AIKIDO-2026-10390

TL;DR

The gift card apply service computes the redeemable amount from gift_card.amount_remaining and order.total then creates store credits without holding a lock that covers both the gift card and the order. Under concurrent requests (e.g. the same gift card applied to multiple orders at once), the check and the credit creation can interleave so that the total store credits created exceed the gift card value, allowing overspend. The fix wraps the read and the store credit creation in order.with_lock and acquires gift_card.lock! inside it so the critical section is serialized.