The logout that Back undid
The account page is sent with Cache-Control: no-store, which is how most people believe an authenticated page is kept out of the browser's instant back/forward restore.
A user logged out and pressed Back. The page came back fully rendered, scrolled where they left it, with their data on screen. The logout had cleared a token the browser has no opinion about, and the browser's eviction rule watches something else entirely.
Outside every boundary: Logout (clears the app's token; FAILED: invisible to it), Account page (sent with no-store; FAILED: restored anyway), Back/forward cache (holds it fully rendered), Back button, an empty slot for the what the logout must change Connections: Account page calls Back/forward cache — kept on leaving (step 1) Logout calls what the logout must change — the logout response (step 2) what the logout must change controls Back/forward cache — evicts it (step 3) Back/forward cache must NOT reach Back button — nothing to restore