I’ll split this up. One agent traces how sessions are created, one maps the token refresh, and one checks what changed in auth recently.
Found it. The random sign-outs come from refresh-token rotation, which shipped 6 days ago in 4f2c1a9.
Access tokens only last 15 minutes, so the middleware refreshes often. When two tabs, or two requests from one page, refresh at the same moment, the first one rotates the token and the second arrives with the revoked one. The refresh route answers 401 and the middleware signs the person out.
The fix is a short grace window. Keep the previous refresh token valid for about 30 seconds after it’s rotated, and hand back the token that was already issued if it’s reused in that window. Want me to make that change in lib/auth/refresh.ts?