Rebounder Tech Blog

cqw Fails Silently When the DOM Around It Changes

Fri, 04 Sep 2026 00:00:00 GMT

A board preview scaled with container-query units stopped resolving when a DOM change left .frame's width undetermined, so it rendered at full size and clipped.

Hand-Built Preview Payload Drifts From the Device

Fri, 04 Sep 2026 00:00:00 GMT

The class editor's board preview hand-built its base and pinned automatic blocks to null. The device builds every block from one source, so the two disagreed.

pdfjs-dist standard_fonts Missing From standalone

Fri, 04 Sep 2026 00:00:00 GMT

pdfjs-dist loads its standard fonts dynamically over file://, so Next.js file tracing cannot follow it and the standalone build ships without them.

A disabled Submit Button Dies Before Hydration

Fri, 04 Sep 2026 00:00:00 GMT

Driving the disabled attribute from server state left the button permanently disabled before hydration or when JS failed, making the signing form unsubmittable.

Duplicate URLs in a Feed Break ON CONFLICT DO UPDATE

Thu, 03 Sep 2026 00:00:00 GMT

A news job upserting several articles in one ON CONFLICT DO UPDATE failed with Postgres 21000 on duplicate URLs, and a fail-soft catch skipped it silently.

A Ledger INSERT Failure Swallowed as a Duplicate

Thu, 03 Sep 2026 00:00:00 GMT

The Stripe webhook returned a 200 no-op for any ledger INSERT failure, so a transient DB fault lost the event permanently: Stripe never retried it.

maybeSingle() Throws PGRST116 on a Too-Loose Filter

Thu, 03 Sep 2026 00:00:00 GMT

An evidence-PDF API filtered on 2 of 3 unique-key columns, then called maybeSingle(). Once a second row existed for that pair, real data started returning 404.

Missing passThroughEnv Skips Tests While CI Stays Green

Thu, 03 Sep 2026 00:00:00 GMT

Without passThroughEnv, turbo won't forward CI's DATABASE_URL to vitest. A describe.skip guard hides the gap, so CI stayed green while 24 RLS tests never ran.

Only the Poll Stringifies Date: getTime Is Not a Function

Wed, 02 Sep 2026 00:00:00 GMT

SSR restores Date as a Date, but the same screen's polling gets a string from res.json(). Calling .getTime() on it took the whole board down.

insetsController Is null Before setContentView

Tue, 01 Sep 2026 00:00:00 GMT

window.insetsController returns null before setContentView() because the DecorView is not resolved yet. hide() never runs and immersive mode silently fails.

One startActivity Is Not Enough to Blank a Kiosk Screen

Tue, 01 Sep 2026 00:00:00 GMT

An always-on Android kiosk that blanks its screen with one startActivity stays lit all night when BAL limits or a missing SYSTEM_ALERT_WINDOW block the call.

SECURITY DEFINER Functions Are PUBLIC EXECUTE

Tue, 01 Sep 2026 00:00:00 GMT

A SECURITY DEFINER write RPC gets PUBLIC EXECUTE by PostgreSQL default. Without a revoke, anon can call it directly through Supabase's PostgREST layer.

read-merge-write Without FOR UPDATE Loses Keys

Sun, 30 Aug 2026 00:00:00 GMT

Several settings keys share one JSONB row. Read, spread, write back without SELECT ... FOR UPDATE and a concurrent save overwrites the key the other just wrote.

Only One Branch Had No Way to Add the First Item

Sun, 30 Aug 2026 00:00:00 GMT

The school structure screen branches three ways on two booleans, and the state with grades but no departments had no way to add a department at all.

Re-consent to Revised Terms Does Not Reset auto_renew

Sun, 30 Aug 2026 00:00:00 GMT

A customer re-consents to terms without the auto-renewal clause, yet auto_renew stays true. The flag is only ever written false to true.

Media Queries See the Real Viewport in a Scaled Stage

Sun, 30 Aug 2026 00:00:00 GMT

A 1280x720 stage shrunk with transform:scale still evaluates @media against the real viewport, so a large monitor applies the big-screen profile.

left:50% With width:fit-content Makes max-width Never Apply

Sat, 29 Aug 2026 00:00:00 GMT

An absolute plate centred with left:50% and width:fit-content wrapped long before its max-width. Shrink-to-fit subtracts the left offset from available width.

An inset box-shadow Ring Hides Behind a Child Background

Sat, 29 Aug 2026 00:00:00 GMT

A ring drawn with inset box-shadow vanished under a child with its own background. inset shadows paint at the background stage, below static children.

