CI / test (push) Successful in 1m14s
TestRejections built a "wrong" key by replacing a valid one's last character with X. Keys are base62, so one in sixty-two already ends in X and the wrong key was the right one, which authenticated and failed the assertion. It passed locally all day and failed in CI, which is how long a flake of that shape takes to look like a real bug — long enough that the instinct on seeing it is to go looking in the authenticator. The replacement is now chosen to differ from what it replaces, with a test on the helper itself: a mutation that can return its input turns the test it serves into one that quietly checks nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>