{
  "required_positive_paths": [
    "anonymous session active",
    "authentication rotates to a new authenticated handle",
    "authenticated session remains valid until bounded invalidation"
  ],
  "required_negative_paths": [
    "old pre-authentication handle rejected after rotation",
    "logged-out handle rejected server-side",
    "browser-only deletion is not accepted as server invalidation",
    "unjustified cookie-scope expansion detected"
  ],
  "forbidden_conclusions": [
    "HTTPS alone makes any session cookie configuration safe.",
    "SameSite replaces all CSRF defenses in every application.",
    "Deleting a browser cookie always invalidates server-side session authority.",
    "A long random session identifier alone solves rotation, logout and reauthentication policy."
  ],
  "transfer_context": "synthetic admin console requires reauthentication before changing recovery settings"
}