I was active, then suspended, then banned in 30 seconds — two super-admins racing on the same affiliate (PR #660 batch X F4)

Marcel (31) Berlin Friedrichshain content marketer @latteandlinen, 6 months thMenu affiliate, 3 active promo codes, 840 EUR earned. Tuesday morning 10:42 affiliate dashboard flipped active->suspended->banned in 30 seconds. Audit log: 443ms apart two super-admins PATCHed. Anja 10:42:18.124 active->suspended (cautious "hold for forensic review"), Thomas 10:42:18.567 active->banned (aggressive bot-detection call). Both SELECTed active, both succeeded. Last-writer-wins: Thomas banned. Thomas PATCH cascaded Stripe coupon disable + anonymize_affiliate RPC. Audit log has both entries; Anja s suspended intent silently overwritten with no record of which step invalidated it. **PR #660 batch X F4** two-layer fix (Supabase context): (1) no-op short-circuit — same-status PATCH returns ok+noop, no audit-log noise. (2) OCC race guard — Supabase UPDATE chain adds .eq("status", before.status); .select("id") 0-row detection returns 409 status_changed. Pattern: internal admin tooling state-changing PATCH endpoints MUST carry OCC race guard; shift overlaps + parallel queue walks + urgent-action collisions are inevitable; side effects only fire AFTER UPDATE confirmed.

Related articles