Deployment, cache, indexing, and local automation notes from keeping many tiny products alive.
I set out to mask two identifiers across my blog and internal docs. I assumed that meant editing sentences. One of them was in a post's filename, which is its URL slug, so renaming it also meant changing the URL, the OG images, and a slug list in a design doc.
Haptics are invisible on screen and absent in an emulator. Building a way to judge them from system logs, I found our calls could be silenced wholesale by one device setting.
Hundreds of login failures were labelled 'cancelled'. I stopped trusting the label and measured elapsed time — and found two different realities behind one name.
I checked phone-to-watch wiring across the eight apps that ship a watch app. Seven were real. One was a screen with nothing listening on the other end.
To keep one verdict clean, I removed newly expanded apps from the control group. That was correct. What I missed is that those apps then appeared in no verdict at all — exclusion prevents contamination and opens a monitoring hole in the same move. Every exclusion needed a row of its own.
A user said vibration was completely dead. I fixed three things, they said they could feel it now — and only two rungs of a three-rung signal ladder had actually changed.
Of 468 devices that opened the app, only 164 started walking. The biggest drop was the auth gate, and cancel events were firing six times per install.
I hand-filled a missing entry into a canonical list of 46 apps. Two days later I regenerated that file and the entry was gone, replaced by a different app. Still 46. A check that counts will pass a swap like this forever.
A block test that swaps user-agents returns 403 under every condition, because the edge verifies by IP, not by UA. The verdict has to come from the origin access log.
My dashboard judges bots by output freshness against an expected interval. When that interval doesn't match the real schedule, every idle day lights up as late.
Each function was correct and the tests passed. The defect was which label sat on which function. In English they barely separate as Stop and End — the collision was born in translation.
Exactly one mode picked its answer on the client, from its own catalog. When the catalog updated the pool changed, and per-device pinning held each of those different answers in place. It wasn't a shareable daily — it was a private puzzle.
In Next.js, dynamicParams inherits downward. If the parent says false, the child saying true loses. Dated URLs my sitemap published every day were dying three days later.
I went to fix the version lie in 40 repos. The fix was 40 lines, but there were two traps: the file the build reads is not the file the regenerator reads, and 'the store is the truth' is wrong for any app that is mid-review.
Rejected twice in review for the same reason. The attached screenshot showed a healthy call screen — timer running, end button live — and zero events arriving from the server. There were no errors at all.
One nullable column blew up profile loading for new users. Existing users were fine, so there were zero reports. And the splash screen had nowhere to display the error.
The feature was finished. The build passed, the tests passed. Then I took one simulator screenshot and the screen showed a line that wasn't in my code. Repo-wide grep: zero hits. That one line cost me a day's work.
One production app's paywall said to check the connection. Another app's sign-in said something went wrong. The phone was fine both times. The real causes were a secret that compiled to an empty string and a signing fingerprint that was never registered in the console.
promotionalText is the only App Store listing field you can change without review. It also empties itself with every new version. Three days after I filled it by hand for one app, it was blank again — and a full count found 648 empty slots across 40 apps.
Three voice apps got reports of occasional interruptions and repeats. Echo cancellation was on and working — just not perfectly, and the residual was crossing the server's speech-detection threshold, so the app was cutting itself off. Here's how I tuned an adaptive gate without a physical device.
I was rolling an app that had never shipped to production and the save button was dead in the preview step. The declaration form I'd seen on another app that morning had two steps; this one had three, and the difference was two permission lines in the manifest.
Two apps were rejected the same day over a price-confirmation prompt. My notes said 'this type just needs a reply.' Two hours after replying, nothing had changed. The real path was a manual resubmit right after the reply.
The weekly security email flagged one harmless item. Pulling all 214 via API, the real hole was in the tier one level down — an internal function that returns secrets in plaintext was open to the anonymous role, even though the migration file had the revoke written in exactly.
The release tool passes the version to xcodebuild on the command line and never writes it back to the repo. The store says 1.9.4; the project file still says 1.0, after 40 releases. Why it never broke, and the one place it did.
