OAuth 2.0 BCP §4.14 reuse detection in practice — race vs theft disambiguation

Standard advice for refresh tokens: rotate on every use, store hashed, set a short expiry. Done, right? Not quite. Rotation alone does nothing against token theft. If malware or XSS lifts a refresh token from a legit client, the attacker and the client race to rotate it next. Whoever loses the rac