# Concepts — Topic Index

> Atomic knowledge articles extracted from Claude Code sessions.
> Each article covers one distinct concept, pattern, or technique.

| Article | Summary | Source | Updated |
|---------|---------|--------|---------|
| [[wiki/concepts/librechat-openid-auth]] | LibreChat v0.8.4 OpenID/OAuth auth internals — ALLOW_SOCIAL_REGISTRATION, openidId requirement, state mismatch diagnosis | daily/2026-04-15.md | 2026-04-15 |
| [[wiki/concepts/msal-vanilla-js-pkce]] | MSAL.js v5 UMD script-tag PKCE for SPAs without bundlers — Azure portal platform type, Node.js JWKS validation | daily/2026-04-15.md | 2026-04-15 |
| [[wiki/concepts/shell-static-deploy-patterns]] | Shell deploy scripts for static frontends — cp -r vs glob, Apache reload requirement, setup vs deploy distinction | daily/2026-04-15.md | 2026-04-15 |
| [[wiki/concepts/fish-shell-path-config]] | Fish shell PATH configuration — /usr/local/bin not in default PATH, fish_add_path, SSH aliases as Fish functions | daily/2026-04-15.md | 2026-04-15 |
| [[wiki/concepts/microsoft-graph-api-mailbox-migration]] | Graph API app-only (client credentials) flow for reading shared mailboxes — Mail.Read.All, EML download, pagination | daily/2026-04-16.md | 2026-04-16 |
| [[wiki/concepts/mailcow-maildir-import]] | Mailcow Maildir volume path, rsync import, chown 5000:5000, mandatory doveadm index — without indexing IMAP shows nothing | daily/2026-04-16.md | 2026-04-16 |
| [[wiki/concepts/fastapi-mongodb-role-migration]] | Adding UserRole enum + MongoDB schema validator migration + idempotent seed in FastAPI lifespan | daily/2026-04-16.md | 2026-04-16 |
| [[wiki/concepts/monorepo-deploy-script-pitfall]] | deploy.sh checking backend/.git / frontend/.git silently skips git pull in monorepos — fix: single git pull at root | daily/2026-04-16.md | 2026-04-16 |
| [[wiki/concepts/nextjs-basepath-auth-redirects]] | Next.js basePath requires all auth redirect strings to include the prefix — middleware and API routes don't auto-prepend | daily/2026-04-16.md | 2026-04-16 |
| [[wiki/concepts/python-service-deployment-dotenv]] | Python service deploy checklist — venv pip install after git pull, .env.example → .env for new config.py requirements | daily/2026-04-16.md | 2026-04-16 |
| [[wiki/concepts/openai-max-completion-tokens]] | OpenAI newer models reject `max_tokens` — must use `max_completion_tokens` in both raw API calls and internal wrappers | daily/2026-04-17.md | 2026-04-17 |
| [[wiki/concepts/fish-abbr-patterns]] | Fish `abbr` expands visibly (git/docker/uv), `alias` for transparent replacements (ls/cat); forgit conflict resolution | daily/2026-04-17.md | 2026-04-17 |
| [[wiki/concepts/bitbucket-mcp-atlassian]] | Bitbucket MCP via aashari/mcp-server-atlassian-bitbucket; GitHub MCP is GitHub-only; Atlassian API tokens replace App Passwords | daily/2026-04-17.md | 2026-04-17 |
| [[wiki/concepts/proxmox-mcp-server]] | canvrno/ProxmoxMCP is the best community Proxmox MCP server; install to global Claude Code config for any-project access | daily/2026-04-18.md | 2026-04-18 |
| [[wiki/concepts/proxmox-vm-management-methods]] | Proxmox VM creation approaches — SSH+qm (ad-hoc), REST API, Terraform, Ansible, MCP; when to use each | daily/2026-04-18.md | 2026-04-18 |
| [[wiki/concepts/home-assistant-proxmox-install]] | HAOS on Proxmox via community-scripts one-liner — Default Settings, VM specs, why VM over LXC | daily/2026-04-19.md | 2026-04-19 |
| [[wiki/concepts/homepage-proxmox-widget-quirks]] | Homepage v0.10.9 proxmox widget quirks — type field required, pnpm start, duplicate env vars, SSL, ARP; replaced by Dashy | daily/2026-04-19.md | 2026-04-19 |
| [[wiki/concepts/lxc-arp-cache-api-failures]] | Stale ARP cache entries in LXC cause silent API failures — ip neigh flush dev eth0 is the fix | daily/2026-04-19.md | 2026-04-19 |
| [[wiki/concepts/nodejs-ssl-system-trust-store]] | Node.js ignores Linux system trust store — NODE_TLS_REJECT_UNAUTHORIZED=0 or NODE_EXTRA_CA_CERTS must be in systemd unit | daily/2026-04-19.md | 2026-04-19 |
| [[wiki/concepts/tailscale-dns-homelab]] | Tailscale Global Nameserver + Override local DNS makes internal domains resolve on mobile via AdGuard | daily/2026-04-19.md | 2026-04-19 |
| [[wiki/concepts/remote-server-dotfiles-bootstrap]] | Full-stack remote dotfiles bootstrap via sshpass r() helper — Fish, Starship, Neovim, CLI tools, fnm, conf.d pattern | daily/2026-04-19.md | 2026-04-19 |
| [[wiki/concepts/homarr-proxmox-integration]] | Homarr Proxmox integration cert trust — PVE root CA in trusted-certificates/, Termix SSH REST API, docker-socket-proxy | daily/2026-04-19.md | 2026-04-19 |
| [[wiki/concepts/export-endpoint-filter-pattern]] | PDF/CSV exports must receive variant_ids from frontend — frontend-only selection is invisible to backend renderers | daily/2026-04-20.md | 2026-04-20 |
| [[wiki/concepts/ollama-lxc-ram-requirements]] | Ollama in LXC loads Intel oneAPI toolkit (~1.8 GB overhead) even on CPU-only inference — minimum 6 GB RAM for 7B model | daily/2026-04-21.md | 2026-04-21 |
| [[wiki/concepts/beszel-monitoring-deployment]] | Beszel hub + agent deployment across Proxmox host and LXC containers — Ed25519 key auth, port assignment, systemd setup | daily/2026-04-21.md | 2026-04-21 |
| [[wiki/concepts/adguard-dns-rewrites-homelab]] | AdGuard DNS rewrites for *.ai-impress.com wildcard → NPM IP; single entry covers all internal services | daily/2026-04-21.md | 2026-04-21 |
