general experience has shown that purging unused refresh tokens breaks clients/use-cases that rely on being able to use them at arbitrary points in the future. namely something happening in a backend/background process when there's not a user around to go back through the authorize flow.