revokeFamily is idempotent: aborting the updater on already-revoked
state classifies as "aborted" at the storage layer, which the wrapper
treats as success (the desired end-state is reached). Same for not-found:
the desired end-state (no live family) is already present.
Note (#274): the refresh-grant replay path no longer routes through here —
createRefreshTokenFamilyRotation revokes inside the same compare-and-swap
that detects the replay. This wrapper remains the entry point for
revocations that are NOT a replay classification: admin operations, logout
cascade, and the caller's fail-closed fallback for a custom rotation
implementation that reports replayed without familyRevoked: true.
isFamilyRevoked is read-only via findFamily; returns false if the
family does not exist or the revoked flag is false.
RefreshTokenFamilyRevocation composition.
revokeFamilyis idempotent: aborting the updater on already-revoked state classifies as "aborted" at the storage layer, which the wrapper treats as success (the desired end-state is reached). Same for not-found: the desired end-state (no live family) is already present.Note (#274): the refresh-grant replay path no longer routes through here —
createRefreshTokenFamilyRotationrevokes inside the same compare-and-swap that detects the replay. This wrapper remains the entry point for revocations that are NOT a replay classification: admin operations, logout cascade, and the caller's fail-closed fallback for a custom rotation implementation that reportsreplayedwithoutfamilyRevoked: true.isFamilyRevokedis read-only via findFamily; returns false if the family does not exist or therevokedflag is false.Per A3 §6.2.