@@ -266,42 +266,82 @@ function createUrlCallbackProvider(URI, callbackRoute) {
  * running on this origin, which can call the same key: the editor therefore loads no third-party
  * extensions (see docs/WEB.md). Where IndexedDB or WebCrypto is unavailable (some private
  * windows), secrets live in memory for the session and the user signs in again after a reload.
+ *
+ * The store belongs to every tab of this origin, as the desktop's keychain belongs to every window,
+ * and the extension relies on that: the refresh token is rotated on use, so a tab that renewed the
+ * session has to be seen by the next tab that does, or that one presents a token that is no longer
+ * good and ends a session the first just renewed. So nothing is cached here: a read is a read of
+ * what is stored now, and a change is read-modify-write of ONE key under a lock shared by the tabs
+ * (the Web Locks API; without it, changes from one tab are still applied one at a time).
  */
 async function createSecretStorage() {
 	const STORE_KEY = 'levelcode-web.secrets.v1';
+	const LOCK = 'levelcode-web.secrets';
 	let key;
 	try { key = await loadOrCreateKey(); } catch (e) { key = undefined; }
 
-	let cache = {};
-	const fromMemoryOnly = !key;
-	if (key) {
+	if (!key) {
+		const memory = new Map();
+		return {
+			type: 'in-memory',
+			async get(k) { return memory.get(k); },
+			async set(k, v) { memory.set(k, v); },
+			async delete(k) { memory.delete(k); },
+			async keys() { return [...memory.keys()]; },
+		};
+	}
+
+	/** Everything stored now. Unreadable (key lost, tampered) is dropped: the user signs in again. */
+	const read = async () => {
+		let sealed = null;
+		try { sealed = localStorage.getItem(STORE_KEY); } catch (e) { return {}; }
+		if (!sealed) { return {}; }
 		try {
-			const sealed = localStorage.getItem(STORE_KEY);
-			if (sealed) { cache = JSON.parse(await unseal(key, sealed)); }
+			const all = JSON.parse(await unseal(key, sealed));
+			return all && typeof all === 'object' ? all : {};
 		} catch (e) {
-			// An unreadable store (key lost, tampered) is dropped; the user signs in again.
 			console.warn('[levelcode-web] the saved session could not be read and was cleared', e);
 			try { localStorage.removeItem(STORE_KEY); } catch (e2) { /* ignore */ }
-			cache = {};
+			return {};
 		}
-	}
+	};
 
-	let writing = Promise.resolve();
-	const persist = () => {
-		if (!key) { return writing; }
-		writing = writing.then(async () => {
-			try { localStorage.setItem(STORE_KEY, await seal(key, JSON.stringify(cache))); }
-			catch (e) { console.error('[levelcode-web] could not persist secrets', e); }
-		});
-		return writing;
+	// One change at a time within this tab, and — where the browser has Web Locks — across tabs.
+	let queue = Promise.resolve();
+	const exclusive = (fn) => {
+		const run = () => (globalThis.navigator && navigator.locks && navigator.locks.request
+			? navigator.locks.request(LOCK, fn)
+			: fn());
+		const next = queue.then(run, run);
+		queue = next.then(() => undefined, () => undefined);
+		return next;
 	};
+	// When the browser refuses the write (storage disabled or full) this tab keeps the session in memory and
+	// the user signs in again after a reload: better than a sign-in that completes and is not there.
+	/** @type {Map<string, string> | null} */
+	let inMemory = null;
+	const change = (mutate) => exclusive(async () => {
+		if (inMemory) {
+			const all = Object.fromEntries(inMemory);
+			mutate(all);
+			inMemory = new Map(Object.entries(all));
+			return;
+		}
+		const all = await read();
+		mutate(all);
+		try { localStorage.setItem(STORE_KEY, await seal(key, JSON.stringify(all))); }
+		catch (e) {
+			console.error('[levelcode-web] could not persist secrets; keeping them for this tab only', e);
+			inMemory = new Map(Object.entries(all));
+		}
+	});
 
 	return {
-		type: fromMemoryOnly ? 'in-memory' : 'persisted',
-		async get(k) { return cache[k]; },
-		async set(k, v) { cache[k] = v; await persist(); },
-		async delete(k) { delete cache[k]; await persist(); },
-		async keys() { return Object.keys(cache); },
+		type: 'persisted',
+		async get(k) { return inMemory ? inMemory.get(k) : (await read())[k]; },
+		async set(k, v) { await change((all) => { all[k] = v; }); },
+		async delete(k) { await change((all) => { delete all[k]; }); },
+		async keys() { return inMemory ? [...inMemory.keys()] : Object.keys(await read()); },
 	};
 }
 
