docs: reorder & testing

integration/admin_user_sanction_test.go

@@ -70,7 +70,11 @@ func TestAdminUserSanctionPermanentBlock(t *testing.T) {
 	if lastErr == nil {
 		t.Fatalf("authenticated call succeeded after permanent_block")
 	}
-	if !testenv.IsUnauthenticated(lastErr) {
+	// Gateway maps a revoked session to FailedPrecondition ("device
+	// session is revoked"); a session that vanished from the cache
+	// before the call lands as Unauthenticated. Either is a correct
+	// rejection.
+	if !testenv.IsFailedPrecondition(lastErr) && !testenv.IsUnauthenticated(lastErr) {
 		t.Fatalf("post-sanction status: %v", lastErr)
 	}