How would you design token refresh so that a stolen refresh token is detected quickly?

Implement refresh token ROTATION: every time a refresh token is used, issue a brand-new refresh token and invalidate the old one. If an already-used (old) refresh token is ever presented again, treat it as a signal of theft — immediately invalidate the ENTIRE token family (all descendants of that refresh token) and force re-authentication, since a legitimate client would never replay an already-rotated token.