sessions get a home and an eviction rule
The cheapest way to hold a login is a signed token the client carries. It is also the hardest to take back: revocation becomes a blocklist, and a blocklist is a second store with its own lifetime problem. The platform had token plumbing…