Email verification, removed and restored repeatedly
An email-verification gate was disabled during development more than once and had to be rediscovered as a requirement each time.
Two copies drifted
One idea kept by hand in two places — schema and migration, dev and prod, app and app.
The gate was removed and put back more than once before settling as enforced by the auth guard, with resend on the verify-email screen. Worth remembering as a pattern rather than an incident: a security gate that's inconvenient during development gets disabled "temporarily" and then has to be rediscovered as a requirement.