The five concurrent 401s example is the right way to explain shared refresh. With rotating refresh tokens, the second parallel /auth/refresh call can invalidate the first one's new token and log the user out for no visible reason. The 401 vs 403 table is useful too. Refreshing on a 403 is a common bug that turns a permissions problem into an endless refresh loop.