Backend Check-Then-Act Races

A check-then-act sequence reads state, decides, and writes later, leaving a window for another request to invalidate the decision.

Why This Matters

Unique creation, stock deduction, quota enforcement, and one-time transitions commonly fail this way.

Working Model

A check-then-act sequence reads state, decides, and writes later, leaving a window for another request to invalidate the decision. Correctness comes from preserving an explicit invariant across every permitted ordering, not from expecting one observed timing.

Practical Rules

  • Express the condition in the write.
  • Use database constraints as final guards.
  • Check affected row counts.
  • Keep transactions short.
  • Map constraint failure to a deliberate domain outcome.

Failure Modes

  • Checking uniqueness only in PHP.
  • Reading a balance and later writing an absolute value.
  • Holding a lock while calling an external API.
  • Retrying every database error blindly.

Verification

  • Run two operations concurrently.
  • Assert one winner and defined loser.
  • Inspect final rows and side effects.
  • Test at the real isolation level.

What You Should Be Able To Do

After this lesson, you should be able to explain check-then-act races and atomic conditional writes, choose a suitable approach for a real PHP project, and verify the result instead of relying on assumptions.

Practice

Practice: Reserve The Last Item

Protect the last inventory unit.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Use an update such as decrement where quantity is at least one, then require one affected row. Create the reservation in the same transaction.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Create A Unique Username

Protect username uniqueness under concurrent requests.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Normalize consistently, enforce a unique database constraint, attempt insertion, and translate the duplicate-key outcome. A prior availability check is advisory only.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Enforce A Quota

Two uploads can exceed a tenant quota.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Coordinate usage and reservation in one transaction with a locked aggregate or conditional update. Finalize or release reservations after storage outcomes.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.