The payload.sig token string (from a cookie or bearer header).
Live runtime carrying the session secret + current credentials.
Transport the caller presented the token on.
Procedure with the session payload, or failure when invalid/mismatched/stale.
Verifies a raw signed-session token against the live runtime: valid signature, unexpired, minted for the transport it arrived on, and a credential fingerprint that still matches the current password/allow-list — so a rotated credential evicts the token.