Fixed: ordinary parallel writes no longer sign you out. A refresh's result was thrown away the moment nobody was waiting on it, so requests still carrying the pre-refresh cookie went back and spent a refresh token that had already been used — which an authorization server reads as a stolen token, and answers by ending the whole session.