A refresh racing a revoke could mint a pair the revoke had already missed. Both now take one advisory lock per user and app, and the refresh mints the new pair before deleting the old key, inside one transaction. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>