fix(design): bound requests and prevent mutation replay

tests/unit/works-square-session.test.ts

@@ -284,6 +284,53 @@ describe('works-square-session service', () => {
     expect(fetchImpl).toHaveBeenCalledOnce();
   });
 
+  it('expires a stuck shared refresh and permits the next refresh attempt', async () => {
+    let requestSignal: AbortSignal | null = null;
+    const fetchImpl = vi.fn<typeof fetch>((_input, init) => {
+      requestSignal = init?.signal ?? null;
+      return new Promise<Response>(() => undefined);
+    });
+    storeWorksSquareSession({
+      accessToken: 'old-access-token',
+      refreshToken: 'old-refresh-token',
+      expiresAt: Date.now() + 10_000,
+    });
+
+    const first = getValidWorksSquareAccessToken({ fetchImpl, requestTimeoutMs: 25 });
+    const second = getValidWorksSquareAccessToken({ fetchImpl, requestTimeoutMs: 25 });
+    const outcomes = Promise.allSettled([first, second]);
+    await vi.advanceTimersByTimeAsync(25);
+
+    await expect(Promise.race([
+      outcomes,
+      Promise.resolve('pending'),
+    ])).resolves.toEqual([
+      expect.objectContaining({
+        status: 'rejected',
+        reason: expect.objectContaining({ name: 'RequestDeadlineExceededError' }),
+      }),
+      expect.objectContaining({
+        status: 'rejected',
+        reason: expect.objectContaining({ name: 'RequestDeadlineExceededError' }),
+      }),
+    ]);
+    expect(requestSignal?.aborted).toBe(true);
+    expect(fetchImpl).toHaveBeenCalledOnce();
+
+    fetchImpl.mockResolvedValueOnce(new Response(JSON.stringify({
+      access_token: 'new-access-token',
+      refresh_token: 'new-refresh-token',
+      token_type: 'Bearer',
+      expires_in: 3600,
+    }), { status: 200 }));
+
+    await expect(getValidWorksSquareAccessToken({
+      fetchImpl,
+      requestTimeoutMs: 25,
+    })).resolves.toBe('new-access-token');
+    expect(fetchImpl).toHaveBeenCalledTimes(2);
+  });
+
   it('still allows refresh one millisecond before the seven-day boundary', async () => {
     const lastActiveAt = Date.now();
     const nowMs = lastActiveAt + WORKS_SQUARE_SESSION_IDLE_TIMEOUT_MS - 1;