[Bl0ck154]

Problem

The current token-refresh helper retries the same refresh-token POST up to three times after transport failures. Refresh tokens can rotate on the first successful server-side request. If that response is lost, retrying the old one can yield refresh_token_reused / refresh_token_invalidated and strand an otherwise healthy session.

Fix

• Send each single-use refresh token only once; if the network outcome is uncertain, return the error without replaying the request.
• Never include the raw identity-provider error response in logs or messages. Preserve allowlisted OAuth error codes for diagnosis.
• Add a local TCP regression test that drops the connection and asserts exactly one refresh POST is attempted.

This does not restore already revoked tokens; users must re-authenticate those. The risky retry logic predates the latest fork update and exists in upstream main.

Tested in fork PR #33 (Rust tests, Windows and macOS compilation all passed). Related issue: #223.