The flag that was written and never read
A Stripe webhook set is_active to False and nothing on the request path read it. The middleware that fixed it, and the four exemptions it needs.
Certificates for domains that do not exist yet
Caddy issues a certificate at the first handshake for a name it has never seen. Without the right ask endpoint, that is a free certificate mint for anyone.
A DNS zone you can only write whole
SET_DNS_ZONE replaces everything. That one constraint decides where truth lives, how you delete a record, and why the mail block is published late.
Configuring django-tenants properly
Schema per tenant is the easy part. This is the configuration that decides whether your image builds, whether a Postgres blip takes the fleet down, and whether migrations run.