R-35: an ended session cannot return after a failed save (password fingerprint in the file; a failed revoking save removes it) — security review

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/auth.go

@@ -240,7 +240,7 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 	if cookie, err := r.Cookie(sessionCookieName); err == nil {
 		s.sessionsMu.Lock()
 		delete(s.sessions, sessionFingerprint(cookie.Value))
-		_ = s.saveSessionsLocked() // R-35: a signed-out cookie stays signed out across a restart
+		s.saveSessionsRevokingLocked() // R-35: a signed-out cookie stays signed out across a restart
 		s.sessionsMu.Unlock()
 	}
 	s.logger.Printf("[INFO] [web] User logged out from %s", r.RemoteAddr)
@@ -299,7 +299,7 @@ func (s *Server) invalidateAllSessions() {
 	s.sessionsMu.Lock()
 	count := len(s.sessions)
 	s.sessions = make(map[string]*session)
-	_ = s.saveSessionsLocked() // R-35: the password change ends every session on disk too
+	s.saveSessionsRevokingLocked() // R-35: the password change ends every session on disk too
 	s.sessionsMu.Unlock()
 	s.logger.Printf("[INFO] [web] All sessions invalidated (cleared %d)", count)
 }