 
@@ -115,9 +115,12 @@ try {
 	await sleep(1500);
 	check('an editor that is not waiting for it leaves it alone', (await orphan.eval(`localStorage.getItem('vscode-web.url-callbacks[7]') !== null`)) === true);
 	const before = exchanges();
+	const callsBefore = accountCalls();
 	await orphan.goto(editorOrigin + '/');
 	await workbenchReady(orphan);
 	await orphan.waitFor(() => exchanges() > before, { ms: 60000, label: 'delivery at start-up' }).catch(() => null);
+	await orphan.waitFor(() => accountCalls() > callsBefore, { ms: 30000, label: 'the second tab\'s account calls' }).catch(() => null);
+	check('a second tab of the editor is signed in from the store the first one wrote, with no sign-in of its own', accountCalls() > callsBefore && stub.state.signIns === 1, `account calls ${callsBefore} -> ${accountCalls()}, sign-ins ${stub.state.signIns}`);
 	check('the next start delivers it to the extension (the stand-in refuses the made-up code; the attempt is the proof)', exchanges() === before + 1, `${before} -> ${exchanges()}`);
 	check('and it is gone from storage', (await orphan.eval(`localStorage.getItem('vscode-web.url-callbacks[7]')`)) === null);
 
 
@@ -8,6 +8,7 @@
  *    leaveForSignIn           the one command the page offers an extension: it must take the tab to the
  *                             account site's /ai/ pages and nowhere else
  *    createUrlCallbackProvider  .drain / .whenListening: what is delivered when the page starts
+ *    createSecretStorage      the session store, shared by every tab of the origin
  *    startReturnFromSignIn    ?signin=1 and the return from a sign-in
  *--------------------------------------------------------------------------------------------*/
 // @ts-check
@@ -19,10 +20,19 @@ const path = require('path');
 
 const SOURCE = fs.readFileSync(path.join(__dirname, '..', '..', 'main.js'), 'utf8');
 
-/** The text of a top-level `function name(...) { ... }` — it ends at the first `}` in column 0. */
+/**
+ * The text of a top-level `function name(...) { ... }` (or `async function`): a one-line function is its
+ * line, any other ends at the first `}` in column 0.
+ */
 function extract(name) {
-	const start = SOURCE.indexOf('\nfunction ' + name + '(');
+	let start = SOURCE.indexOf('\nfunction ' + name + '(');
+	if (start < 0) { start = SOURCE.indexOf('\nasync function ' + name + '('); }
 	assert.ok(start >= 0, 'main.js has no top-level function ' + name);
+	const eol = SOURCE.indexOf('\n', start + 1);
+	const line = SOURCE.slice(start + 1, eol);
+	const opens = (line.match(/\{/g) || []).length;
+	const closes = (line.match(/\}/g) || []).length;
+	if (opens > 0 && opens === closes && line.endsWith('}')) { return line + '\n'; }
 	const end = SOURCE.indexOf('\n}\n', start);
 	assert.ok(end > start, 'could not find the end of ' + name);
 	return SOURCE.slice(start + 1, end + 2);
@@ -197,6 +207,162 @@ const ACCOUNT = 'https://levelcode.example';
 		} finally { t.restore(); }
 	});
 
