Sign-out everywhere cutoffs live in apps/gateway/data (the gateway unit's ReadWritePaths; /opt/openvibe.tools/data was unwritable and every delivery answered 500), in a rollback journal so the read-only apps under ProtectSystem=strict can open it

ddiff --git a/apps/_shared/guard/revocations.js b/apps/_shared/guard/revocations.js
iindex fa9269d..b507ba1 100644
---- a/apps/_shared/guard/revocations.js
++++ b/apps/_shared/guard/revocations.js
@@@ -8,7 +8,8 @@
  const fs = require('fs');
  const path = require('path');
  
--const DEFAULT_FILE = path.resolve(__dirname, '..', '..', '..', 'data', 'token-revocations.db');
++// In the gateway's data directory: the one place its unit may write (ReadWritePaths); the other apps only read it.
++const DEFAULT_FILE = path.resolve(__dirname, '..', '..', 'gateway', 'data', 'token-revocations.db');
  
  function revocationsFile(env = process.env) { return env.TOOLS_REVOCATIONS_DB || DEFAULT_FILE; }
  
ddiff --git a/apps/gateway/server/revocation-events.js b/apps/gateway/server/revocation-events.js
iindex 7c1584a..7025be0 100644
---- a/apps/gateway/server/revocation-events.js
++++ b/apps/gateway/server/revocation-events.js
@@@ -20,7 +20,9 @@ function cutoffs() {
      const file = revocationsFile();
      fs.mkdirSync(path.dirname(file), { recursive: true });
      const db = new Database(file);
--    db.pragma('journal_mode = WAL');
++    // A rollback journal, not WAL: the other apps open the file read-only under ProtectSystem=strict and could not
++    // create a WAL's -shm file. Writes are one row per sign-out-everywhere.
++    db.pragma('journal_mode = DELETE');
      db.pragma('busy_timeout = 2000');
      store = require('openvibe-sdk/auth').createRevocationStore(db, { table: 'token_revocations' });
      return store;
ddiff --git a/apps/gateway/test/revocations.test.js b/apps/gateway/test/revocations.test.js
iindex 743818f..5e61fbc 100644
---- a/apps/gateway/test/revocations.test.js
++++ b/apps/gateway/test/revocations.test.js
@@@ -15,7 +15,10 @@ const express = require('express');
  const Database = require('better-sqlite3');
  const { signDeliveryHeaders } = require('openvibe-sdk/events');
  const events = require('../server/revocation-events');
--const { createCutoffReader } = require('../../_shared/guard/revocations');
++const { createCutoffReader, DEFAULT_FILE } = require('../../_shared/guard/revocations');
++
++// The default lives where the gateway's unit may write (ReadWritePaths=apps/gateway/data).
++assert.strictEqual(DEFAULT_FILE, path.resolve(__dirname, '..', 'data', 'token-revocations.db'));
  
  const SUBJECT = 'usr_01J8Z3Q4R5S6T7V8W9X0Y1Z2A3';
  const at = Date.parse('2026-09-25T12:00:00Z');