Three JWT bugs that ship to prod silently — and the 5-line CI test that catches them

Your auth tests pass. Your token verification works. Then your identity provider rotates a key at 02:47, your service hasn't refreshed its JWKS cache for 12 hours, and 8 minutes of production traffic hits 401. Or worse: the rotation does happen, your cache picks up the new keys, but a service you haven't touched in six months is still pinning the old kid . Now half your fleet validates and half rejects, your error budget bleeds, and the only signal in your dashboard is "auth failures up." This i