PR #27848 live server verification
main: e5909e53c3 (github/main)
PR: 4cd48eb8cbcf8694f33e0881d4df644d1f0783b9

Real credentials issued through browser pairing -> POST /api/auth/pairing-token -> POST /oauth/token. Tokens/cookies/tickets omitted.
POST /api/auth/websocket-ticket
bearer only: main 200; PR 200
empty primary + bearer: main 401; PR 200
empty primary without bearer: main 401; PR 401
invalid primary + bearer: main 401; PR 401
invalid bearer: main 401; PR 401

Browser primary HttpOnly cookie explicitly replaced with empty value via Playwright cookie API.
Bearer request with empty primary cookie issued a real WebSocket ticket (200).
Real web client opened /ws with that ticket; no cookie session was available.
Client submitted Codex gpt-6.1-sol turn; server persisted completed Codex turn; reply rendered: gpt-6.1-sol empty cookie bearer path verified.
Restored original primary cookie, opened fresh client without bearer headers/ticket override.
GET /api/auth/session: browser-session-cookie. A gpt-6.1-sol followup completed and rendered normal cookie followup verified.

Blacksmith: EnvironmentAuth.test.ts, 20/20 passed.
CI at exact head: 29 successful, 0 failing, 0 pending.
No source changes. No push.