Need help with coding: debugging flaky Supabase RLS in a Next.js app

My server actions intermittently return empty rows even though the same query works in the SQL editor. I suspect RLS and auth session timing, but I cannot reproduce it locally with the service role disabled. I have logging on auth.uid() in policies and still get silent empty results about one request in ten. Looking for someone who has shipped Supabase RLS with Next.js App Router and can spot the usual footguns.