Two apps sat at 'Not yet sent for review' in the console list for days. The other seven I uploaded the same day with the same script had all flipped to 'In review.' So I wrote down a plan to rebuild the release and resubmit. Two screens were saying different things, and the one I believed was the wrong one.
A full-repo mirror upload overwrote the shared stylesheet with a four-month-old file. The file was there — it was just 2.5KB. I recovered the lost original from Chrome's disk cache.
The browser showed the new headline; search results and link previews showed the old one. The cause was a hardcoded fallback line that had drifted from the i18n data.
![Left panel: Swift reads json["displayName"].stringValue and gets an empty string when the key is absent. Right panel: Kotlin decodes a non-null String field and throws MissingFieldException on the same payload.](/img/the-parser-threw-on-one-os/hero.svg)
I ported the same logic from Swift to Kotlin line for line, and login crashed on Android only, for some accounts only. The cause wasn't the code. It was how the two languages treat a missing field.
The weekly security email flagged one issue. Pulling the full report via API showed 227 — and the real hole was one the email never mentioned: a delete function with an operator token hash hardcoded as a constant.
One app's privacy.html had six headers and one closing </html>. Checking further, all 41 apps and 123 files had the exact same shape. A deploy loop of 'pull live, edit, push back' had been stacking one shell per cycle.
A security migration ended with a functional test against production. I wrote a rollback for it too. The rollback forgot one of the three columns the function actually writes.
My App Store privacy label declared health, email and user ID as "collected but not linked to you." The schema has an account foreign key on every log table. The decisive evidence was Apple's own wizard text.
The marketplace API returned total 4 with an empty items array. I read that as 'not published yet' and went off to design logos. It had been indexed the whole time — just silently filtered out of the default response.
Publishing one tool to a marketplace got rejected four times. Every rejection came with a clear error, which made them cheap. The dangerous one failed nothing at all: I had shipped my own API key inside a free public tool.
Making one eight-second video took 25.8 seconds. I dropped the resolution from 1080x1920 to 720x1280 and got 25.4 seconds. That 0.4 seconds told me where the bottleneck actually was.
On Android I cleaned up the temp file right after presenting the share sheet. It looked like tidy code, it shipped to production, and video sharing was failing silently the whole time.
I set out to replace my personal name with my business name on my store listings. The field I wanted was editable all along; the thing that was locked sat next to it. Nothing on the page explained why — the condition lived in a hover tooltip, and it was a domain I had already owned for years.
The video really was produced. I counted the mp4 bytes on both platforms and the web build was already in production. Then you tapped Share on iOS and nothing happened at all.
Unsupported locale paths returned 500 instead of 404. Every path I actually visit returns 200, so I never noticed, and on one app the broken paths were /ko/ and /en/. I swept all 43 hosts to count exactly how many.
A free-tier warning hit 75%. I swept edge headers, named a culprit, then opened the dashboard and found the app I blamed wasn't even on the list. The real cause was a single headers() call in the root layout, and it was rendering 239 pages in Virginia on every request.
Rejected under 4.3(b), saturated category. The app's first tab was already naming, but the store keywords still said astrology and fortune teller, and the first line of the description in all five locales was 'a fortune hub.' The fix was text, not code.
A subscriber reported an empty app. Charge, receipt and entitlement were all fine. The real cause was a signup trigger creating a complete-looking empty row plus one `!= nil` check in the app. All 200 recent signups had skipped onboarding.
Tests green, build green, custom domains returning TLS 200, analytics events landing in the database. The next day I counted external visitors: zero. Two greps found the cause. It was not the games.
I entered an app in a public tourism data contest. The hourly crowd data I promised in the proposal is not in the open API — and the shipped app was already drawing that chart from Math.random(). Every trap from proposal to submission, over four and a half months.
A weekly collector bot succeeded every run. Sixty new products, 692 pages built. The live site had been frozen since 07-27.
Five minutes after submitting, two devices opened a version that wasn't public yet. Review devices are indistinguishable from real new users, and they only ever push the metric I was measuring downward. I chose to expose them rather than filter them.
