Refresh sessions without renaming the cookie.
Two tracks. Auth touches three modules. Ada takes token refresh.
Session store and the cookie helper are the hidden dependencies.
Tests first on track A. I will not rename the cookie.
Track B is blocked until the old cookie name survives one release.
Ship the alias, keep the old cookie name.