A JWKS rotation succeeds and one edge still rejects valid tokens

The new JWKS is published, yet one audience path reuses a cache entry created from another path under the same issuer host.