The day I deleted live data by hand
A shallow spread over a partial PATCH payload replaced an entire settings blob, deleting every field the request didn't happen to carry.
It could not have worked
A race, an ordering, one column holding two things. The shape ruled it out before the code ran.
I was verifying maintenance mode through the API and sent a partial update to the platform-settings endpoint. The update code merged it into the stored settings blob with a shallow spread over whatever the request happened to carry, so a partial payload replaced the entire blob. Everything outside my two fields was gone.
Recovered it and fixed the merge. The lasting change is procedural, and it's a rule for me now: don't test a write with a hand-rolled partial API body, drive it through the UI, which sends the shape the server was designed for, and capture the DB state first either way. I was testing exactly the endpoint whose merge semantics were broken, with exactly the payload shape that triggers it.