From the logic audit:
- consent rejects sid-less bearers and requires a LIVE hub session
(sessionAlive) before minting codes — a logged-out bearer can no longer
mint downstream tokens inside its TTL
- refresh rotation race closed: consume returns whether THIS call won;
the loser revokes the family (reuse detection now holds under
concurrency)
- error redirects carry iss (RFC 9207) on error responses too
- logout awaits the revocation and no longer returns ok for missing or
forged bearers
createPublishingCredentialAccessor is execution-fenced (Temporal contexts
only) — the API-process amplify route threw EXECUTION_CREDENTIAL_FENCE.
Use the established PgConnectionStore+vault accessor instead (same trust
level as the archive amplify route's bot-token path).
