A user double-clicks Submit or the browser retries a request. How would you prevent duplicate records?

In production I would add cleanup for old idempotency records, conflict behavior when the same key is reused with a different payload, and metrics for duplicate attempts. Database constraints remain important because concurrent requests can bypass application memory checks. The UI should show clear pending and retry behavior, not let users spam the endpoint. Support needs enough audit or request metadata to explain whether a duplicate was prevented or a second valid operation happened. I would test concurrent submits at the API level because browser-only checks do not prove the backend is duplicate-safe.