Access stream opening race: real-server evidence

Base: 5f4368165b27a499a61fe5a919eb4680dd72f04a
Head: 04c4314a5ff0c9306507516cfc48fba21dfd70f4

Run vp i in each isolated checkout first.
Apply: python3 instrument.py <base-checkout>
       python3 instrument.py <head-checkout>
Run: node run.mjs <base-checkout> <head-checkout> <new-output-directory>
Ports 14931 and 14932 must be free. The runner owns and stops its server subprocesses.

Both servers receive identical temporary instrumentation in loadAuthAccessSnapshot:
after the real SessionStore-backed listClientSessions returns, hold that result
until the driver has revoked the synthetic session using the real HTTP endpoint.
This deliberately schedules the change inside the vulnerable opening window.
No stores, PubSubs, transports or authentication services are mocked.
The driver consumes the production subscribeAuthAccess RPC over a real WebSocket,
acknowledges chunks, and applies the relevant removal to its snapshot-derived list.
It then opens another real stream to verify authoritative current state.
The later control pairing-link removal proves the original stream remains live.

Evidence is server output, not a unit-test run or a browser demonstration.
terminal.cast is an asciinema v2 recording of the driver's live standard output;
transcript.txt is the same output for reading without a player. Recorded events
are summarized with synthetic labels rather than secret credentials or UUIDs.
Raw server startup logs contain pairing credentials and must never be uploaded.
No provider turns are needed for this authentication-only reproduction.

Limit: this demonstrates the production HTTP/WebSocket behavior under an explicit
scheduling gate. It does not measure natural race frequency or capture Settings UI,
desktop, or mobile behavior without instrumentation.

AI-assisted; verified with the tests and tools listed above.