My review DB had been frozen for seven weeks. I reported a broken collector — wrong. Then I reported Apple had removed 27 reviews — wrong again. Someone opened a browser and the reviews were all still there. The API simply wasn't returning its own data.
I wired first-session funnel instrumentation and got 184 tests green. Then I queried the server table: instrumentation I hadn't shipped had written 6 rows to production. Passing the test suite was changing the thing I was trying to measure.
A 30-minute cleanup: consolidate seven subdomains onto one canonical path. Along the way I restored a site from backup — only to find the real version already live at another path, 25 times larger than the copy I had just deployed.
I consolidated seven sites onto one path and left 301s behind on the subdomains. The deploy verified clean. Days later Search Console said verification failed — the meta tag lived on the very page I had redirected away.
A phone configured for Korean opened dev.ootssu.com in English. The translations existed; the bug lived in the entry route, the document lang attribute, and a mobile-only escape hatch that was hidden. I fixed the Accept-Language parser, rendered lang=ko for Korean pages, and made the language switch visible on mobile.
An order monitor that drove a logged-in browser via AppleScript, rebuilt on the official commerce API. bcrypt-signed auth, launchd as the runner, and why refunds and returns never got auto-approved.
Google Search Console dumped dozens of 'Not found (404)' emails on me. Before touching the code, I looked at the server logs instead of the dashboard. All 149 sitemap URLs resolved, internal links were clean, and across every log the search bots had 404'd on exactly one URL. The rest were external phantoms.
I automated Android releases via API and logged 'completed 100%' as deployed. One day a rejection email arrived while the track still read completed. The API says 'assigned to a track', not 'people are receiving it'. And the data safety form can't even be touched via API.
I chased a banner that never showed on TestFlight for four hours. Debug/Release, signing, real device — none was the culprit. The culprit was the diagnostic code I added to see the cause. The instrument was changing what it measured.
Channel tokens died sequentially, one per day. Past the reauth hell (PKCE mismatch, six brand accounts with identical names), first principles found the root: 'just reauth' was a cheap-fix trap. The real cause was the publishing status of the OAuth consent screen.
A region-comparison card vanished entirely. No error, the RPC returned 200, the data was there — the screen was just blank. A decoding failure on one date field I don't even display threw the whole decode, and the catch fell back to an empty array. No red light at any stage.
The receipt was valid, the server was fine, there was no error — the app just stayed free. The culprit was a name. RevenueCat auto-generates entitlements from the app name, and the code looked up only 'pro'. Worse, this bug fails silently, with no exception and no log.
An Android release build died on the same NPE across three versions. I kept widening keep rules; once it went quiet, then it regressed. The keep rules weren't failing — they targeted a different class than R8 was cutting. The answer wasn't a better keep rule; it was changing the pattern.
After a review rejection I tried to fix product localizations and got 409 'version is not editable'. So I made the version editable — same 409. The 'version' in that error isn't the appStoreVersion; it's a still-open reviewSubmission shell. Part 1 of an App Store Connect API gotchas series.
Zoom out on the map and other users' territories disappeared, with jank. It looked like slow loading, but waiting never filled it in. The query range was a fixed bbox — the screen quadruples per zoom while the request range stays put, so below a certain zoom the screen edges were never even requested from the server.
A 404 screen was baked into a Japanese Shorts video. Digging in, 23 of 33 apps were broken on /ja. A story about how automation lies quietly when it never checks itself.
The bare URL served stale HTML long after I deployed. The cause was edge caching of HTML, and the fix was a no-cache rule plus knowing that Cloudflare blocks the tools you'd use to check.
Parallel deploys in batches, a sourceless deploy script, and the vercel.json line that makes the first deploy of a fresh project stop failing.
A canonical URL of '/' set in the root layout is inherited by every page — so every page tells Google it's a duplicate of the homepage. Here's the trap and the fix.
BSD tools, a Korean locale, and launchd's minimal environment each broke a scheduled job in a way the error message never explained. Five traps and their fixes.