Revoke every refresh token in the requested token's family.

Returns the affected records so the caller can also revoke their paired access credentials through its separately configured store. Remote implementations must serialize this operation with rotate() for the same family: durably mark the family revoked and revoke current members in one operation, while rotate() atomically rejects a marked family. A rotation ordered before this operation must have its successor included; one ordered after it must not persist a successor.