Date: 2026-09-23 Status: Accepted
A revoked refresh token's record is kept so that presenting it again is a replay and not an unknown hash: RFC 6819 §5.2.2.3.
It is kept until its own expires_at, and dropped then.
expires_at
Nothing does this yet.