Revoking the vendor's tunnel is a DELETE with a drain budget

The integrator's laptop has held a PULL binding into the benefits-portal container for six weeks: the container's loopback port reaches their on-site test rig over one outbound WebSocket. Their side opened it, so nothing on the agency's network ever accepted an inbound connection. The contract ends Friday.

GET /api/v1/tunnel/tunnels lists the session: peerAddr, protocol, the pull binding on port 5432, active streams. That listing goes in the procurement file as the access record.

DELETE /api/v1/tunnel/sessions/{id}?grace_ms=100. The kit sends GOAWAY on the WebSocket, drains for a hundred milliseconds, and closes. An admin kill skips orphan parking, so the session cannot be resumed.

No VPN account to disable, no firewall rule to hunt for. The vendor's access was a session, and sessions have an id.

Revocation is a DELETE, and the drain budget is a query parameter.