diff --git a/auth-migration/src/main/java/com/example/auth/security/TokenBlacklistService.java b/auth-migration/src/main/java/com/example/auth/security/TokenBlacklistService.java
new file mode 100644
index 0000000..a191089
--- /dev/null
+++ b/auth-migration/src/main/java/com/example/auth/security/TokenBlacklistService.java
@@ -0,0 +1,29 @@
+package com.example.auth.security;
+
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * Token Blacklist Service - preserves AUTH-012 invariant.
+ * Logout immediately invalidates token.
+ */
+@Service
+public class TokenBlacklistService {
+
+    private final ConcurrentHashMap<String, Instant> blacklist = new ConcurrentHashMap<>();
+
+    public void blacklist(String token) {
+        blacklist.put(token, Instant.now());
+    }
+
+    public boolean isBlacklisted(String token) {
+        return blacklist.containsKey(token);
+    }
+
+    public void cleanupExpired() {
+        Instant cutoff = Instant.now().minusSeconds(7 * 24 * 60 * 60);
+        blacklist.entrySet().removeIf(entry -> entry.getValue().isBefore(cutoff));
+    }
+}