Function revoke_family_on_refresh_token_reuse 

async fn revoke_family_on_refresh_token_reuse(
    conn: &mut PgConnection,
    cache: &Cache,
    client: &OAuthClient,
    refresh_token: &SecretString,
    token_hmac_key: &SecretString,
) -> Result<(), TokenGrantError>

RFC 9700 §4.14.2: presenting a refresh token that has already been revoked — by a rotation that superseded it, or by /revoke — is evidence the token leaked, so the whole (user, client) family is taken down instead of only this request failing. Without that, an attacker who redeems a stolen token first keeps a self-renewing family alive while the victim silently re-logs-in into a new one.

Runs before the issuance transaction: that transaction is rolled back on error, which would undo the takedown.

A token still valid here that loses a concurrent race to another rotation is deliberately left alone — that is one client refreshing twice, and the winning rotation already turned the family over.