Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Reset the lab state
In HTTP Forge replay the reset endpoint as Admin, then GET the state. Remaining must equal one and accepted must be empty.
POST /api/race/resetConfigure the smallest useful burst
Set POST /api/race/coupon as User A. In Race choose exactly two parallel requests, one wave, no retry, and a short timeout.
The run sends two requests only.
Execute and inspect state
Run the burst, then GET /api/race/state. The intentionally vulnerable lab accepts both requests even though only one coupon existed.
accepted contains two entries and remaining is -1.
Save timing evidence
Preserve request start times, durations, both response hashes, and the final state. Reset the lab when finished.
Prove it before moving on.
You produced a two-request reproduction, proved the impossible state, and reset the lab afterward.