A checkout flow passed every test it had. Then someone double-clicked Pay.

A checkout flow passed every test it had. Then someone double-clicked Pay.

Two requests, 40ms apart. Both read order.status as "pending." Both charged the card. The test suite never caught it because no test clicks twice.

We replayed it with concurrency=2. It reproduced 100 times out of 100.

The fix was four lines — a lock around the status read. The bug was never the code. It was the assumption that requests arrive one at a time.

Nobody finds this in a happy-path suite. You find it in production, in a chargeback report, three weeks later.

Break it here. Not in prod.