Two concurrent withdrawal requests both read $100, both passed the check, both wrote $0. The agent had added FOR UPDATE to stop double-spend. It just put the lock on the wrong side of the read.
The agent wired up idempotency correctly on the first request. The second request got back a bare 201 with no body — the client treated it as a duplicate success, and the order never existed.
The agent overwrote its own null check three edits later. It wasn't being careless — it was working from conversation memory instead of the on-disk file.
A sleep looks like a fix because it's a single line and it makes the flaky test stop flaking. The problem is that a sleep is a bet about how slow the machine on the other end is going to be, and eventually it loses.
A flaky payment test failed on a timeout. The agent added retries around the whole handler. The second attempt charged the card twice. Retry without idempotency is not a fix — it's a louder bug.
You asked for one endpoint. The diff has the endpoint, a renamed variable across fourteen files, a rewritten error helper, and a formatting pass. You can't tell which hunk is the feature and which is a side quest. Here's the habit that fixed it.
