[Mathieu2301]

Summary

• make concurrent unknown-key callers join the active JWKS refresh before applying the ten-second abuse window
• exercise two independent production verifier caches through key activation, conditional expiry, outage, and recovery
• prove 32 concurrent future-key verifications share one physical fetch
• keep SDK HELLO and scheduled REAUTH on one socket while the signing key changes
• record only bounded, mode-0600 counters and consistency booleans

Validation

• go test -race ./...
• go test -race -tags integration ./...
• go vet ./...
• go vet -tags integration ./...
• shell and Node syntax checks
• full cross-repository platform integration passed twice against V3 259173ca730f0763710b7c99afa163ba26e70bb2 and MiakAPI 967632ccc57df32a1a31cdbd761c7c3515106c4b

The integration observes eight JWKS requests, one origin request at a time, 32 overlapping verifier calls, three conditional 304 responses, one fail-closed 503, two actual relay verifications, one SDK generation, and no reconnect.

Boundary

All controls are integration-build-only or loopback-only and use canonical synthetic data. This does not claim live Cloud KMS rotation, live Firebase certificate behavior, or public-ingress validation.