The refresh endpoint required the agent to exist in the in-memory registry. After server restart the registry is empty, so all refresh attempts got 404. The refresh token itself is self-contained with subject, application, and roles — the registry lookup is optional. Now uses application from the JWT, falling back to registry only if the agent happens to be registered. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>