| [[wiki/concepts/prometheus-joules-watts-gotcha]] | rate(joules_total) already returns watts — multiplying by 1000 causes W→kW display bug in Grafana dashboards | daily/2026-04-21.md | 2026-04-21 |
| [[wiki/concepts/old-gpu-sysfs-metrics]] | AMD GCN 1.0 (Oland) and Intel HD 630 don't expose gpu_busy_percent via sysfs — temperatures still available via hwmon | daily/2026-04-21.md | 2026-04-21 |
| [[wiki/concepts/chartjs-time-axis-adapter]] | Chart.js type:time axis requires chartjs-adapter-date-fns registered — without it chart silently fails to render | daily/2026-04-21.md | 2026-04-21 |
| [[wiki/concepts/uptime-kuma-socketio-management]] | Uptime Kuma has no REST API — uses Socket.IO; management done via SQLite directly | daily/2026-04-21.md | 2026-04-21 |
| [[wiki/concepts/proxmox-container-502-misdiagnosis]] | 502 Bad Gateway ≠ dead container — often nginx misconfiguration inside CT; always confirm visually before destructive actions | daily/2026-04-21.md | 2026-04-21 |
| [[wiki/concepts/git-includeif-per-remote]] | Git includeIf hasconfig:remote.*.url auto-applies correct email per remote — GitHub vs Bitbucket/work without per-repo config | daily/2026-04-23.md | 2026-04-23 |
| [[wiki/concepts/dns-youtube-ad-blocking]] | DNS-based ad blocking cannot block YouTube ads — Google serves ads and content from the same domains; uBlock Origin / ReVanced required | daily/2026-04-23.md | 2026-04-23 |
| [[wiki/concepts/adguard-blocklist-setup]] | AdGuard Home blocklist upgrade: default 1 list → 5 lists (AdAway, HaGeZi Multi Pro++, OISD Big, HaGeZi TIF); ~2.2M domains | daily/2026-04-23.md | 2026-04-23 |
| [[wiki/concepts/claude-code-schedule-skill-account-type]] | /schedule skill requires claude.ai login account — API-only users need launchd/cron as fallback | daily/2026-04-24.md | 2026-04-24 |
| [[wiki/concepts/memory-compiler-mac-migration]] | Migrating memory-compiler between Mac users — PROJECTS_ROOT, Python version, Fisher conf.d, cc-collector hyphen bug | daily/2026-04-24.md | 2026-04-25 |
| [[wiki/concepts/immich-lxc-ram-oom]] | Immich in LXC needs 8 GB RAM — 6 GB causes OOM; OOMPolicy=continue + MemoryMax=7G for auto-recovery | daily/2026-04-24.md | 2026-04-24 |
| [[wiki/concepts/systemd-memory-oom-policy]] | systemd MemoryMax + OOMPolicy=continue + RestartSec pattern for auto-recovery of memory-constrained services | daily/2026-04-24.md | 2026-04-24 |
| [[wiki/concepts/proxmox-lxc-autostart]] | LXC containers don't start after PVE reboot unless "Start at boot" (--onboot 1) is explicitly enabled | daily/2026-04-24.md | 2026-04-24 |
| [[wiki/concepts/fish-fisher-conf-d-conflict]] | Fisher plugin manager conflict when conf.d/ files are manually copied — delete and run fisher update to reinstall cleanly | daily/2026-04-22.md | 2026-04-22 |
| [[wiki/concepts/macos-python-version-hooks]] | macOS system /usr/bin/python3 = 3.9; Path\|None syntax requires 3.10+; Claude Code hooks must use /opt/homebrew/bin/python3 | daily/2026-04-22.md | 2026-04-22 |
| [[wiki/concepts/preflight-record-pattern]] | preflight(estimate) → AI call → record(actual) — the 3-step AI cost-tracking pattern with budget enforcement | ai-cost-tracker | 2026-04-27 |
| [[wiki/concepts/lazy-user-mirror]] | User mirror created on first AI event, not on user creation — minimal integration surface, source project stays owner | ai-cost-tracker | 2026-04-27 |
| [[wiki/concepts/sync-with-outbox]] | Sync HTTP + SQLite outbox: record() never blocks the AI pipeline; background flusher retries up to 10x | ai-cost-tracker | 2026-04-27 |
| [[wiki/concepts/litellm-pricing-source]] | LiteLLM model_prices JSON as auto-updating LLM price source — why scraping provider sites is fragile | ai-cost-tracker | 2026-04-27 |
| [[wiki/concepts/authentik-homelab-tradeoffs]] | Authentik v2026.2.2 migration failure `0056`, ~500MB RAM overhead, NPM auth_request removal — when to keep vs remove | daily/2026-04-27.md | 2026-04-27 |
| [[wiki/concepts/icloud-git-sync-conflict]] | iCloud creates `main 2` files in `.git/refs/heads/` on sync conflict — causes `badRefName`; fix and prevention | daily/2026-04-27.md | 2026-04-27 |
| [[wiki/concepts/homarr-sqlite-integration-cleanup]] | Homarr upgrade removes widget kinds but leaves stale SQLite rows — crashes integrations page with TypeError | daily/2026-04-28.md | 2026-04-28 |
| [[wiki/concepts/docker-lxc-dns-configuration]] | Docker containers in LXC/Proxmox use router DNS by default — need explicit AdGuard DNS in compose for internal domains | daily/2026-04-28.md | 2026-04-28 |
| [[wiki/concepts/mac-address-randomization-dhcp]] | Apple MAC randomization creates multiple DHCP leases per device — exhausts pool, causes IP conflicts; disable per-network | daily/2026-04-28.md | 2026-04-28 |
| [[wiki/concepts/prowlarr-flaresolverr-limitation]] | Prowlarr bypasses FlareSolverr for some indexers (RuTracker); VPN alternatives: SOCKS5, WireGuard in LXC, router VPN; DoLogin SQLite cookie injection workaround | daily/2026-04-28.md | 2026-04-29 |
| [[wiki/concepts/bash-and-or-short-circuit]] | Bash `A && B \|\| C` is not if/else — if B fails, C runs even when A was true; deploy scripts must use if/fi | daily/2026-04-24.md | 2026-04-24 |
| [[wiki/concepts/python-iso-z-suffix]] | Python < 3.11 `fromisoformat()` rejects `Z` suffix from JS `toISOString()` — replace `Z` with `+00:00` before parsing | daily/2026-04-24.md | 2026-04-24 |
| [[wiki/concepts/gemini-conversation-cost-scaling]] | Gemini bills full accumulated conversation history per turn — cost grows quadratically; backfill scripts must account for this | daily/2026-04-24.md | 2026-04-24 |

