Consecutive rejected-session recoveries tolerated before giving up (see recoverSession). One rotation handles a normal expiry; a couple more absorb races with server-side propagation. Beyond that the credential itself is bad.