Silent token refresh bug logged a Bluesky monitoring account out for two days

A developer running an automated job to monitor a Bluesky account for replies discovered that silently consuming an expired token produced results indistinguishable from a quiet inbox, masking the failure entirely. After adding proper error-checking, the developer attempted to fix the expired token by calling the AT Protocol refresh endpoint directly, which appeared to work initially. However, AT Protocol refresh tokens are single-use and rotating, meaning presenting one invalidates it and issues a new pair that must be saved. Because the monitoring job did not write the new token pair back to storage — to avoid corrupting the browser app's session — the browser was left holding an already-consumed token and was signed out the next time it attempted a refresh. The incident highlights a subtle integration risk: refreshing a token owned by another client causes delayed, hard-to-diagnose session revocation, deferred by roughly one access-token lifetime.