| [[wiki/concepts/asyncio-contextvar-task-boundary]] | Python ContextVar is NOT propagated through asyncio.wait_for / create_task — pass user_id as explicit parameter | daily/2026-04-27.md | 2026-04-27 |
| [[wiki/concepts/pydantic-v2-alias-id-gotcha]] | Pydantic v2 Field(alias="_id") serializes JSON key as "_id" not "id" — frontend .id is undefined; fix with _from_doc() helper | daily/2026-04-27.md | 2026-04-27 |
| [[wiki/concepts/php-display-errors-json-leak]] | PHP display_errors=1 prepends HTML warnings to JSON — "Unexpected token '<'" is the diagnostic signal; ini_set order matters | daily/2026-04-27.md | 2026-04-27 |

| [[wiki/concepts/jellyfin-tmdb-thetvdb-plugin]] | TMDb plugin silently fails to load images when API date format changes — switch to TheTVDB; Jellyfin S01E01 naming; Prowlarr search-only role | daily/2026-04-28.md | 2026-04-28 |
| [[wiki/concepts/azure-ad-yaml-allowlist-pattern]] | AuthN via Azure AD (MSAL PKCE), AuthZ via local YAML allowlist — when to use, SPA redirect URI type, Docker volume for config dir, PyYAML requirement | daily/2026-04-28.md | 2026-04-28 |
| [[wiki/concepts/zustand-async-hydration]] | Zustand persist hydrates localStorage asynchronously — components must gate API calls behind hasHydrated or token will be null on first render | daily/2026-04-28.md | 2026-04-28 |
| [[wiki/concepts/pydantic-model-dict-interface]] | Pydantic model passed where dict expected — .get() returns None silently instead of raising; use isinstance check or model_dump() at boundary | daily/2026-04-28.md | 2026-04-28 |

| [[wiki/concepts/localstorage-key-migration-rebrand]] | localStorage key migration after renaming storage keys in a rebrand — session loss, Zustand persist name, migration script pattern | daily/2026-04-28.md | 2026-04-28 |

| [[wiki/concepts/poetry-docker-version-mismatch]] | Poetry 2.x `poetry install` fails with `readme` in pyproject.toml without `--no-root`; poetry.lock version mismatch between dev and Dockerfile causes silent failures | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/pydantic-default-factory-type-alias]] | `PyObjectId = Annotated[str, ...]` used as `default_factory=PyObjectId` calls `str()` → `""` → DuplicateKeyError on second MongoDB insert; fix: `lambda: str(ObjectId())` | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/security-middleware-json-key-regex]] | Bare XSS regex on raw JSON body matches field names (transcript, subscription) not just values — fix: parse first, validate values only, or use word boundaries | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/multitenant-fail-open-authz]] | `get_accessible_project_ids()` returning `None` instead of `[]` means fail-open (all projects visible); use 404 not 403 for cross-tenant access to avoid resource existence disclosure | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/gemini-embedding-api-channel]] | `gemini-embedding-001` works with AI Studio key; `text-embedding-004` and `text-multilingual-embedding-002` require Vertex AI credentials — not available via standard Gemini API key | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/native-track-blob-url]] | Browsers block `data:text/vtt` URIs for `<track>` elements; must use `URL.createObjectURL(new Blob([vttString]))` and revoke in effect destructor | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/claude-code-plugin-marketplace]] | `/plugin marketplace add <user>/<repo>` registers GitHub marketplace; then `/plugin install <name>@<marketplace-name>`; `/plugin add` without marketplace doesn't work for GitHub repos | daily/2026-04-29.md | 2026-04-29 |

| [[wiki/concepts/docker-compose-cpu-limits-env]] | `cpus: '4.0'` fails at `docker compose up` on a 2-CPU server — fix with per-environment compose override files | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/etag-optimistic-locking]] | ETag/If-Match pattern for concurrent edit protection — backend hash, frontend state (not ref), 412 conflict handling | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/double-submit-cookie-csrf]] | CSRF for stateless JWT APIs: csrf_token cookie + X-CSRF-Token header; every login path must set both cookies | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/time-sleep-blocks-asyncio]] | `time.sleep()` inside async FastAPI handlers blocks the entire event loop — replace with `asyncio.sleep()` or `run_in_executor` | daily/2026-04-29.md | 2026-04-29 |

| [[wiki/concepts/apache-proxypass-include-files-ignored]] | ProxyPass in Apache Include fragment files is silently ignored on optical-dev — always add ProxyPass directly to the main vhost file | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/cookie-domain-migration-auth-loop]] | COOKIE_DOMAIN mismatch after domain migration causes silent auth failure — browser drops cookie, manifests as infinite /login redirect loop; Vite bundle must be rebuilt after env var changes | daily/2026-04-29.md | 2026-04-29 |

| [[wiki/concepts/mongodb-enum-deserialization]] | MongoDB stores Python Enum fields as plain strings — `.value` raises AttributeError; `hasattr` guard or Pydantic `mode="before"` validator at boundary | daily/2026-04-29.md | 2026-04-30 |
| [[wiki/concepts/websocket-react-token-guard]] | React WebSocket `useEffect` must guard `if (!token) return` before opening socket, and include `token` in dep array so socket reconnects after login | daily/2026-04-29.md | 2026-04-30 |
| [[wiki/concepts/docker-builder-prune-safe]] | `docker builder prune` removes only build cache — safe on live servers; running containers, images, and named volumes are untouched | daily/2026-04-29.md | 2026-04-30 |

