#717 named network tokens during password change — candidate

Optional HTTP revoke_network_tokens=true selects only the caller’s active scope=full network-bound tokens without a bound node, excluding the current token. Default keeps them and lists metadata only. keep_cli_tokens remains independent. Aggregate revoked includes revoked_network; other users, node credentials and existing session rotation stay unchanged. Password update and revocations are transactional.

Dedicated Docker tests run the existing password/CLI-kind contracts and new real HTTP cases on SQLite and PostgreSQL, including cross-network ownership, default compatibility, strict boolean opt-in, no credential disclosure, node scope/binding protection, auth failures, current token handling and an injected DELETE failure rolling back password plus prior session deletes. Four targeted mutations per backend must fail assertions rather than infrastructure. Source candidate is not a public or live release. CI results will be recorded after the exact-tree run.

No production password, credentials or runtime changed. Existing deploy/hub profile, private environment/data/key sources and rollback remain the recovery authority. CLI173 propagation and production Node139 activity remain separate open requirements.

First CI38351164972 passed the SQLite green HTTP suite and owner/scope/strict assertion witnesses, then the atomic mutation setup stopped: its generic transaction anchor matched multiple functions. Scope that anchor to the password-change nextHash block; no production guard or assertion is weakened. Preserve this failed run and require a fresh exact-tree CI before merge.

Final sourceCI38351601576:SQLite24/PG24 normal HTTP regression and8 assertion witnesses PASS; session-token ownership38351601532 and ten required PASS. PR2687/main8c2dcb3a16cbd78581d783e7ae1b2e87b9d82e3b equals the full actual tested merge tree. Formal publication visibility and prepared/live deployment stages are recorded in report-test717-hub136-publication.txt. No local functional suite was substituted for the isolated Docker CI.
