diff --git a/cloud/tests/AuthControllerTest.php b/cloud/tests/AuthControllerTest.php
index 9bd6f24..53537e8 100644
--- a/cloud/tests/AuthControllerTest.php
+++ b/cloud/tests/AuthControllerTest.php
@@ -50,4 +50,21 @@ final class AuthControllerTest extends TestCase
         $this->assertSame(200, $res->status());
         $this->assertSame(1, $sess->get('user_id'));
     }
+    public function testUnknownUsernameReturns401GenericBody(): void {
+        $c = new AuthController($this->users(), new InMemoryAuditRepository());
+        $res = $c->login($this->req('nobody', 'whatever'), new ArraySessionStore(), now: 1000);
+        $this->assertSame(401, $res->status());
+        // identical generic body to the wrong-password case (no user-enumeration leak)
+        $wrong = $c->login($this->req('alice', 'nope'), new ArraySessionStore(), now: 1000);
+        $this->assertSame($wrong->body(), $res->body());
+    }
+    public function testLogoutClearsSession(): void {
+        $c = new AuthController($this->users(), new InMemoryAuditRepository());
+        $sess = new ArraySessionStore();
+        $c->login($this->req('alice', 'pw'), $sess, now: 1000);
+        $this->assertSame(1, $sess->get('user_id'));
+        $res = $c->logout($sess);
+        $this->assertSame(200, $res->status());
+        $this->assertNull($sess->get('user_id')); // session identity cleared
+    }
 }