diff --git a/.planning/todos/pending/2026-10-22-user-logout-cookie-stays-valid.md b/.planning/todos/pending/2026-10-22-user-logout-cookie-stays-valid.md
new file mode 100644
index 00000000..54c25abe
--- /dev/null
+++ b/.planning/todos/pending/2026-10-22-user-logout-cookie-stays-valid.md
@@ -0,0 +1,33 @@
+---
+created: 2026-10-22T03:30:00.000Z
+title: User plugin logout leaves the session cookie valid for up to 60 minutes
+area: user-plugin
+severity: major
+g15office: pending
+files:
+  - ../sm-user-plugin (mounted at plugins/golem15/user in the apps)
+  - controllers/api_controller.go
+  - classes/session_user.go
+  - routes.go
+---
+
+## Problem
+
+Reported by the user: after logout the auth cookie is not invalidated at once; requests keep
+authenticating until the token expires about 60 minutes later. If true, a logout on a shared
+machine does not end the session, and a stolen cookie survives the victim's logout.
+
+## To check
+
+- What logout does: clear the cookie only, or also revoke the server-side session / refresh
+  token, and whether the access JWT is checked against a revocation list (bouncer) or only by
+  signature and `exp`.
+- Whether the 60 minutes is the access-token TTL.
+- Parity with the PHP (WinterCMS) user plugin's logout behaviour; the frontend contract stays.
+
+## Fix direction
+
+Logout revokes the server-side session so the access token is refused on the next request
+(same mechanism c3712dc uses for deactivate/ban), clears the cookies with matching
+attributes, and a test pins "request after logout is 401". No breaking change to the plugin
+API (core plugin, many projects).