Rotating refresh tokens without reuse detection leaves downstream API keys exposed when a compromised token keeps minting sessions. refresh tokens are marked spent with a short grace period for network retries, but presenting a spent token after grace revokes the entire token family and logs a refresh_token_reuse audit row. deriving replacement JTIs directly from parent tokens blocks concurrent token tree forks. deriving child JTIs directly from the parent and revoking the entire token family on replay locks down downstream API keys at the auth boundary.

I love adaptive reuse. At 150 Hayes, they are turning an ugly vacant office building to a beautiful 105-unit residential building (1,2,3 BR's) for ~$350/sf (construction cost) + $225/sf (acquisition cost). The project only pencils because SF waived affordable-housing requirements for office-to-resi conversions. $575/sf (construction + acquisition cost) seems like a pretty good deal for what looks like a nice building. The same guys did a great job on 100 Van Ness.