The deployment atgc is actually used in, and the one case with nothing behind it: several agents in several worktrees sharing one account and one $HOME, all acting at once. A refresh token is single-use and rotates, so two processes that both read the session, both find it expired and both present the same token get one success and one `invalid_grant` -- which jacquard classifies permanent and deletes the session over, logging the account out from a command that reported success. The mock now rotates refresh tokens and refuses a spent one, so a double spend is detectable rather than invisible. Without the refresh lock the test reproduces the incident exactly: "session refresh failed permanently". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Change-Id: Iceea5a5108f49b75c0169e073b6f054e73accff4