1## ADDED Requirements23### Requirement: Session revocation4Users SHALL be able to list their active sessions and revoke any of them, and a revoked session MUST be rejected on its next request.56#### Scenario: Revoke another device7- **WHEN** a user revokes a session belonging to another device from the Active sessions page8- **THEN** the next request using that session is redirected to the login page910#### Scenario: Session list contents11- **WHEN** a user opens the Active sessions page12- **THEN** each session shows its creation time, last-used time, and user agent13- **AND** the current session is labelled "This device"1415## MODIFIED Requirements1617### Requirement: Session expiry18Sessions SHALL expire after 12 hours without activity and MUST expire no later than 7 days after creation regardless of activity.1920#### Scenario: Idle timeout21- **WHEN** a request arrives with a session last used more than 12 hours ago22- **THEN** the system deletes the session and redirects to the login page2324#### Scenario: Activity extends idle window25- **WHEN** a request arrives with a session last used 11 hours ago26- **THEN** the request succeeds and the session's last-used time is updated2728#### Scenario: Absolute lifetime reached29- **WHEN** a request arrives with a session created more than 7 days ago, even if it was used within the last hour30- **THEN** the system deletes the session and redirects to the login page3132## REMOVED Requirements3334### Requirement: Remember me35**Reason**: Long-lived sessions were flagged as high risk in pentest PT-2026-09 (finding H-2).36**Migration**: None for users; all sessions now follow the standard expiry rules. The `remember_me` column is dropped in the following release.3738## RENAMED Requirements3940- FROM: `### Requirement: Password login`41- TO: `### Requirement: Password authentication`