+	/* ---- the secret store --------------------------------------------------------------------------- */
+	const nodeCrypto = require('crypto');
+	const STORE_KEY = 'levelcode-web.secrets.v1';
+	const SECRET_SOURCE = ['b64', 'unb64', 'seal', 'unseal', 'createSecretStorage'].map(extract).join('\n');
+	const memoryStorage = () => {
+		const m = new Map();
+		return {
+			m,
+			getItem: (k) => (m.has(k) ? m.get(k) : null),
+			setItem: (k, v) => { m.set(k, String(v)); },
+			removeItem: (k) => { m.delete(k); },
+		};
+	};
+	/** A mutex shared by every "tab" that is handed the same one, as Web Locks is. */
+	const sharedLocks = () => {
+		let tail = Promise.resolve();
+		const held = { max: 0, now: 0 };
+		return {
+			held,
+			request: (_name, fn) => {
+				const run = async () => { held.now++; held.max = Math.max(held.max, held.now); try { return await fn(); } finally { held.now--; } };
+				const p = tail.then(run, run);
+				tail = p.then(() => undefined, () => undefined);
+				return p;
+			},
+		};
+	};
+	/** One tab of the editor: its own storage object over the shared localStorage, the shared origin key. */
+	const tab = async ({ storage, key, locks, failKey = false, noKey = false }) => {
+		const logs = { error: [], warn: [] };
+		const factory = new Function('localStorage', 'navigator', 'console', 'loadOrCreateKey', 'crypto', 'TextEncoder', 'TextDecoder', 'btoa', 'atob', 'Uint8Array',
+			SECRET_SOURCE + '\nreturn createSecretStorage;');
+		const create = factory(storage, locks ? { locks } : {}, { warn: (...a) => logs.warn.push(a), error: (...a) => logs.error.push(a) },
+			async () => { if (noKey) { throw new Error('no indexedDB'); } return key; }, nodeCrypto.webcrypto, TextEncoder, TextDecoder, btoa, atob, Uint8Array);
+		return { store: await create(), logs };
+	};
+	const newKey = () => nodeCrypto.webcrypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+
+	await test('secrets: set, get, keys and delete, and they are there after a reload', async () => {
+		const storage = memoryStorage();
+		const key = await newKey();
+		const a = await tab({ storage, key });
+		assert.strictEqual(a.store.type, 'persisted');
+		await a.store.set('access', 'token-AAA');
+		await a.store.set('refresh', 'token-RRR');
+		assert.strictEqual(await a.store.get('access'), 'token-AAA');
+		assert.deepStrictEqual((await a.store.keys()).sort(), ['access', 'refresh']);
+		await a.store.delete('access');
+		assert.strictEqual(await a.store.get('access'), undefined);
+		const reloaded = await tab({ storage, key });
+		assert.strictEqual(await reloaded.store.get('refresh'), 'token-RRR');
+		assert.deepStrictEqual(await reloaded.store.keys(), ['refresh']);
+	});
+	await test('secrets: what is stored is sealed — neither the value nor its base64 is in it', async () => {
+		const storage = memoryStorage();
+		const a = await tab({ storage, key: await newKey() });
+		await a.store.set('refresh', 'a-very-recognisable-secret-value');
+		const blob = storage.getItem(STORE_KEY);
+		assert.ok(blob && blob.length > 20);
+		assert.ok(!blob.includes('recognisable') && !blob.includes(Buffer.from('a-very-recognisable-secret-value').toString('base64')));
+	});
+	await test('secrets: another tab\'s change is seen at once — the rotated refresh token is the one a second tab uses', async () => {
+		const storage = memoryStorage();
+		const key = await newKey();
+		const locks = sharedLocks();
+		const first = await tab({ storage, key, locks });
+		await first.store.set('refresh', 'R1');
+		await first.store.set('access', 'A1');
+		const second = await tab({ storage, key, locks });                 // started while R1 was current
+		assert.strictEqual(await second.store.get('refresh'), 'R1');
+		await first.store.set('refresh', 'R2');                            // the first tab renews the session
+		await first.store.set('access', 'A2');
+		assert.strictEqual(await second.store.get('refresh'), 'R2', 'a second tab must not present the refresh token that was rotated away');
+		assert.strictEqual(await second.store.get('access'), 'A2');
+	});
+	await test('secrets: a change is one key — a tab does not write back what it saw at start-up', async () => {
+		const storage = memoryStorage();
+		const key = await newKey();
+		const locks = sharedLocks();
+		const first = await tab({ storage, key, locks });
+		await first.store.set('access', 'A1');
+		const second = await tab({ storage, key, locks });
