Yeah, the session-as-lease thing with versioning actually solves a real concurrency bug that most teams never track down because they don't think to version their session state in the first place. The cookie rotation flexibility is legit better than stateless tokens since you're not locked into assumptions about TTL upfront. What would make this stronger is actual retry logic like exponential backoff caps and dedup thresholds when stuff explodes, what happens when your vault goes down, and being clearer that this is really a session-based pattern, not a token one. The audit by drawing the credential path thing is solid guidance, though automated redaction in logs would be a separate implementation detail. The antipatterns are well-spotted and the versioning approach is worth using either way