Two tabs refreshing at once both send the old token. Without a grace window, real users get signed out.
session.service.ts · L128–130changed in PR #15
128if (session.revokedAt) {
129 const recent = now - revokedAt < GRACE_MS;
130 if (!recent) await revokeFamily(id);
131}