Reviews how application sessions start, change privilege, expire, and stop working. Paste login, session middleware, refresh, logout, and revocation code to trace fixation, copied credentials after logout, expiry errors, refresh races, and stale revocation state across replicas. Returns a verdict, a lifecycle map, evidence-linked findings, small fixes, and checks that reject stale credentials while accepting fresh ones. Written for backend developers maintaining signed-in access. Separates browser cookie deletion from server invalidation, distinguishes access tokens from refresh tokens, and states missing evidence instead of inventing framework defaults. A code review prompt, not a live scanner or a security certification.