The Edit Form Pruned Selections It Could Not See

Fri, 28 Aug 2026 00:00:00 GMT

The edit form silently dropped selected IDs missing from a refetched monitor list, so saving just a price change could shrink the targeted monitors.

A Non-Numeric env Becomes NaN and Slips Past ??

Fri, 28 Aug 2026 00:00:00 GMT

A non-numeric env makes Number.parseInt return NaN. It passes the truthy check and the ?? default alike, so embeddings ran zero and fetch aborted instantly.

Narrowing a Page's Roles Left the Action's Gate

Fri, 28 Aug 2026 00:00:00 GMT

The dashboard's requireRole was narrowed to system admins while a panel's Server Action kept its publisher gate, producing an uncaught ForbiddenError.

A Post-Charge DB Failure Read as a Card Decline

Fri, 28 Aug 2026 00:00:00 GMT

Handle PaymentIntent creation and the DB write in one try/catch and a transient write error after the charge succeeds gets diagnosed as a card failure.

RLS Allowing actor_user_id NULL Erases Audit Trails

Thu, 27 Aug 2026 00:00:00 GMT

The audit log INSERT policy allowed actor_user_id IS NULL for any role. A compromised tenant account could log its actions as actor=NULL and escape the trail.

A Leftover sticky top:0 Makes a fixed Bar Fill the Screen

Thu, 27 Aug 2026 00:00:00 GMT

Switching to position:fixed without clearing the sticky top:0 leaves top and bottom both set, stretching the box to the full viewport height.

The Leak Check Only Grepped Half the Package

Thu, 27 Aug 2026 00:00:00 GMT

A build script grepped the distribution package for internal wording. Internal text shipped anyway: the grep path covered only part of the package.

A New httpOnly Cookie 401s Only Already-Logged-In Users

Wed, 26 Aug 2026 00:00:00 GMT

A write-only httpOnly HMAC cookie shipped and only staff logged in before the deploy got 401s, while the UI still showed them signed in.

A Public Route Missing From the middleware matcher

Wed, 26 Aug 2026 00:00:00 GMT

The public signage page is anonymous — no __session. Left out of the middleware matcher's exclusion list, every device was redirected to /login instead.

Duplicating a Placement Without Ending the Old One

Wed, 26 Aug 2026 00:00:00 GMT

The renewal batch duplicates placements for the successor contract. Without ending the original row, the remaining-capacity sum keeps counting both.

LIMIT 1 Without ORDER BY Returns Another Tenant

Tue, 25 Aug 2026 00:00:00 GMT

dev-login resolved a school_admin with a SELECT LIMIT 1 and no ORDER BY, so as multi-tenant test data grows it can return a uid from an unintended school.

proxy.ts Redirected API-Key Endpoints to the Login Page

Tue, 25 Aug 2026 00:00:00 GMT

Next.js proxy.ts listed only /api/health as exempt from session auth, so /api/v1/ and /api/mcp/ with their own API key auth were redirected to the login page.

?? Defaults Overwrite Fields the Form Never Sent

Tue, 25 Aug 2026 00:00:00 GMT

An edit form without an availability field rolled live slots back to vacant on every save. val(formData.get(...)) ?? default treats unsent as the default.

Holding-Only Checks Reapply a Bundle Discount

Mon, 24 Aug 2026 00:00:00 GMT

A bundle discount decided purely by whether the buyer holds every member reapplied on each further purchase. A granted-history check fixed it.

The Lock Held; the Count Counted Intent, Not Writes

Mon, 24 Aug 2026 00:00:00 GMT

A flaky test where newlyDown summed to 2 instead of 1 was not the DB rows but the summary. FOR UPDATE serialised the writes; the count used the classification.

A Temp-Password Guard Written Per Page Leaks by URL

Mon, 24 Aug 2026 00:00:00 GMT

A must_change_password advertiser could skip the forced change by going to any page but /dashboard by direct URL. The guard lived per page, not in one place.

RLS On Is Not Safe While TRUNCATE Is Granted

Mon, 24 Aug 2026 00:00:00 GMT

chat_knowledge had RLS enabled and zero policies, yet Supabase's default grants left TRUNCATE on anon/authenticated. TRUNCATE is not subject to RLS at all.

Humanising an Error Message Cost the Dead-Letter Its Trace

Sat, 22 Aug 2026 00:00:00 GMT

Coverage validation returned only admin-form Japanese. Reusing it as the dead-letter last_error dropped the school ID, so logs could not name the cause.

Permissions-Policy: microphone=() Blocks Your Own Origin Too

Sat, 22 Aug 2026 00:00:00 GMT

Permissions-Policy: microphone=() allows no origin at all, blocking our own Web Speech API voice input with no permission prompt. Fixed with microphone=(self).