| [[wiki/concepts/pydub-ffmpeg-silent-dependency]] | pydub installs via pip but requires system `ffmpeg` at runtime — crashes silently in Docker; fix: `apt install ffmpeg` or switch to `lameenc` | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/lameenc-bytearray-gcs-upload]] | `lameenc.encode()` returns `bytearray` not `bytes` — GCS `upload_from_string()` raises TypeError whose message looks like corrupt data; fix: `bytes()` cast | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/apache-mod-alias-proxy-priority]] | Apache `mod_alias` hooks earlier than `mod_proxy` — when physical directory exists, Alias wins and ProxyPass for paths under that prefix never fires | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/faster-whisper-startup-memory]] | `faster_whisper` loads the full model into RAM at container startup regardless of task routing — memory limits must reflect model size, not routing config | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/celery-redis-queue-flush-on-deterministic-error]] | Deterministic Celery errors leave task IDs in Redis queue causing retry loops — resetting MongoDB status alone is not enough; must flush Redis + re-enqueue | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/cline-lm-studio-openai-compatible]] | Cline's native LM Studio provider causes silent retry loop — use OpenAI Compatible provider (`/v1/`) instead; load model at 32k+ context | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/celery-queue-worker-specialization]] | Named Celery queues: only the container consuming that queue processes tasks — fix bugs in specialised workers by rebuilding THAT container | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/gcs-resumable-upload-pattern]] | Browser → backend creates GCS Resumable Session URI → browser uploads chunks directly to GCS, bypassing LB/Apache; 8 MB chunks, 308=continue, resume via Range header | daily/2026-04-30.md | 2026-04-30 |

| [[wiki/concepts/celery-prefork-pool-startup-memory]] | Celery prefork forks ALL CONCURRENCY workers at startup — CONCURRENCY=20 × 120 MB = 2.4 GB before first task; OOM before any work | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/sudo-git-clone-root-ownership]] | `sudo git clone` makes all files root-owned — subsequent user `git pull` fails with Permission denied on .git/FETCH_HEAD; fix: chown -R | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/python-fastapi-module-level-singletons]] | `settings = Settings()` at module import level crashes pytest when env vars aren't set — guard with `@lru_cache` function or lazy `@property` | daily/2026-04-30.md | 2026-04-30 |

| [[wiki/concepts/react-query-enabled-falsy-value]] | `enabled: !!clientId` silently disables React Query when clientId is `""` — empty string is falsy; use explicit null check or separate hook | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/mongodb-cross-collection-id-confusion]] | `find_one({"_id": client_id})` in wrong collection returns `None` silently — MongoDB has no FK constraints; email/notify code never runs | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/browser-sequential-download-blocking]] | Sequential `window.open()` downloads only deliver the first file — browser popup blocker suppresses the rest; 400–500ms gap or fetch+blob fixes it | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/mongodb-schema-validator-migration-verification]] | MongoDB `collMod` migration marked "applied" without actually running — verify with `getCollectionInfos`; fix with direct `collMod` + `validationLevel: moderate` | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/git-worktrees-parallel-claude]] | Git worktrees for parallel Claude Code sessions — isolate branches, exact commands, when to suggest, Claude Code `isolation: "worktree"` | manual | 2026-05-05 |

| [[wiki/concepts/docker-compose-restart-no-code-reload]] | `docker compose restart` does not rebuild the image — must run `build && up -d` after any .py change; service name typos fail silently | daily/2026-05-01.md | 2026-05-01 |
| [[wiki/concepts/mongodb-unwind-preservenullandemptyarrays]] | Typo `preserveNullAndEmpty` (wrong) vs `preserveNullAndEmptyArrays` (correct); MongoDB 7.0 rejects unknown `$unwind` options with error 28811; older versions silently ignored them | daily/2026-05-01.md | 2026-05-01 |
| [[wiki/concepts/fastapi-response-model-silent-field-strip]] | FastAPI `response_model` silently strips fields not declared in the Pydantic schema — data exists in DB but never reaches the JSON response; Vue list-field crash (`?.` dual-layer fix) | daily/2026-05-01.md | 2026-05-07 |
| [[wiki/concepts/react-useref-event-handler-state]] | React `useState` setters are async — `pointerMove` sees stale state set in `pointerDown`; fix with `useRef` for drag flags; also: `act()` in RTL tests, `useMemo` declaration order | daily/2026-05-01.md | 2026-05-01 |

| [[wiki/concepts/llamaextract-data-none-gotcha\|LlamaExtract — Truthy Object with data=None]] | `LlamaExtract.aextract()` always returns an object — even when the PDF cannot be parsed (scanned ima | sandbox-notebookllamalm-nextjs | 2026-05-05 |
| [[wiki/concepts/vite-prebuilt-subpath-workaround\|Vite Pre-built Subpath Workaround — <base href>]] | Vite builds without a configured `base` option always generate **absolute asset paths** (e.g., `/ass | loreal-timelog-viewer | 2026-05-05 |
| [[wiki/concepts/icloud-space-2-duplicate-files\|iCloud Concurrent Write: ' 2.md' Duplicate Files]] | When two devices write to the same iCloud Drive file at the same time, iCloud resolves the conflict  | memory-compiler | 2026-05-05 |
| [[wiki/concepts/one2edit-username-format\|One2Edit Username Format]] | One2Edit usernames are **email addresses**, not `firstname.lastname` handles. This trips up anyone g | 01 Projects/3m-portal | 2026-05-05 |
| [[wiki/concepts/sqlite-not-null-as-boolean\|SQLite: IS NOT NULL AS Boolean]] | When a column contains sensitive data (e.g. a password hash), never select it directly to answer a y | sandbox | 2026-05-05 |
| [[wiki/concepts/fastapi-root-path-route-stripping]] | Starlette strips `root_path` prefix before route matching — register `/healthz` not `/cc-dashboard/healthz` even when app is at that prefix | daily/2026-05-06.md | 2026-05-06 |
| [[wiki/concepts/sse-jwt-query-param]] | Browser `EventSource` has no headers option — JWT must travel as `?token=` query param for SSE streams | daily/2026-05-06.md | 2026-05-06 |
| [[wiki/concepts/spa-index-html-cache-control]] | Vite asset hashes change on rebuild — old cached `index.html` causes 404 on JS chunks; fix: `no-cache` on index.html, `immutable` on `/assets/` | daily/2026-05-06.md | 2026-05-06 |
| [[wiki/concepts/microsoft-sso-non-uuid-ids]] | Microsoft SSO app IDs are not UUIDs (`ms-4n0T2x-...`) — UUID validation in routing/DB silently fails for SSO users | daily/2026-05-06.md | 2026-05-06 |

