A verification link that flashed an error on success
The email-confirm endpoint fired twice per page load and a non-atomic findUnique-then-update made the second call report 'Invalid or already-used token' on success.
It said it worked
Green, 200, saved, “already handled” — and wrong. No error anywhere to go on.
Registered a fresh account, opened the real emailed link in a real browser. The UI flashed "Invalid or already-used email verification token" in red — but the database showed the account had verified fine. Network trace showed the confirm endpoint firing twice for one page load, and the handler wasn't safe against that: a plain findUnique-then-update with no atomicity, so the second call would legitimately find the token consumed and correctly report failure. From the user's point of view, their account was fine and they got a scary error.
Fixed both ends. A ref guard on the frontend so the effect fires once per token, and the backend rewritten to an atomic updateMany with the token match in the WHERE clause, so only one of two concurrent callers can claim it — with "zero rows matched but already verified" returning success, so a genuine duplicate is harmless rather than alarming.
This only exists at the intersection of a frontend re-render quirk and a backend race window. Neither half looks wrong alone, and I only found it by clicking the actual link and watching the wrong thing happen.