- Shipped
- August 10, 2026 at 6:44 PM UTC
- Author
- Kamo
- Commit
- e47eae4
The expiration on the Redis record IS the session; when it lapses the member is signed out. This service holds its own copy of KSessionService against that SHARED key and renewed it on every read, which alone kept sessions alive forever no matter what the other services decided — five services each did this, so fixing them one at a time never moved the symptom. getSession is now a pure read. Renewal belongs to exactly one place: the client activity tracker calling SecurityService session extend on real interaction. The X-Kamo-Idle-Ms plumbing is deleted with it — it existed only to decide when to renew here. SessionTtlWriteRatchetTest fails the build if anything writes a session TTL in this service again.