The session that wouldn't end
An account that should have been locked kept a valid session because the frontend auth state and the backend's view of the session disagreed with no error.
Only visible by using it
Invisible to a code read. Found by being the real user, on a real device, at a real width.
Surfaced about three weeks after the initial schema went in, through use rather than review. An account that should have been locked was still wandering the app on a session that by every rule shouldn't have been valid.
I found it by putting the frontend's auth state next to the backend logs and noticing they disagreed: the app thought the account was logged out, the backend was still accepting the token. Obvious in hindsight — JWTs are stateless, so once you sign one you can't take it back, and the token has no idea the account got locked five minutes later.
Fixed with a token_version counter on each user, embedded in the token and checked on every request. Bump the counter and everything outstanding for that user dies at once. Caught in development, not in front of users. What I took from it: decide how you kill a session before writing the login endpoint, not after discovering you can't.