Omitting expires_at Holds a Seat for 24 Hours

Sat, 22 Aug 2026 00:00:00 GMT

A Stripe Checkout Session with no expires_at defaults to 24 hours, and a booking abandoned without paying keeps occupying capacity that whole time.

Aborting streamObject Leaves usage as an Unhandled Rejection

Fri, 21 Aug 2026 00:00:00 GMT

Wiring an AbortSignal into the Vercel AI SDK's streamObject makes result.usage reject on abort. If the caller returns without awaiting done, nothing catches it.

Fixing a detect-non-literal-regexp False Positive

Fri, 21 Aug 2026 00:00:00 GMT

An E2E fallback, new RegExp(c.path.replace(...)), tripped Semgrep's detect-non-literal-regexp. The branch was unreachable, so we deleted it with a type.

A Stale Branch Deploy Silently Reverted Features

Fri, 21 Aug 2026 00:00:00 GMT

Swapping a Cloud Run image tag by the usual steps removes features merged to main since the build branch diverged — without a single git revert commit.

YT.Player Replacing a div Can Leave a Black Screen

Fri, 21 Aug 2026 00:00:00 GMT

Initialising the YouTube IFrame API by handing it a div shows nothing until that div becomes an iframe, and depending on timing playback never starts.

Removing a Role-Change Seam With No Callers Left

Thu, 20 Aug 2026 00:00:00 GMT

A function that writes any role and any school ID into IdP claims stayed in the repo with zero production callers after its only caller was removed.

Phone Numbers Garble When Copied From a pdf-lib PDF

Thu, 20 Aug 2026 00:00:00 GMT

Embedding NotoSansJP through fontkit into pdf-lib garbles digits on copy and pdftotext. GSUB picks glyphs the ToUnicode CMap has no entry for.

Remounting a Form by key Resets Uncontrolled Inputs

Thu, 20 Aug 2026 00:00:00 GMT

With

Carrying a creative_id Revived an Ended Placement

Thu, 20 Aug 2026 00:00:00 GMT

The renewal batch copies a placement row and keeps creative_id on both. Another batch in the same cron run uses that key to roll the ended row back to booked.

Two Migrations Claimed the Same Sequence Number

Wed, 19 Aug 2026 00:00:00 GMT

Two feature branches both created migration 0035. Both applied to production as idempotent SQL, but a fresh database run in order has no guaranteed sequence.

A staging Default in env Deleted Production Images

Wed, 19 Aug 2026 00:00:00 GMT

Leave another environment's bucket as an env var's fallback and that value gets written into the production database, vanishing the day staging is destroyed.

Half-Controlled Forms Silently Revert on Resubmit

Wed, 19 Aug 2026 00:00:00 GMT

React 19's resets uncontrolled inputs to defaultValue whether it succeeded or not. Control only some fields and the rest revert silently.

Linking Everyone to a Tenant-Only Feature Gave 502

Wed, 19 Aug 2026 00:00:00 GMT

The application page always showed a PDF copy link to a route implemented for one tenant type only. The other side got a 502, though nothing had failed.

A CHECK Rewrite Erased Another Branch's Value

Tue, 18 Aug 2026 00:00:00 GMT

Rewriting a PostgreSQL CHECK constraint with DROP then ADD silently removes values another branch added. share_links.kind lost receipt, with no migration error.

A 23503 FK Violation Disguised as a Conflict

Tue, 18 Aug 2026 00:00:00 GMT

An operator ad submission failed every time in production, showing "conflicted with another operation". The real cause was a foreign key violation, 23503.

auth/invalid-password: App Allowed Shorter Passwords

Tue, 18 Aug 2026 00:00:00 GMT

A 4-5 char password passed app validation, then Identity Platform rejected it as auth/invalid-password, uncaught: an error boundary, not a form error.

A Missing force-dynamic Froze a Flag Flip Behind Static HTML

Tue, 18 Aug 2026 00:00:00 GMT

Enabling teacher login changed nothing on screen. With no dynamic API call, Next.js prerendered the route at build time and the CDN cached it for a year.

A UI Freeze Without a Server Check Is Not a Freeze

Tue, 18 Aug 2026 00:00:00 GMT

The edit screen froze its inputs when a slot was live or bought out, but the update path only checked live. A forged POST could rewrite targeting in between.

An Android Foreground Service Can Die Without Crashing

Mon, 17 Aug 2026 00:00:00 GMT

Guarding only pollOnce() is not enough. An exception in delay or the backoff calculation exits while(true) quietly, stopping the work while the app lives on.

