The logo that centred itself off the top of the screen
A short browser window cut the sign-in logo in half and nothing could scroll to it. One centring rule was the cause; three more sign-in rows went with it.
A tester sent a screenshot of the sign-in page with the top of the logo missing. Not cropped by the browser chrome, not hidden behind a bar: the page had drawn it above the top edge of the window, and no amount of scrolling brought it back. We reproduced it at 1280 by 560, a laptop with the browser not quite full height, which is most laptops at some point in the day.
The cause was one line of layout. The left half of the page centred its box vertically. Centring is the right default when there is room: the box floats in the middle and looks deliberate. When there is not room, a vertically centred box overflows both ways, half above the window and half below, and the half above is unreachable because nothing scrolls upwards past zero. The fix is the same box with automatic margins instead: centred when the window is tall enough, pinned to the top and scrollable when it is not. One property, and the logo is whole at every height we tried.
What else was on that screen
Three more rows in the same report were the same page, so they went in together. The wrong-password message used to sit under the back link, below the fold on a phone, so the person who typed the wrong thing saw the button do nothing. It sits under the fields and above the button now, announced to a screen reader, and it clears on the next keystroke rather than nagging while you fix the typo. The address bar read the home address while the form was showing, because the no-session boot path never moved it; it reads the sign-in address now. And where you were headed before the form appeared is remembered for the length of the tab, so signing in lands you on the page you asked for, not on the dashboard.
What was kept on purpose
Three rows on the same screen were answered rather than changed. An email address typed in capitals is accepted, because addresses are not case-sensitive and the server lower-cases them. And the refusal is one sentence, wrong email or password, never incorrect password, because the second wording tells a stranger that the address has an account. A tester reads that as a vague message. It is a deliberate one, and the reply to the sheet says so.
We checked the fix in a real browser at the tester’s size before shipping: logo whole, the message above the button, clearing as you type, the bar reading the sign-in address. A layout rule that is right on a tall window and wrong on a short one is the kind of bug nobody at the desk ever sees, which is exactly why someone else has to.