Core answer
Start here. This is the direct spoken answer to practice first.
Overview
Validation belongs at the narrowest level that owns all required values, and remote checks need explicit concurrency behavior.
I attach a field rule to one control and a cross-field rule to the group or schema node that owns all participating values. For an asynchronous check, I debounce where appropriate, avoid requests for obviously invalid input, and ensure a response for an old value cannot overwrite the latest state. The server still validates on submission because client validation is not a trust boundary.