What
The first-party event sink now refreshes an expired OAuth token once before sending a batch, and refuses to send a federated workload-identity token that was minted for a different host, that follows a recent mint failure still in backoff, or where the identity resolution changed mid-send. No user-visible surface.
Details
- Refreshes are deduplicated by access token and share one in-flight promise across sinks; shutdown waits for it up to a millisecond budget.
- The refresh is skipped for the final flush, shutdown, startup retries, and when the auth gate says otherwise.
- Batch bodies and headers can be rewritten before the POST.
Evidence
workload-identity mint failed recently; not retried yet
Strings lifted out of the shipped bundle, so the claim above can be checked against them.