Let us break it — index

Field notes.

Notes from the work — findings, failure modes, and the occasional postmortem, each one with a repro attached.

A checkout flow passed every test it had. Then someone double-clicked Pay.

Two requests, 40ms apart. Both read order.status as "pending." Both charged the card. No test clicks twice.

A password reset link still worked 31 hours after the password had been changed. The token had an expiry. It did not have a use count.