PR #24881 runtime verification, 2026-10-30, Linux Boat VM
Main: 32ecd71726 (github/main). PR: 545874cc49d61f32f773ef5c311e91e1b094c95a.
Separate fresh data directories. One dev server at a time.
Playwright from repo dependencies; /usr/bin/google-chrome.
Project /home/user/revocation-project created through web Add project > Local folder.
Codex gpt-6.1-sol selected in composer. No mocks, seeded database or demo provider.

MAIN
$ node apps/server/src/bin.ts auth session revoke <target-session-id> --base-dir .t3
Revoked session <target-session-id>.
After three seconds: target RPC WebSocket still open; observer still lists 2 clients.
Revoked browser submitted a further real Codex turn in the same thread.
Received: MAIN_REVOKED_CLIENT_STILL_WORKS

PR HEAD
Same baseline prompt and response: REVOCATION_BASELINE_OK.
$ node apps/server/src/bin.ts auth session revoke <target-session-id> --base-dir .t3
Revoked session <target-session-id>.
Target RPC WebSocket closes. Reconnect is rejected. /api/auth/session => authenticated:false.
Observer drops from 2 clients to 1 without reload.
Unrelated observer sends another Codex turn and receives UNRELATED_CLIENT_STILL_WORKS.

NETWORK FAILURE AND RETRY
CLI alone runs inside a separate Linux network namespace; real server remains running.
$ sudo -n unshare --net -- runuser -u user -- node apps/server/src/bin.ts auth session revoke <retry-id> --base-dir /home/user/t3code/.t3
Could not reach the T3 Code server at http://127.0.0.1:13773. Connections already open with this session stay open until they close.
Revoked session <retry-id>.
Target RPC WebSocket still open; fresh HTTP authentication already fails.
$ node apps/server/src/bin.ts auth session revoke <retry-id> --base-dir .t3
No active session found for <retry-id>.
Target RPC WebSocket now closes. Observer stays authenticated and lists 1 client.

UNKNOWN SESSION
$ node apps/server/src/bin.ts auth session revoke 00000000-0000-4000-8000-000000000000 --base-dir .t3
No active session found for 00000000-0000-4000-8000-000000000000.
Observer remains authenticated. Final CLI list: 1 active session, 0 active t3 auth cli helpers.

CHECKS
Blacksmith: vp i; vp test run apps/server/src/cli/pair.test.ts -t "auth session revoke"
3 passed, 20 filtered out. CI at exact PR head: 29 successful, 0 failing, 0 pending.
No code changes or pushes needed.

Not verified: Electron, native iOS/Android, macOS/Windows, remote/relay/tunnel access.