Quick experiment you can run in five minutes. Open your Flutter app. Find a screen that fires multiple API calls on load — dashboard, profile, anything that does this: @override void initState () { super . initState (); _loadProfile (); _loadNotifications (); _loadRecentActivity (); _loadUnreadMessages (); } Enter fullscreen mode Exit fullscreen mode Four API calls. Normal stuff. Now expire your access token (manually, or wait it out) and reload. Open your network inspector and count how many times /auth/refresh gets called. If you see 4, you have the race condition I shipped to production once. Twice, actually. Took three failed mitigations before I landed on the lock pattern below.…