| [[wiki/concepts/memory-compiler-lesson-signal]] | Claude Code built-in memory is unused; real pipeline is memory-compiler hooks; `Lesson: <rule> — Reason: <cause>` guarantees flush capture; always use skill FQN to avoid ambiguity | daily/2026-05-06.md | 2026-05-06 |
| [[wiki/concepts/pinia-storeftorefs-array-reactivity]] | Pinia storeToRefs loses reactivity on array assignment in Options API stores — must mutate in-place or use $patch | daily/2026-05-06.md | 2026-05-06 |
| [[wiki/concepts/glance-dashboard-config]] | Glance dashboard config: $include page limitation, internal IP for monitors, Homarr replacement | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/sonarr-custom-format-quality-profile]] | Sonarr Custom Formats only score within Quality Profile — "Any" ignores them entirely; season pack creates one queue entry per episode | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/prowlarr-flaresolverr-get-only]] | FlareSolverr only intercepts GET requests — DoLogin() POST bypasses it; workaround: SQLite cookie injection into IndexerDefinition | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/npm-sqlite-admin-reset]] | Nginx Proxy Manager admin password reset via SQLite bcrypt injection — stop NPM first, backup DB, update auth table | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/vaultwarden-master-password-encryption]] | Vaultwarden E2E encryption — master password IS the encryption key; resetting it destroys all vault data; restore from Backrest backup | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/jellyseerr-setup-wizard-sqlite]] | Jellyseerr serverType: 2 for Jellyfin (not 4); public.initialized = false causes wizard loop; urlBase must be empty string not null | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/ssh-agent-passphrase-key]] | SSH keys with passphrases need ssh-add before use; "no identity pubkey loaded" diagnostic; AddKeysToAgent + UseKeychain for persistence | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/linux-cpu-frequency-fan-noise]] | HP Elitedesk pwm returns N/A (BIOS-only fan control); CPU max freq capping via cpufreq/systemd is the only Linux noise lever | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/paperless-ngx-docker-exec-permission-bug]] | docker exec without -u flag creates root-owned temp dirs inaccessible to celery worker; PAPERLESS_SCRATCH_DIR fix | daily/2026-05-01.md | 2026-05-01 |
| [[wiki/concepts/paperless-ngx-mail-rule-attachment-only]] | Mail rule mark-as-read prevents re-processing; attachment-only mode (0) prevents body+attachment duplicate detection | daily/2026-05-01.md | 2026-05-01 |
| [[wiki/concepts/documenso-vs-libresign-esignature]] | Documenso=AES (email auth, external clients); LibreSign=SES (Nextcloud PKI, internal only) | daily/2026-05-01.md | 2026-05-01 |
| [[wiki/concepts/gpu-device-node-lxc-docker]] | GPU device node mismatch in LXC Docker — renderD128 vs renderD129, bind mount creates empty file, exit 255 | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/jellyfin-client-bitrate-limit]] | ContainerBitrateExceedsLimit is a client-side bitrate cap causing transcoding — fix in Jellyfin app Quality settings | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/jellyfin-library-path-mismatch]] | Radarr/Sonarr root folder vs Jellyfin library path mismatch — downloaded media silently invisible in Jellyfin | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/qbittorrent-slow-speed-checklist]] | qBittorrent slow speeds checklist — proxy profile blocking, UPnP, TP-Link AX72 port forwarding | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/docker-bridge-subnet-whitelist]] | Docker containers use 172.x.x.x bridge IPs — LAN /24 whitelist doesn't cover them; add 172.16.0.0/12 | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/proxmox-lxc-disk-fstrim]] | Proxmox LXC disk 99% → 35% via fstrim + issue_discards=1 — TRIM not sent automatically without these settings | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/macos-cron-sleep-missed-jobs]] | macOS cron silently drops jobs when machine sleeps at trigger time — no catch-up on wake; diagnose via `log show --predicate 'process == "cron"'` | daily/2026-05-07.md | 2026-05-08 |
| [[wiki/concepts/macos-launchd-catchup-cron-replacement]] | launchd with `RunCatchUpIfMissed=true` fires on wake if schedule was missed — correct cron replacement for laptops; plist structure, launchctl commands | daily/2026-05-07.md | 2026-05-08 |
| [[wiki/concepts/macos-windows-usb-wimlib]] | macOS Windows 11 USB creation when install.wim > 4 GB — FAT32 limit, wimlib-imagex split, .swm auto-detection by installer | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/rspamd-mailcow-whitelist]] | rspamd sender domain whitelist in Mailcow — score -100 override, BAYES training data reset, rspamc learn_ham | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/apple-mail-trust-junk-headers]] | Apple Mail "Trust junk mail headers" reads rspamd X-Spam headers and silently auto-deletes emails — disable in Junk Mail settings | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/dovecot-expunge-irreversible]] | doveadm expunge and IMAP EXPUNGE are permanent — no server-side recycle bin; recovery requires external backup (Scaleway, Backrest) | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/apple-silicon-usb-passthrough]] | OrbStack has no USB passthrough; UTM (QEMU) does — use case: Windows diskpart to clear Kingston hardware read-only lock | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/macos-full-disk-access-external-volume]] | macOS FDA must be granted to Terminal/Claude Code to read `/Volumes/SSD/` paths; app restart required after granting | daily/2026-05-07.md | 2026-05-08 |
