Function classify_refresh 

pub fn classify_refresh(
    request: &RefreshRotationRequest,
    session: Option<&RefreshSession>,
) -> RefreshDecision

Classifies authoritative session state without accessing product entities or performing effects.

Same-client stale is allowed only for the previous JTI of this exact account/session, with a nonnegative rotation age inside the explicit window. Older replays remain identifiable by sid; foreign or absent sessions never cause another account’s revocation.