Hunt for race conditions

Anything async, concurrent, or touching shared state.

Find the concurrency problems in this code.

Consider:
- Two calls arriving simultaneously
- A call arriving while a previous one is mid-flight
- Check-then-act sequences where state changes between the check and the act
- Shared mutable state without synchronisation
- Operations assumed atomic that aren't
- Cleanup that runs while work is still in progress
- Ordering assumptions that only hold by luck

For each: the exact interleaving that breaks it, written as a timeline of two actors. Then the fix.

Code:

Reviewing a change. Passes you run over a diff before it merges: correctness, security, concurrency, migrations.