Good breakdown, the revocation vs statelessness framing is the clearest way I've seen this explained. One thing worth adding on the middleware side, since it's only checking presence not validity for sessions, that means a stolen but not-yet-revoked session cookie sails right through the edge check and only gets caught at the actual session store lookup deeper in the request. Worth being explicit in the writeup that middleware here is a redirect-for-UX layer, not a security boundary, people sometimes read "middleware protects routes" and assume it's doing more than it is.