- A failed refresh resets _initialized inside _handle_refresh_response, so
the 401-path refresh site behaves like the pre-request one: the next
request re-reads storage and can retry a refresh token that is still good
instead of leaving a long-lived headless provider with no tokens.
- A CIMD client_id is portable across authorization servers but its tokens
are not: when the discovered issuer differs from the record's stamp, keep
the record, drop the tokens, and re-stamp before deciding to refresh.
- Tests pinning: rejected 401-path refresh falls back to authorization; a
headless provider retries the refresh on its next connection; a fresh
registration does not present tokens left from a previous client; the
CIMD issuer-change case. Manifest wording for the discovered-endpoint
entry no longer overclaims about the no-metadata fallback.
Max Isbey
ab4032413f