Idempotence! If the app is not in the collection, then that's what the API client wants. Perhaps the server should return a 205 to indicate that the client should probably refresh.
I'll buy a 205.
FWIW, this bug (and others like it) does not need to be [qa-]. This ought to be pretty easy to verify.
Fair enough. My logic was that it's something easy enough for basta to verify, rather than spending QA resources on it.