[Mathieu2301]

Summary

• always reverify unknown-key tokens against the key set returned by the shared refresh path
• deterministically prove that 32 concurrent unknown-key callers join one active refresh, including cancellation and shared-failure coverage
• wait for the SDK to process REAUTH_OK and assert a single WebSocket connection in the full platform integration
• restore the version 1 relay metadata shape and derive loopback-only fixture endpoints from canonical public URLs

Validation

• go test -race ./...
• go test -race -tags integration ./...
• go vet ./...
• go vet -tags integration ./...
• node --check test/integration/platform-auth.mjs
• full Home Key to control plane to relay integration (32 concurrent verifications, 8 JWKS requests, 0 reconnects)