Refresh-token rotation under concurrent replay: 200 scheduled callers

I implemented a single-process token-family state machine and drove 200 scheduled refresh attempts against the same credential. The invariant was simple: one accepted rotation, one successor and explicit handling for every competing replay.

The handler stores SHA-256 digests of high-entropy token bytes and tracks active, consumed, expired, and revoked states. One attempt issued the successor; the others couldn't reuse the same credential. That result is useful for checking my state transitions, but it doesn't prove atomic rotation across independent servers. The code is a reference experiment, not a production identity service.

One local session family begins with a single valid refresh token. The test schedules 200 Promise callbacks, each attempting to rotate the same token.

I ran npm test locally. The source repository is private; the central assertion is included here so the claim is checkable.

The important assertion is simple:

const replies = await Promise.all(
  Array.from({length: 200}, () =>
    Promise.resolve().then(() => service.rotate("alice", token))
  )
);

assert.equal(replies.filter(reply => reply.ok).length, 1);

Five repository tests passed under Node.js 24.21 on macOS. These are reproducible logical outcomes, not evidence of cross-region atomicity or hardened production account recovery.

The code runs within one process. Synchronous consume-and-replace operations are serialized by the JavaScript runtime, so the test is intentionally incapable of reproducing a database-level lost-update race across two independent server processes. Treat its result as an assertion about a local state machine, not a service-level availability or security guarantee.

Real production token families require durable atomic updates, expiration and key lifecycle handling, issuer/audience validation where relevant, explicit theft-detection policy, service-wide revocation, and protected recovery flows. Do not log raw refresh tokens or accept client-reported session state as authorization.

The session state-machine guide covers recovery bypasses that a simple token-rotation function does not address.

Editorial note: I used AI assistance while preparing this reference experiment. I verified the described results with local tests; they do not measure a multi-worker production identity service.