Classic phantom read and race condition scenario. Relying on application-level locks without explicit serializable isolation or atomic update constraints almost always breaks under production traffic.
yeah, the surprising part was seeing both requests succeed even inside transactions. it pushed me to make the database enforce the invariant explicitly, using deterministic event IDs, rather than assume the transaction alone was enough. the concurrent tests were what exposed the gap.