---
'@pdsjs/core': patch
---

A refresh token just rotated answers a replay with its replacement until that
replacement is used, instead of refusing it. Browser apps lose the reply to a
refresh whenever a page reloads, a link is followed or a laptop sleeps with
the refresh in flight, then come back with the old token and were signed out.
The tokens are DPoP-bound, so answering costs nothing without the session's
key; a session revoked meanwhile stays revoked, and a spent token isn't
listed as a session of its own.