Credential revocation and password change must end live sessions #137

execute_program only re-reads the role (handler.rs:4316). Sessions opened with a revoked API key or an old password keep working for up to 24 h. Record a credential id or password epoch in the session, re-validate it per request, and close sessions on revoke. Scoped (read-only, per-KG) keys go in a follow-up.

Roadmap checkpoint — 2026-10-03

S03 acceptance includes queued/live push fencing, not only fresh requests. Bind sessions to credential identity/password generation; revoke the targeted key without revoking unrelated credentials, and invalidate subscriptions on deletion/password change. Test revocation during evaluation and immediately before send (src/protocol/rest/handlers/ws.rs:645), replay and internal/KG-change notice visibility. Use event-driven invalidation/checkable generation without per-frame disk writes or a new global mutex; pass #163.