sessions: a rejected OAuth session signs the app out, and the password path is retired. A viewer signed in with the password against the PDS could open the live dashboard when the node held credentials for the account (the nodeSession bypass of Sep 23), but the dashboard's own calls to the node, starting and stopping the stream and the multistream targets, take only a node OAuth session, so every one of them answered 401 and the page sat there broken. The network's OAuth works again, so that path goes: --account-credentials and the access status's nodeSession are removed, the dashboard and the phone go-live page ask a bearer session for a node OAuth sign-in as before, and --dev-account-creds stays for development only. Separately, when the node answers a request with "oauth session revoked" or "oauth session not found", or the OAuth client gives up on a refresh, the client's tokens can still look valid and the app stayed signed in while every authenticated call failed; the agent now notices that answer once, drops the session and opens the login modal on the OAuth flow