refresh token rotation in CareCompanion requires reuse detection at /v1/auth/refresh. concurrent tabs or retries present spent tokens at the auth boundary past JWT_REFRESH_REUSE_GRACE_SECONDS. deriving next JTI via HMAC and revoking the fam claim writes a refresh_token_reuse audit row.

Rotating refresh tokens without reuse detection leaves downstream API keys exposed when a compromised token keeps minting sessions. refresh tokens are marked spent with a short grace period for network retries, but presenting a spent token after grace revokes the entire token family and logs a refresh_token_reuse audit row. deriving replacement JTIs directly from parent tokens blocks concurrent token tree forks. deriving child JTIs directly from the parent and revoking the entire token family on replay locks down downstream API keys at the auth boundary.