| [[wiki/concepts/apple-mail-trust-junk-headers 2\|Apple Mail — 'Trust junk mail headers' Silent Auto-Deletion]] | Apple Mail has a setting — **Mail → Settings → Junk Mail → "Trust junk mail headers in messages"** — | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/docker-bridge-network-whitelist 2\|Docker Bridge Network (172.x.x.x) Bypasses LAN-Based App Whitelists]] | When a Docker container communicates with another service, it uses the Docker bridge network IP (typ | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/docker-bridge-network-whitelist\|Docker Bridge Network (172.x.x.x) Bypasses LAN-Based App Whitelists]] | When a Docker container communicates with another service, it uses the Docker bridge network IP (typ | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/docker-bridge-subnet-whitelist 2\|Docker Bridge Network Bypasses LAN-Based Whitelists]] | Docker containers on the default bridge network are assigned IPs in the `172.16.0.0/12` range (e.g., | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/docker-lxc-gpu-device-node-mismatch 2\|Docker LXC GPU Device Node Mismatch — renderD128 vs renderD129]] | When a Docker Compose volume bind-mounts a GPU device node (e.g., `/dev/dri/renderD129`), if that de | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/docker-lxc-gpu-device-node-mismatch\|Docker LXC GPU Device Node Mismatch — renderD128 vs renderD129]] | When a Docker Compose volume bind-mounts a GPU device node (e.g., `/dev/dri/renderD129`), if that de | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/documenso-vs-libresign-esignature 2\|Documenso vs LibreSign — Electronic Signature Legal Validity]] | Documenso and LibreSign are both open-source self-hosted electronic signature solutions, but they se | daily/2026-05-01.md | 2026-05-01 |
| [[wiki/concepts/dovecot-expunge-irreversible 2\|Dovecot — Expunge Is Permanent; Recovery Requires External Backup]] | `doveadm expunge` and client-triggered IMAP EXPUNGE commands permanently remove messages from disk.  | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/glance-dashboard 2\|Glance — Go-Binary Homelab Dashboard]] | Glance is a lightweight, single-binary homelab dashboard written in Go. It replaces heavier alternat | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/glance-dashboard-config 2\|Glance Dashboard — Config Patterns and Homelab Setup]] | Glance is a Go-binary self-hosted dashboard with rich widget support (RSS, Reddit, YouTube, monitors | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/gpu-device-node-lxc-docker 2\|GPU Device Node Mismatch in LXC Docker — Exit Code 255]] | When passing a GPU device node (e.g., `/dev/dri/renderD128`) into a Docker container inside a Proxmo | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/jellyfin-client-bitrate-limit 2\|Jellyfin ContainerBitrateExceedsLimit — Client-Side Setting, Not Server]] | When Jellyfin shows `ContainerBitrateExceedsLimit` in logs and starts transcoding (or buffering heav | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/jellyfin-library-path-mismatch 2\|Jellyfin Library Path Mismatch — Radarr/Sonarr Root Folder vs Jellyfin Library Paths]] | When Radarr or Sonarr download content to a specific path and Jellyfin's library monitors a differen | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/jellyseerr-setup-wizard-sqlite 2\|Jellyseerr Setup Wizard Loops and SQLite Gotchas]] | Jellyseerr has several sharp edges during initial setup: the wrong `serverType` integer causes the m | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/linux-cpu-frequency-fan-noise 2\|Linux CPU Frequency Capping for Fan Noise Reduction]] | The HP Elitedesk 800 G3 (and similar small-form-factor business PCs) exposes fan control only throug | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/macos-full-disk-access-external-volume 2\|macOS Full Disk Access — External Volumes]] | **Source:** daily/2026-05-07.md | — | — |
| [[wiki/concepts/macos-launchd-catchup-cron-replacement 2\|macOS launchd as Cron Replacement with RunCatchUpIfMissed]] | macOS cron silently drops jobs when the machine is asleep at trigger time. launchd with `RunCatchUpI | daily/2026-05-07.md | 2026-05-08 |
| [[wiki/concepts/macos-windows-usb-wimlib 2\|macOS — Windows 11 USB Creation when install.wim Exceeds 4 GB (wimlib split)]] | Modern Windows 11 ISOs include an `install.wim` that exceeds 4 GB — above the FAT32 single-file limi | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/paperless-ngx-docker-exec-permission-bug 2\|Paperless-NGX — docker exec Root-Owned Temp Dirs Break Mail Fetcher]] | Running `docker exec paperless-ngx ...` without a `-u paperless` flag executes as root. Python's `te | daily/2026-05-01.md | 2026-05-01 |
| [[wiki/concepts/paperless-ngx-mail-rule-attachment-only 2\|Paperless-NGX Mail Rule — Attachment-Only Processing and Mark-as-Read Gotcha]] | Paperless-NGX mail rules have two non-obvious behaviors: (1) emails already marked as read by a prev | daily/2026-05-01.md | 2026-05-01 |
| [[wiki/concepts/prowlarr-flaresolverr-get-only 2\|FlareSolverr GET-Only Limitation and SQLite Cookie Injection]] | FlareSolverr intercepts only HTTP GET requests. Prowlarr's `DoLogin()` method sends a POST request t | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/proxmox-lxc-disk-fstrim 2\|Proxmox LXC Disk Space Recovery via fstrim]] | After deleting large files inside an LXC container, the disk usage shown in `df -h` (and Proxmox UI) | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/proxmox-lxc-disk-trim 2\|Proxmox LXC Disk Space Recovery — fstrim and issue_discards]] | When a Proxmox LXC container's disk appears full (e.g., 99%) but the container hasn't actually used  | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/proxmox-lxc-disk-trim\|Proxmox LXC Disk Space Recovery — fstrim and issue_discards]] | When a Proxmox LXC container's disk appears full (e.g., 99%) but the container hasn't actually used  | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/qbittorrent-proxy-profile-blocking 2\|qBittorrent Proxy Profile Enabled Without Proxy Host Blocks All Connections]] | When qBittorrent has a proxy configuration enabled (type: SOCKS5 or HTTP) but no valid proxy host is | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/qbittorrent-proxy-profile-blocking\|qBittorrent Proxy Profile Enabled Without Proxy Host Blocks All Connections]] | When qBittorrent has a proxy configuration enabled (type: SOCKS5 or HTTP) but no valid proxy host is | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/qbittorrent-slow-speed-checklist 2\|qBittorrent Slow Speed Checklist — Proxy, UPnP, Port Forwarding]] | Three distinct root causes found in practice when qBittorrent shows near-zero download speeds despit | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/rspamd-mailcow-whitelist 2\|rspamd — Sender Whitelist and