period access control

Access level as a computed function, not a cron job

stripe idempotency key retry double charge

An idempotency key that actually matches the request

stripe checkout session duplicate subscription prevent double billing

Stopping a second live subscription before it starts

stripe price id hardcoded vs lookup key test live mode

Price IDs don't survive the trip from test mode to live mode

stripe customer portal subscription update bypass proration

The customer portal's own defaults bypass your proration rules

stripe tax automatic calculation not collecting tax jurisdictions

automatic_tax: true collects zero tax with zero registrations

stripe webhook signature verification nextjs app router raw body

constructEvent needs the exact bytes, not re-serialized JSON

postgres timestamptz recurring availability wrong time dst

Making a wall-clock rule timestamptz is this pack's single most common bug

iana timezone identifier vs utc offset storage drift

EST and PST8PDT resolve fine today and opt a resource out of DST forever

rrule expand utc vs local wall clock dst 23 hour day

Adding 86,400,000 milliseconds a day is right until the day it isn't

dst spring forward fall back ambiguous time rfc 5545

A wall clock that happens twice or never needs one pinned answer, not a coin flip

iana timezone alias comparison bug asia calcutta kolkata

Two zone identifiers can name the same real zone and still fail ===

rrule bysetpos wkst silently ignored recurrence rule part

A rule part your parser doesn't implement should error, never disappear

postgres read committed write skew double booking race condition

Two READ COMMITTED transactions can both see the same free slot and both win

postgres on conflict do nothing exclusion constraint silent

The fix everyone reaches for doesn't error. It just doesn't book anything.

seats_remaining counter non idempotent cancellation double decrement

A seats_remaining counter makes cancellation dangerous to retry

postgres tstzrange half open adjacent vs overlapping bookings

09:00-10:00 and 10:00-11:00 are adjacent. A naive overlap check calls them a conflict.

booking buffer pre post minutes overlap dont coalesce

Two buffers both apply -- they don't collapse into the bigger one

appointment duration exact minutes dst fall back same time twice

A 60-minute booking across fall-back is still 60 minutes -- and looks like zero

webhook idempotency two different dedupe keys delivery vs effect

One idempotency key isn't enough. It's two, and they fail in opposite directions.

shopify webhook dropped after 4 hours no replay api

Shopify retries for 4 hours, then the event is just gone

webhook route handler status code 500 vs 200 contract

500 means 'retry me.' Everything else that isn't a duplicate should be 200.

webhook unparseable payload dead letter not dropped

A payload you've already authenticated should never just be discarded

google play rtdn effect key snapshot vs accumulate mode

Play has no accumulate handler, and that's a finding, not a gap

webhook event ordering watermark snapshot vs accumulate mode

A stale event should be skipped -- unless skipping it loses money forever

postgres savepoint unique violation aborted transaction webhook

Catch the unique violation without a SAVEPOINT and the whole transaction is already dead

postgres for update skip locked webhook worker queue

N workers, no broker, no lease table -- SKIP LOCKED is the entire scheduler

webhook worker crash retry attempts counter order

Increment the retry counter at claim time, or a crash loses the count

webhook dead letter replay vs reprocessing re-ingestion

Replay is re-processing, never a second ingestion path

nextjs 16 route handler params promise await webhook

In Next 16, a route handler's params argument is a Promise -- awaiting it isn't optional

webhook admin dashboard dev only no auth surface

An ops page needs authentication -- so build a dev-only page instead of authentication