+		await first.store.set('refresh', 'R2');                            // after the second tab started
+		await second.store.set('verifier', 'V');                           // an unrelated change in the second tab
+		assert.strictEqual(await first.store.get('refresh'), 'R2', 'the second tab\'s write did not undo the first\'s');
+		assert.strictEqual(await first.store.get('verifier'), 'V');
+		await second.store.delete('access');                               // the second tab signs out of the access token
+		assert.strictEqual(await first.store.get('refresh'), 'R2');
+		assert.strictEqual(await first.store.get('access'), undefined);
+	});
+	await test('secrets: changes made at the same moment in two tabs all land, one at a time', async () => {
+		const storage = memoryStorage();
+		const key = await newKey();
+		const locks = sharedLocks();
+		const a = await tab({ storage, key, locks });
+		const b = await tab({ storage, key, locks });
+		const work = [];
+		for (let i = 0; i < 12; i++) {
+			work.push(a.store.set('a' + i, 'x' + i));
+			work.push(b.store.set('b' + i, 'y' + i));
+		}
+		await Promise.all(work);
+		const keys = await a.store.keys();
+		assert.strictEqual(keys.length, 24, 'lost: ' + [...Array(12).keys()].flatMap((i) => ['a' + i, 'b' + i]).filter((k) => !keys.includes(k)).join(','));
+		assert.strictEqual(locks.held.max, 1, 'never two changes inside the lock at once');
+	});
+	await test('secrets: with no Web Locks a tab still applies its own changes one at a time', async () => {
+		const storage = memoryStorage();
+		const a = await tab({ storage, key: await newKey() });
+		await Promise.all([...Array(10).keys()].map((i) => a.store.set('k' + i, 'v' + i)));
+		assert.strictEqual((await a.store.keys()).length, 10);
+	});
+	await test('secrets: a store that cannot be read is dropped, with a warning, and the tab carries on', async () => {
+		const storage = memoryStorage();
+		storage.setItem(STORE_KEY, 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');
+		const a = await tab({ storage, key: await newKey() });
+		assert.strictEqual(await a.store.get('refresh'), undefined);
+		assert.strictEqual(storage.getItem(STORE_KEY), null);
+		assert.strictEqual(a.logs.warn.length >= 1, true);
+		await a.store.set('refresh', 'R');
+		assert.strictEqual(await a.store.get('refresh'), 'R');
+	});
+	await test('secrets: a key from another browser profile cannot read it — that is a sign-in again, not an error', async () => {
+		const storage = memoryStorage();
+		const mine = await tab({ storage, key: await newKey() });
+		await mine.store.set('refresh', 'R');
+		const other = await tab({ storage, key: await newKey() });
+		assert.strictEqual(await other.store.get('refresh'), undefined);
+	});
+	await test('secrets: where there is no key the store is in memory, writes nothing, and works for the session', async () => {
+		const storage = memoryStorage();
+		const a = await tab({ storage, key: null, noKey: true });
+		assert.strictEqual(a.store.type, 'in-memory');
+		await a.store.set('access', 'A');
+		assert.strictEqual(await a.store.get('access'), 'A');
+		assert.deepStrictEqual(await a.store.keys(), ['access']);
+		await a.store.delete('access');
+		assert.strictEqual(await a.store.get('access'), undefined);
+		assert.strictEqual(storage.m.size, 0, 'nothing was written to localStorage');
+	});
+	await test('secrets: when the browser refuses the write the session is kept for this tab, not lost', async () => {
+		const storage = memoryStorage();
+		const key = await newKey();
+		const a = await tab({ storage, key });
+		await a.store.set('refresh', 'R1');
+		const realSet = storage.setItem;
+		storage.setItem = () => { throw new Error('QuotaExceededError'); };
+		await a.store.set('access', 'A1');                                 // refused: kept in memory, with R1 carried over
+		storage.setItem = realSet;
+		assert.strictEqual(await a.store.get('access'), 'A1');
+		assert.strictEqual(await a.store.get('refresh'), 'R1');
+		await a.store.set('refresh', 'R2');
+		assert.strictEqual(await a.store.get('refresh'), 'R2');
+		assert.ok(a.logs.error.length >= 1, 'said so');
+	});
+
 	/* ---- startReturnFromSignIn --------------------------------------------------------------------- */
 	function makeStart(href, { drained = 0, listening = true, sessionThrows = false } = {}) {
 		const calls = { replaced: [], drain: [], fired: [], removed: [] };