Constant MAX_CACHE_TTL 

const MAX_CACHE_TTL: Duration;

Upper bound on cache TTL, independent of the token’s own expiry.

A cache hit skips every authorization check in resolve_oauth_user, so this is the window in which a change that nothing evicts for goes unnoticed. Every mutation this application performs does evict: token revocation (/revoke), refresh-family revocation on reuse, consent withdrawal (authorized_clients), and user deletion — both self-service and the sync_tmc_users batch — all go through code that holds the affected digests.

What remains is only out-of-band SQL, and it cannot be hooked from here:

• a hard DELETE FROM users/oauth_clients, whose ON DELETE CASCADE into oauth_access_tokens holds no digests and runs no Rust;
• oauth_clients changes — bearer_allowed = false, a soft delete, a narrowed scopes — for which no Rust mutator exists at all, so there is no call site to evict from.

For those paths this bound is still the only guard, which is why it is minutes and not an hour: a change made by hand has to take effect without also flushing Redis.