Token endpoint (authorization_code, refresh_token)

Exchanges a single-use authorization code plus its PKCE code_verifier for an access token, or rotates a refresh token.

Refresh tokens rotate on every use and reuse kills the family. A refresh that was already rotated and shows up again means somebody holds a copy — the legitimate client or the thief, and there is no way to tell — so both are cut off and the user re-consents.

agent:approve does not survive a refresh. It is the one scope that releases escrow without a per-operation signature, it is consented to separately, and it is re-granted only by consenting again.