DF gen2 CI-CD : how many refresh tokens are used internally?

Consider a gen2 CI-CD dataflow, and it sends data to a lakehouse ("cloud connection"). I know there are at least two (and possible three) "refresh tokens" that are used internally. Despite the fragile nature of these tokens, Fabric doesn't expose them clearly nor share much documentation about their behavior. Here are the tokens: First there is the owner token, that is typically assigned to the DF when you click the funky "take over" button on the item in the workspace. Secondly there is a hidden token used to send data to the lakehouse (so-called "cloud connection"). It is managed inside of t