The bug is what happens in the transition you forgot to model.
[ trace // field response ]
Every interface is a state machine. The only question is whether the team has drawn it. Skip the drawing and the machine still exists; it is just defined by an accidental web of booleans nobody can fully enumerate.
The bug, when it arrives, is always in the transition nobody named. Loading-but-also-error. Submitted-but-not-yet-acknowledged. Authenticated-but-pending-MFA. These states exist in the wild whether or not the code admits them.
Draw the machine. Name the states. Let the code reflect the diagram. The bug surface contracts immediately.