Greptile Summary

This PR extends the gateway's device token rotation handler (device.token.rotate) to disconnect any active sessions that are authenticated with the rotated token immediately after rotation succeeds, rather than waiting for those sockets to close naturally. The change follows the exact same queueMicrotask + optional-chaining pattern already in place for device.pair.remove and device.token.revoke, making the three mutation paths consistent. The implementation is straightforward and low-risk.

Key changes:

• devices.ts: adds a queueMicrotask call to context.disconnectClientsForDevice?.(deviceId.trim(), { role: entry.role }) after a successful rotateDeviceToken, mirroring the revoke and remove patterns.
• devices.test.ts: adds mocks for getPairedDevice and rotateDeviceToken, and a new test asserting that disconnectClientsForDevice is invoked with the trimmed device ID and correct role after successful rotation.
• CHANGELOG.md: records the new behavior.

One minor gap: a failure-path test (rotation denied → disconnectClientsForDevice not called) is absent, while the revoke handler does have this symmetrical test.

Confidence Score: 5/5

• Safe to merge — no logic, security, or data integrity issues introduced.
• The implementation is a one-liner that exactly mirrors two already-reviewed patterns in the same file. The only finding is a P2 suggestion to add a symmetrical failure-path test, which does not affect correctness or merge readiness.
• No files require special attention; the missing failure-path test in devices.test.ts is a nice-to-have, not a blocker.

This is a comment left during a code review.
Path: src/gateway/server-methods/devices.test.ts
Line: 176-191

Comment:
**Missing failure-path test for token rotation**

The PR adds a success-path test for disconnecting clients after rotation, but there is no corresponding test asserting that `disconnectClientsForDevice` is **not** called when rotation fails (e.g. `rotateDeviceToken` returns `{ ok: false }`). The revoke handler has exactly this symmetrical test ("does not disconnect clients when token revocation fails"), so a parallel test for the rotate failure path would keep coverage consistent and guard against future regressions in the early-return branches.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(gateway): revoke active sessions on ..." | Re-trigger Greptile}