Webform submission limit does not work on multiple user submit

Database-Level Locking

// In WebformSubmissionForm.php or similar handler

public function validateForm(array &$form, FormStateInterface $form_state) {
$webform = $this->getWebform();

// Get exclusive lock for this webform
$lock_id = 'webform_submission_limit:' . $webform->id();
if (!$this->lock->acquire($lock_id)) {
$form_state->setErrorByName('', $this->t('Submission processing, please try again.'));
return;
}

try {
// Check submission limit with lock held
if ($webform->hasSubmissionLimit() && $webform->isSubmissionLimitExceeded()) {
$form_state->setErrorByName('', $webform->getSubmissionLimitExceededMessage());
}
}
finally {
$this->lock->release($lock_id);
}
}

Adding a patch (WIP) but have to stop for today.

I'll create a proper MR later and still have to do some testing.

I'm still experiencing more submissions then the set limit in a simulation where 25 users submit the webform around the same time.

At this point I'm thinking a custom handler that would write to the database in the validate might be better.
So only users that would have a record in the database would be validated.
The database would look like:
[webform_id] [submittion_count]

Then in the validate it would lock the database table, get the webform_id submission count. write the webform_id, and add added submission.
Then after the user has submit the webform and drupal handled the submission. release the lock.

Locking did not work. I ended up writing a custom handler that uses a drupal queue to only allow the set amount of people to open the form.

I might make a contrib module for this in the future.
The bug still exist so I leave this issue open for now.

I will put a link to the contrib module here in the future if I made it.

I don't think we can safely add a lock behavior on submissions to the core webform module. Still, a contributed module could implement locking via a handler and the validateForm methods.

@scuba_fly If you have to contribute a solution, please post it here.