-"I built the admin panel and forgot the API" — middleware matcher covered pages, not /api/* — one curl showed every contact message -The fix — JWT via jose in middleware, what stays public and why -The 405 that traveled through time — local worked, live ran months-old code; the failed-deploy-keeps-old-container trap -The cache that ate my edits — force-dynamic vs ISR vs revalidatePath, dev never shows you this -"What I check first now" — build stamp, incognito API test, hard refresh — the checklist that saved every debugging session since