Build a useful investigation brief
Create token lifecycle fixtures
Build synthetic cases for a valid token, an expired token with successful refresh, an expired token with rejected refresh, and a request that timed out after dispatch. Label expected operation identity and safe outcome. Never place a real credential or refresh token in the fixture.
Trace cache and request state
Record token issue and expiry labels, receiver time, refresh response class, replacement storage, and the authorization state on every original attempt. Compare the same operation identifier across retries. Look for a token that was issued but never committed or a stale value read after commit.
Challenge timing explanations
Vary one clock, cache, refresh, or network condition at a time. Compare a failure before dispatch with one after remote completion is possible. If the same symptom fits both clock skew and revoked refresh state, name the missing observation and avoid changing tolerance blindly.
What to carry forward
The investigation is ready when lifecycle fixtures show the first divergence between expiry detection, refresh, storage, and operation retry. Deliver a narrow fix or evidence request. Keep remote completion, clock state, and credential revocation explicitly unknown when the local trace cannot establish them.
Technical background: RFC Editor reference.
Keep the decision with the work.
Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.
Create an account See the product workflow