Let the watch own startup refreshes and coalesce additional triggers behind one active request. Bound each HTTP request, complete it once, and ignore responses from credentials replaced while a refresh is in flight.