The courier was already on the road

Booking a courier from the back office is one button and, underneath it, three steps. We ask the courier partner for a driver. They say yes and a real person sets off. Then we write two things down: the courier's reference on the order, and the moment the booking happened.

The first step is the one that costs money and cannot be taken back. The next two are our own database. We had wrapped the fourth step, the audit log, with a note saying a missing log row must never fail a booking. We had not wrapped the two in between it and the partner's yes.

What a failed write looked like from the office

If the database refused either of those writes, the route answered with an error. The office saw "it did not work". The obvious thing to do with a button that did not work is press it again, and pressing it again books a second real, paid courier for the same order. Nothing on screen said the first one was already driving.

The fix is to keep the true statement at the front. The route now still answers with the courier's reference, because that is what happened, and adds a warning that says in words: do not book again. The failure is logged against the order so two orders cannot share one entry.

The test we wrote first was worthless

Our first test for this stopped at "the courier partner is not set up" after a single read. It never reached the booking call, so its assertion that the route did not fail passed through a branch where nothing could fail. A test that cannot reach the fault is not a test of the fault. It moved into the suite that already seeds credentials and fakes the partner, with a control proving the write was genuinely attempted.

Nobody can press this button today, because the screen that would call it has not been built yet. That is exactly why it was worth fixing now. A bug you fix before the first person meets it is the cheapest bug there is.