Session takeover policy

Decision

Single-session policy with expiration and closure: policy above, enforcement in core.

Outcome

Defined behavior that was absent from legacy.

Published without institution identifiers or exploitable implementation detail, per the portfolio publication rule.