No code this time — reason it through, on paper.

1. Choose for your own app. Take an app idea of your own (or your capstone). Decide: JWT or server session? Write the deciding factors in one paragraph — client type, deployment shape, whether "log out everywhere" is a requirement. There is a right answer for your context; make the context explicit.

2. Trace a revocation. For SignFlow, describe exactly what happens, step by step, when a user clicks "log out" — from the DELETE to the next request being anonymous. Then describe what a pure-JWT system would have to do to achieve the same effect, and why it can't do it cleanly.

3. Design the refresh flow. Sketch (in prose or pseudocode) a short-lived-JWT + refresh-token system for Pica: what's in the access token, where the refresh token is stored, what the "refresh" endpoint does, and what "log out this device" deletes. Then name the one thing this design reintroduced that a pure JWT avoided.

4. Find the moved cost. In your refresh-token design, identify precisely where the server-side state lives now and how often it is touched, versus a plain session system. Argue whether the hybrid was worth it for a system at Pica's scale, and for one at SignFlow's.

You have finished the build. One lesson remains: a look back at everything SignFlow is, an honest final word on what its signature is and is not, and where to take your own fork.