How long after a rotation the token it retired may be presented again.
A refresh whose reply never reached the phone leaves it holding only the
spent token, and its retry would otherwise read as theft and sign it out.
Within this window the spent token replaces its successor, as long as that
successor was never presented, so a family still has one live token and the
holder of the replaced one revokes the family when it presents it. The
window is counted from the first rotation and is not extended by a re-grant.
A rotation keeps the spent record at least until the window ends, so a token
rotated in its last two minutes keeps the whole window.
A time before the rotation is outside it, so a clock set back cannot
stretch it.
The app holds a late reply for up to 60 s, so this leaves room for its retry.
How long after a rotation the token it retired may be presented again.
A refresh whose reply never reached the phone leaves it holding only the spent token, and its retry would otherwise read as theft and sign it out. Within this window the spent token replaces its successor, as long as that successor was never presented, so a family still has one live token and the holder of the replaced one revokes the family when it presents it. The window is counted from the first rotation and is not extended by a re-grant. A rotation keeps the spent record at least until the window ends, so a token rotated in its last two minutes keeps the whole window. A time before the rotation is outside it, so a clock set back cannot stretch it. The app holds a late reply for up to 60 s, so this leaves room for its retry.