Rotate the refresh cookie. No body in either direction.

Any failure clears all three cookies: a refresh token that did not rotate is dead (expired, revoked, or reused — and a reuse has just revoked the whole sign-in), and leaving it in the jar would only make the next tab try again.