Enabling a Cloud Run Job Fails With SecretsAccessCheckFailed

Mon, 17 Aug 2026 00:00:00 GMT

Creating a Cloud Run Job and its secret accessor IAM in one Terraform apply taints the job: creation-time validation runs before IAM propagates.

Routing Scanned PDFs to Gemini by Chars per Page

Mon, 17 Aug 2026 00:00:00 GMT

pdfjs-dist returns the text layer as-is, so a scanned PDF comes back near-empty. Below a per-page character threshold, send the bytes to Gemini as a file part.

Auth Middleware Redirects robots.txt to the Login Page

Mon, 17 Aug 2026 00:00:00 GMT

Middleware that sends unauthenticated users to /login tends to treat robots.txt the same way. Crawlers get a 307 and the Lighthouse SEO audit fails.

Astro 7 Breaks Content Collections in Three Places

Sun, 16 Aug 2026 00:00:00 GMT

Upgrading Astro fails with LegacyContentConfigError. Three things changed at once: where the config file lives, the required loader, and the render API.

drizzle-kit migrate Does Not Apply Hand-Written SQL

Sun, 16 Aug 2026 00:00:00 GMT

Migrations succeed but RLS policies and audit triggers are missing in production. drizzle-kit migrate runs only drizzle-generated DDL.

Your First Dev Board Depends on What You'll Build

Sun, 16 Aug 2026 00:00:00 GMT

ESP32, Raspberry Pi and FPGA cover completely different ground. A thing that communicates, a small computer, or learning circuits — that is the choice.

Three Errors You Actually Hit Connecting Actions to GCP

Sun, 16 Aug 2026 00:00:00 GMT

Workload Identity Federation splits configuration across three layers and impersonation fails if any is missing. The three real errors, in order.

Gemini Thinking Tokens Eat maxOutputTokens

Sun, 16 Aug 2026 00:00:00 GMT

A chat AI hung on "thinking" in production only. Gemini's thinking tokens eat the maxOutputTokens budget, so the response ends empty before output starts.

The JMA Evening Update Nulls Today's Temperature

Sun, 16 Aug 2026 00:00:00 GMT

Japan's JMA forecast API drops today's temperature in the 17:00 update. Upsert it straight through and the morning's value is overwritten with null.

FLAG_KEEP_SCREEN_ON Ignored: It's the Screensaver

Sun, 16 Aug 2026 00:00:00 GMT

An always-on Android display still goes black with FLAG_KEEP_SCREEN_ON set. The most likely cause is the screensaver, and settings put resets on every reboot.

Next.js Bundling a wasm Package Breaks Only in Production

Sun, 16 Aug 2026 00:00:00 GMT

A WASM library for PDF generation got bundled by Next.js and broke in production with a path type error. Bundling changes how the wasm relative path resolves.

SECURITY DEFINER Fails in Production: the Executing Role

Sun, 16 Aug 2026 00:00:00 GMT

CI passes but production gets nothing from a SECURITY DEFINER function. The owner is whoever ran the migration, and it cannot bypass RLS.

The Still-Frame Threshold Depends on Bit Depth

Sun, 16 Aug 2026 00:00:00 GMT

Detecting still frames with tblend and signalstats: the YAVG threshold scales with luma range, so 4.8 from 12-bit material breaks entirely on 10-bit.

A Conditional UPDATE Needs error, Not Just data

Sun, 16 Aug 2026 00:00:00 GMT

A conditional UPDATE returns data:null with error when it matches nothing. Read data alone and a transient write failure looks like "already processed".

terraform enabled = false Cannot Tear Down an Env

Sun, 16 Aug 2026 00:00:00 GMT

With an enabled flag on every module, flipping them all to false to fold an environment fails with Invalid template interpolation value. Only destroy works.

How I Settled on Splitting AI Coding Tools

Sat, 15 Aug 2026 00:00:00 GMT

Results from actually splitting work between Claude Code, Cursor, Codex and Gemini: complex development, quick builds, and a separate everyday companion.

A Prompt Template for Mass-Producing Thumbnails

Sat, 15 Aug 2026 00:00:00 GMT

Rather than starting over each time: subject large, title band at the bottom, tone fixed. Swap only the subject and the title. Where Japanese text breaks down.

Cloud Run Jobs Freeze Their Image

Sat, 15 Aug 2026 00:00:00 GMT

You fixed the code, committed, and re-ran the job. Nothing changed. The image is pinned in the job definition until you bump the tag and apply.

Writing 3D Models as Code Instead of Mouse Work

Sat, 15 Aug 2026 00:00:00 GMT

Write dimensions as numbers in OpenSCAD and Python and let equations decide the shape. Change a parameter for a new size, and diff the design in git.

