Keep the duplicate-tab case (a cloned sessionStorage token already claimed by a live document mints its own) and the reload case (a released token is reused); the once-per-document lock accounting, explicit rotation and the no-Web-Locks fallback are implementation details of the same module.