{
  "model": "Strict one-use refresh rotation with family revocation on replay",
  "scenario_count": 6,
  "scenarios": [
    {
      "case": "duplicate-callers",
      "provider_calls": 2,
      "replay_events": 1,
      "family_revoked": true,
      "stored_token_usable": false,
      "trace": [
        "Two callers read version 0 and family-A:0",
        "Owner exchanges family-A:0 and installs version 1",
        "Second caller exchanges consumed family-A:0; family revoked"
      ]
    },
    {
      "case": "coordinated-callers",
      "provider_calls": 1,
      "replay_events": 0,
      "family_revoked": false,
      "stored_token_usable": true,
      "trace": [
        "Two callers read version 0 and family-A:0",
        "Owner exchanges family-A:0 and installs version 1",
        "Waiter reads the owner's committed result; no second exchange"
      ]
    },
    {
      "case": "late-result-unconditional",
      "provider_calls": 1,
      "replay_events": 0,
      "old_result_installed": true,
      "reconnected_grant_preserved": false,
      "trace": [
        "Old refresh accepted, response delayed",
        "Reconnect stores family-B:0 at version 1",
        "Old response overwrites new grant"
      ]
    },
    {
      "case": "late-result-version-guard",
      "provider_calls": 1,
      "replay_events": 0,
      "old_result_installed": false,
      "reconnected_grant_preserved": true,
      "trace": [
        "Old refresh accepted, response delayed",
        "Reconnect stores family-B:0 at version 1",
        "Old response rejected by version guard"
      ]
    },
    {
      "case": "lost-response-blind-retry",
      "provider_calls": 2,
      "replay_events": 1,
      "family_revoked": true,
      "stored_token_usable": false,
      "client_state": "reauthorization-required",
      "trace": [
        "Exchange accepted: server advances to family-A:1",
        "Response lost: client still stores family-A:0",
        "Blind retry of family-A:0 triggers replay revocation"
      ]
    },
    {
      "case": "lost-response-stop",
      "provider_calls": 1,
      "replay_events": 0,
      "family_revoked": false,
      "stored_token_usable": false,
      "client_state": "uncertain",
      "trace": [
        "Exchange accepted: server advances to family-A:1",
        "Response lost: client still stores family-A:0",
        "No blind retry; connection remains uncertain"
      ]
    }
  ],
  "limits": [
    "Constructed event schedules, not a production incident",
    "No HTTP, actual threads, distributed lock, expiry or cryptography",
    "Provider grace periods and recovery APIs are not simulated",
    "No assertion about access-token revocation at resource servers"
  ]
}