Why I Chose the DE10-Lite as a First FPGA Board

Sat, 15 Aug 2026 00:00:00 GMT

Switches, LEDs and a 7-segment display are on board, so a circuit runs with no external wiring, and the syntax is close to C. Those two are what helped.

DeepL and Whisper Quietly Save Time

Sat, 15 Aug 2026 00:00:00 GMT

Neither is flashy, but both work. English is faster if you draft in Japanese first, and transcription run locally never leaves the machine.

Splitting Personal-Project Infrastructure by Use

Sat, 15 Aug 2026 00:00:00 GMT

How to choose between Vercel, Firebase, Supabase and GCP. Starting with the easy end and widening when you need to actually moves faster.

Heat and Battery Are a Choice on a Dev Laptop

Sat, 15 Aug 2026 00:00:00 GMT

Using a ThinkPad X1 Carbon for development, cool running and battery life do not coexist. The power mode makes you pick one.

Putting ESP32 Sensor Data in the Browser With Web Serial

Sat, 15 Aug 2026 00:00:00 GMT

The Arduino IDE serial monitor is just numbers scrolling past. Here is the Next.js and Web Serial API setup that turns it into a browser dashboard.

Building the Same App on Firebase and Supabase

Sat, 15 Aug 2026 00:00:00 GMT

Choosing a backend for a personal project: Firebase for speed to launch, Supabase for freedom. What rebuilding the same app on both made plain.

Pick a First 3D Printer on Assembly and Levelling

Sat, 15 Aug 2026 00:00:00 GMT

What defeats beginners is not printing but assembly and bed levelling. Requiring 95% pre-assembled and automatic levelling shortens the road to a first print.

Running a Google TV Kiosk for Several Months

Sat, 15 Aug 2026 00:00:00 GMT

Making an Android device into signage that never falls over is a power and permissions problem, not a display one. Device Owner, silent failures, timers.

Figma Is Enough for a Logo and a Business Card

Sat, 15 Aug 2026 00:00:00 GMT

Figma is a UI tool by design, but being vector it holds up perfectly well at the level of a logo or a business card. Where the dedicated tool still wins.

Running a Local LLM with Ollama and Building RAG

Sat, 15 Aug 2026 00:00:00 GMT

Where you would rather not send data to an external API, a local LLM is realistic. Running Qwen on Ollama, and why retrieval matters more than the model.

Two Settings to Change When Supports Won't Come Off

Sat, 15 Aug 2026 00:00:00 GMT

OrcaSlicer prints well on defaults. What breaks beginners is supports: switch to tree type and lower the density, and they peel off without damage.

Face Recognition on a Raspberry Pi 5 Hits a Speed Wall

Sat, 15 Aug 2026 00:00:00 GMT

face_recognition plus a CSV file is enough to make face recognition work. But it takes about 15 seconds per person, and a queue forms as soon as numbers grow.

Building a Power Factor Meter With a Raspberry Pi Pico

Sat, 15 Aug 2026 00:00:00 GMT

Power factor comes from the phase difference between voltage and current. A clamp sensor gets the waveform and the Pico does the maths.

What Stops You First in Quartus Is the Setup

Sat, 15 Aug 2026 00:00:00 GMT

The programmer is not recognised, correct code does nothing because a pin assignment is missing, and the 7-segment lights on 0. Three first traps.

Google TV or Raspberry Pi for a Signage Device

Sat, 15 Aug 2026 00:00:00 GMT

For an always-on display, Google TV and a Raspberry Pi take opposite design philosophies. Results from running both, and the storage that matters.

Reading a SwitchBot Motion Sensor Over BLE Directly

Sat, 15 Aug 2026 00:00:00 GMT

SwitchBot's motion sensor assumes a Hub and the cloud, but receiving its BLE advertisements directly keeps it all local. Three points and one silent trap.

Task Management Sticks When Entry Has No Friction

Sat, 15 Aug 2026 00:00:00 GMT

Once Todoist could be driven from an AI in natural language, tasks started accumulating without stopping work. Splitting the storing side from the doing side.

Separate the Machine You Touch Hardware With

Sat, 15 Aug 2026 00:00:00 GMT

Carrying two laptops was risk management, not luxury. Serial-chip drivers and ports, and separating work that can break things from data you cannot lose.

Three Vercel Traps I Hit After Going Live

Sat, 15 Aug 2026 00:00:00 GMT

Deploying to Vercel is the easy part. The alias not following the newest build, the public URL demanding a login, and not appearing in search are what you miss.