Function is_credential_rejected 

fn is_credential_rejected(status: StatusCode) -> bool

Does status mean “this credential is not accepted for this request,” regardless of the specific reason? 401 = expired/invalid token. 403 = the cloud’s agent-binding check rejected it (this credential is bound to a different agent_id than the one it’s being used for). Both mean the SAME thing operationally for a poller CURRENTLY USING A PER-AGENT CREDENTIAL: that credential can’t be used for this agent, so invalidate-and-retry-with-the-shared-token applies identically to either status. Before this, only 401 triggered that recovery path — a 403 fell into the generic non-2xx branch, silently stalling that agent’s WAN delivery for the rest of the poll cycle with no retry and no user-visible error. Once the retry has fallen back to the SHARED token itself, 401 and 403 diverge again — see shared_token_rejection_outcome, which is what actually decides that case, not this function.