[JacobStephens2]

Summary

Adds section 11 to docs/research/eval-sandboxes.md: #1009's checks with the real logins, on the thirdshift host. Closes #1009.

 ## 10. Live checks, 2026-10-21      (fake credentials)
+## 11. Live checks with the real logins, 2026-10-23
+   Logins inside bwrap        all six answer; Claude with only its setup token
+   Hosts with real logins     the inputs to #1013's allowlist
+   agy's web search           can't be turned off: deny rules and `strict` don't stop `search_web`
+   A Trial's memory           session 55-252 MiB, build 1.5 GiB; CPU, not memory, runs short
+   systemd-run --user         works; sample `anon`, since `--wait --collect` reports 0B

What #1012 has to handle:

• Grok saves its login by rename, which a single-file bind refuses.
• OpenCode 2.0.24 keeps its key in opencode.db, beside its sessions, and no longer has OPENCODE_AUTH_CONTENT.
• Codex needs the folder around its binary, not the binary alone.

Evidence

• Before: §10 left four questions open for a session with the real logins.
  After: All four are answered for all six Harnesses. Codex's refresh is still to be seen, since none was due.
• scripts/affected-tests main: 498 of 2395 tests ran before one failed, a_stalled_receiver_cannot_delay_a_session_by_its_span_count, at a load average near 20. Run alone, it passed in 6.6 s. This change touches only Markdown.

Merge Danger

Door: two-way

Blast Radius: none

A research note only, with no code or behavior changes.