Spec checkout that makes one PaymentIntent per order

Your store's backend is Java with Spring Boot, and payments go through Stripe PaymentIntents. The browser asks your server to start payment, gets a client secret back and confirms the card with Stripe.js. A separate webhook handler, already built, records each successful payment. An agent will build the endpoint that starts payment.

Last month a customer double-clicked Pay and saw 2 pending charges on their card. Another order was paid at an old price after the cart changed in a second tab.

Write the spec you would hand the agent.

What you know:

• orders(id, user_id, status, amount_cents, currency, payment_intent_id)
• the cart can change until payment succeeds
• the Stripe Java library sends an idempotency key through RequestOptions
• a call to Stripe can time out after Stripe has already created the object

Then, in a few sentences: what does "create a PaymentIntent and return the secret" get wrong?