Problem pages
Specific build problems, and which pack pre-decides them.
Every page below is one named decision pulled from a pack's own architecture document -- what goes wrong, why agents reliably get it wrong, and exactly what the pack pre-decides instead. Each one cites the exact decision it came from; nothing here is a keyword list standing in for a real answer.
App Store Machinery
Pack details →app store verifyreceipt deprecated still used
verifyReceipt is deprecated, and it's still the path of least resistance
app store server api jws verification x5c chain
Trusting a transaction means verifying its whole certificate chain
storekit 2 appaccounttoken missing join user
Without appAccountToken, nothing reliably joins a transaction to a user
app store server api sandbox production 4040010 transactionidnotfound
TestFlight transactions 404 against the production Server API
storekit 2 transaction.updates listener missed renewals
Forgetting the updates listener misses renewals, refunds, and offer codes
app store server notifications v2 idempotency duplicate
Apple retries notifications for 3 days -- your handler has to expect duplicates
ios privacy manifest required reason api missing
Xcode lets you submit without the privacy manifest Apple requires
storekit product.products for empty array paid agreement
Product.products(for:) returns nothing until paperwork is done
app store review rejection guideline 3.1.2 restore purchases
A missing restore-purchases button is a review rejection, not a build error
Transactional Email Deliverability Core
Pack details →resend webhook dedupe svix id vs email id
email_id looks like the dedupe key. It isn't.
email suppression list complaint overwritten by bounce
A complaint is not a bounce that arrived later
dmarc p=reject broke our email root domain
p=reject on day one rejects your own Workspace mail too
new domain email warmup sending limits reputation
Full volume from day one gets a fresh domain flagged
email deferred send never retried dropped silently
A deferred send with nothing replaying it is a dropped send
svix webhook signature verification raw body nextjs route handler
Verify the signature before you look at the payload -- not after
transactional email missing plain text part spam score
HTML-only email measurably scores worse for spam filters
email soft bounce vs hard bounce suppress or retry
A temporary delivery delay is not a reason to suppress forever
dmarc effective record subdomain vs root domain resolution
Which DMARC record actually governs your mail subdomain?
Multi-Tenant Auth & RBAC Core
Pack details →postgres row level security silently disabled table owner
RLS does not bind the table owner -- and managed hosts default to it
postgres rls using policy without with check cross tenant insert
A USING policy blocks reads but not cross-tenant inserts
postgres set_config vs set session leak pgbouncer transaction pooling
SET leaks tenant context across a pooled connection
postgres rls policy infinite recursion membership subquery
A membership check inside its own table's policy recurses
postgres force row level security breaks security definer functions neon
FORCE RLS everywhere breaks the functions bootstrap depends on
jwt role claims stale after permission change multi tenant
A role baked into a token outlives the demotion that should end it
idor org id enumeration 403 vs 404 multi tenant saas
403 on a non-member request confirms the org exists
prevent last admin removed race condition postgres trigger
Two concurrent demotions can both pass an app-level check
session token hashing postgres store hashed not plaintext
A stolen database backup shouldn't hand out live sessions
sso auto link account by email takeover vulnerability
Auto-linking an SSO login by email is an account-takeover vector
postgres column level grants restrict role escalation
Table-level UPDATE grants let an admin rewrite an invite's role
nextjs middleware edge runtime cannot use pg postgres driver
Middleware runs on the Edge runtime -- pg and argon2 don't
Offline Sync Engine
Pack details →postgres collation locale string comparison bug hybrid logical clock
JavaScript and locale-collated Postgres don't sort strings the same way
offline sync clock skew local edits reverting
A wrong device clock makes your own edits disappear
postgres advisory lock serialize transaction commit order race
Two transactions can take sequence numbers out of commit order
crdt tombstone deleted row resurrected by edit
An edit to another field shouldn't undelete a row
offline queue schema migration versioned messages
An app upgrade can leave the offline queue speaking the old schema
last write wins vs crdt conflict resolution field merge
Field-level merge for free, without a CRDT library
sync cursor expired 410 fallback full resync
A cursor older than the compaction window can't just resume
dexie indexeddb not defined next.js server side rendering
next build prerenders client components once, on the server
idempotent sync push replay duplicate message
Replaying the same push message twice should be a no-op, for free
SaaS Billing + Tax Core
Pack details →stripe current_period_end subscription item api change
current_period_end moved off the subscription object
stripe subscription schedule already exists error downgrade
One active schedule per subscription, and downgrades need one
stripe webhook idempotency nextjs redeploy
Webhook idempotency that survives a redeploy
stripe customer resubscribe new subscription id cache bug
A returning customer gets a new subscription id
stripe webhook out of order events race condition
Stripe doesn't guarantee webhook delivery order
stripe subscription proration edge cases upgrade downgrade
Upgrade now, downgrade later -- and mean it
stripe seat based billing prorate seats add remove
Adding seats now, removing them at renewal
stripe dunning past due grace period access control
Access level as a computed function, not a cron job
stripe idempotency key retry double charge
An idempotency key that actually matches the request
stripe checkout session duplicate subscription prevent double billing
Stopping a second live subscription before it starts
stripe price id hardcoded vs lookup key test live mode
Price IDs don't survive the trip from test mode to live mode
stripe customer portal subscription update bypass proration
The customer portal's own defaults bypass your proration rules
stripe tax automatic calculation not collecting tax jurisdictions
automatic_tax: true collects zero tax with zero registrations
stripe webhook signature verification nextjs app router raw body
constructEvent needs the exact bytes, not re-serialized JSON