BAYES Data Reset in Mailcow]] | When a legitimate sender is blocked by rspamd (Spamhaus SBL, BAYES_SPAM, or other rules), the fastes | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/sonarr-custom-format-quality-profile 2\|Sonarr Custom Formats — Quality Profile Scoping and 'Any' Bypass]] | Sonarr Custom Formats apply score-based ranking to downloaded releases. A critical scoping rule: Cus | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/sonarr-custom-formats-quality-profile 2\|Sonarr Custom Formats — Quality Profile Scoping and Russian Audio]] | Sonarr's Custom Formats system assigns preference scores to releases based on regex patterns (codec, | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/sonarr-custom-formats-quality-profile\|Sonarr Custom Formats — Quality Profile Scoping and Russian Audio]] | Sonarr's Custom Formats system assigns preference scores to releases based on regex patterns (codec, | daily/2026-04-29.md | 2026-04-29 |
| [[wiki/concepts/ssh-agent-passphrase-key 2\|SSH Keys with Passphrases Require ssh-add]] | An SSH key with a passphrase will not be used automatically even if it is listed in `~/.ssh/config`. | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/vaultwarden-master-password-encryption 2\|Vaultwarden Master Password = Encryption Key]] | Vaultwarden (self-hosted Bitwarden) uses end-to-end encryption where the master password is not just | daily/2026-04-30.md | 2026-04-30 |
| [[wiki/concepts/workflow-approve-dispatch-completeness]] | Pipeline approval endpoint should completeness-check before dispatch — if all outputs exist advance state directly, else dispatch and set TRANSLATING | daily/2026-05-06.md | 2026-05-06 |
| [[wiki/concepts/fastapi-orm-property-json-column\|FastAPI ORM @property for JSON-Column Fields — No Migration Needed]] | When an ORM model already stores data in a JSON column (e.g. `fields_json`), new read-only display f | daily/2026-05-07.md | 2026-05-07 |
| [[wiki/concepts/fastapi-orm-property-json-column]] | Python `@property` on SQLAlchemy ORM model exposes JSON-column sub-fields without Alembic migration — zero DB change, forward-compatible | daily/2026-05-07.md | 2026-05-07 |
| [[wiki/concepts/async-def-without-await-silent-coroutine\|async def Called Without await Returns Silent Coroutine]] | Calling an async function without await silently returns a coroutine object — no exception, no execu | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/google-cloud-tts-vs-ai-studio-tts]] | Google Cloud TTS (`texttospeech.googleapis.com`) vs AI Studio TTS — separate services, quotas, IAM, SDK; Cloud TTS returns MP3 directly, requires `roles/aiplatform.user` | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/google-cloud-texttospeech-version-gate]] | `VoiceSelectionParams.model_name` silently ignored in `google-cloud-texttospeech` < 2.28.0 — wrong voice returned with no error; requires ≥ 2.36.0 | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/caption-aligner-cursor-stall-cascade]] | VTT caption aligner: one fuzzy-match miss stalls cursor, cascading all subsequent cues to miss; fix with `bisect.bisect_left` time-based fallback | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/celery-worker-restart-inflight-task-loss]] | Celery tasks executing during worker restart are permanently orphaned — MongoDB job stuck in `ai_processing`; requires manual `reprocess-job/{id}` after deploy | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/poetry-lock-server-conflict-resolution]] | After `poetry update` on a server, `git pull` conflicts on `poetry.lock`; fix: `git checkout backend/poetry.lock && git pull` | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/silent-exception-swallow-falsy-guard]] | Function catches exception and returns `""`, caller uses `if result:` guard — double silent failure; fix: raise exception, add `exc_info=True` to logger | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/pydantic-required-fields-manual-mongodb-patch]] | Manually patching MongoDB without all required Pydantic sub-model fields causes every GET of that document to return 500 with no useful trace | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/caption-aligner-cursor-drift\|Caption Aligner Cursor Drift — Fuzzy Match Failure and bisect Fallback]] | When a fuzzy text-matching caption aligner fails to find a match for a cue, the search cursor stays  | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/celery-inflight-tasks-lost-on-restart\|Celery In-Flight Tasks Lost on Worker Restart]] | Tasks in the `ai_processing` (or any custom) state at the time of a Celery worker restart are perman | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/cmux-ghostty-wrapper-config\|cmux — macOS Ghostty Wrapper; Two Separate Configs]] | cmux is a macOS GUI workspace/multiplexer application that delegates actual terminal rendering to Gh | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/google-cloud-tts-ai-studio-separation\|Google Cloud TTS vs AI Studio TTS — Separate Services, Different Quotas]] | Gemini TTS on AI Studio API (`generativelanguage.googleapis.com`, `GEMINI_API_KEY`) has a 10 RPM pre | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/mongodb-manual-patch-pydantic-required-fields\|MongoDB Manual Patch Must Include All Required Pydantic Fields]] | When manually patching a MongoDB document (e.g., via `mongosh` or a maintenance script), omitting a  | daily/2026-05-08.md | 2026-05-10 |
| [[wiki/concepts/pydantic-mongodb-patch-missing-fields\|Manual MongoDB Patch Missing Pydantic Required Fields → 500 on GET]] | When patching a MongoDB document directly (via MongoDB shell, Atlas UI, or a one-off script) without | daily/2026-05-08.md | 2026-05-08 |
| [[wiki/concepts/celery-inflight-task-restart-loss\|Celery In-Flight Tasks Lost on Worker Restart]] | Celery tasks that are **actively executing** when the worker container restarts are permanently lost | daily/2026-05-08.md | 2026-05-10 |
| [[wiki/concepts/css-marquee-animation-gpu-pattern\|CSS Marquee — GPU-Composited Seamless Scroll Pattern]] | A seamless, stutter-free horizontal marquee (infinite scroll) entirely in CSS, GPU-composited via `t | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/payload-cms-node26-esm-workaround\|Payload CMS + Node 26 — Seed Script ESM Workaround]] | Running a Payload CMS seed script directly via `npx tsx seed.ts` on **Node 26** fails with: | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/payload-cms-root-layout-requirement\|Payload CMS 3.x — (payload)/layout.tsx Must Use RootLayout]] | In a Payload CMS 3.x + Next.js project, the route group `(payload)/layout.tsx` **must** import and r | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/pydantic-exclude-none-null-clearing-conflict\|Pydantic exclude_none vs Intentional null Fields]] | `model_dump(exclude_none=True)` removes **all** fields whose value is `None`, including fields that  | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/css-animation-js-scroll-conflict\|CSS animation + JS scrollLeft Conflict — Layout Thrashing]] | Mixing a CSS `animation` (or `transition`) on an element with JS writes to `scrollLeft` on the same  | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/figma-mcp-oauth-reconnect-restart\|Figma MCP — OAuth Reconnect Requires Full Claude Code Restart]] | If the Figma MCP server disconnects mid-auth-flow (e.g., Claude Code restarts while the browser OAut | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/nextjs16-lint-command-removed\|Next.js 16 — next lint Command Removed]] | `next lint` is removed in Next.js 16. Running it produces: | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/overflow-hidden-clips-positioned-children\|CSS overflow-hidden Clips Absolutely-Positioned Children]] | `overflow: hidden` clips all descendants including absolute/fixed children regardless of z-index — move interactive elements outside the container | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/react-state-playwright-css-hover\|React useState Dropdown — CSS group-hover vs useState for Playwright]] | Playwright `hover()` on a trigger element does not reliably open a React dropdown that uses `useStat | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/overflow-hidden-clips-absolute-children\|overflow:hidden Clips Absolute/Fixed Children Regardless of z-index]] | `overflow: hidden` on a parent element **clips all descendant content at its boundary** — including  | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/figma-fig-binary-format\|Figma .fig File — Proprietary Binary Format; Assets Extractable, Layout Data Not]] | `.fig` = ZIP with proprietary binary `canvas.fig` (magic bytes `fig-kiwij`); image assets extractable via `unzip`, but layer/component/text data requires Figma REST API or Desktop | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/vite-base-url-slash-concatenation]] | `${BASE_URL}file.png` works in dev (BASE_URL="/") but breaks in prod — always use explicit slash or `new URL(file, BASE_URL).href` | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/adguard-parallel-instances-diagnostic]] | Two AdGuard instances on different IPs — how to identify the real production one vs empty placeholder; fix is router-side DNS update | daily/2026-05-03.md | 2026-05-03 |
| [[wiki/concepts/payload-cms-overrideaccess-bypass]] | `overrideAccess: true` in Payload CMS completely bypasses access control — critical anti-pattern in webhook handlers; unauthenticated lead modification | daily/2026-05-09.md | 2026-05-09 |
| [[wiki/concepts/nextjs-unstable-cache-force-dynamic]] | `unstable_cache` + tag revalidation vs `force-dynamic` — ISR pattern for shared rarely-changing data; 99%+ reduction in external API calls | daily/2026-05-09.md | 2026-05-09 |
| [[wiki/concepts/map-ratelimiter-memory-leak]] | In-memory Map rate limiters grow unbounded — `setInterval` eviction with `.unref()` prevents memory leak and test runner hang | daily/2026-05-09.md | 2026-05-09 |
| [[wiki/concepts/vitest-module-level-env-testing]] | `vi.stubEnv` + `vi.resetModules()` + dynamic `await import()` required when module reads env vars at load time | daily/2026-05-09.md | 2026-05-09 |
| [[wiki/concepts/webhook-replay-attack-prevention]] | Timestamp ±5min validation + callId deduplication (DB or Redis NX) to prevent webhook replay attacks — HMAC alone is not sufficient | daily/2026-05-09.md | 2026-05-09 |
| [[wiki/concepts/secrets-git-history-purge]] | `git-filter-repo --invert-paths --path .env` permanently removes secrets from history; force push required; all clones must be redone | daily/2026-05-09.md | 2026-05-09 |
| [[wiki/concepts/payload-cms-push-dev-prod]] | `push: process.env.NODE_ENV === 'development'` — auto-schema in dev, migration-only in prod; `push: false` default silently breaks fresh DB | daily/2026-05-09.md | 2026-05-09 |
| [[wiki/concepts/cloudflare-proxied-domain-npm-subpath]] | Cloudflare-only domains have no NPM nginx vhost — Custom Locations fail; solution is a separate subdomain with its own NPM Proxy Host | daily/2026-05-09.md | 2026-05-09 |
| [[wiki/concepts/eslint-flatcompat-next16-circular-reference]] | `FlatCompat` wrapping `eslint-config-next` v16 causes circular reference crash — import nextConfig directly; FlatCompat is redundant for v16+ | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/active-component-import-verification]] | Grep import chain before editing — Header.tsx vs HeaderClient.tsx lesson; editing the wrong file wastes cycles with no visible change | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/figma-code-connect-plan-requirements]] | Figma Code Connect: `send_code_connect_mappings` MCP requires Org/Enterprise plan; CLI `figma connect publish` works on all plans | daily/2026-05-10.md | 2026-05-10 |
| [[wiki/concepts/figma-design-to-code-workflow\|Figma Design-to-Code — Workflow, Best Practices, Pixel-Perfect Positioning]] | ``` | raw/Structure your Figma file for better code.md | 2026-05-13 |
| [[wiki/concepts/figma-mcp-tools-reference\|Figma MCP Server — Tool Reference]] | Complete list of the 18 tools exposed by the Figma MCP server. The primary 3 are bolded — they cover | raw/Tools and prompts  Developer Docs.md | 2026-05-13 |
| [[wiki/concepts/figma-skills-reference\|Figma Skills Reference — All Official Skills]] | Skills = pre-built workflow instructions bundled with the Figma plugin. They tell the AI which tools | raw/Figma skills for MCP.md | 2026-05-13 |
<!-- Articles added automatically by compile.py -->
<!-- Format: | [[concepts/slug]] | One-line summary | daily/YYYY-MM-DD.md | date | -->
