Do not rotate the key.The endpoint accepted authentication and rejected request semantics.
Route by evidence, not the version label.
Use a bounded workaround or upgrade one coherent installation.
Prove the executable and every resolved runtime package before reinstalling.
Preserve the parent and child headers with a minimal read-only reproduction.
Capture the three decisive facts.
Record dsh --version from the exact launch environment.
Record package versions and resolved entry paths, not only a global CLI label.
Compare the parent and child's first request/header events.
If effort is present in the child header, inspect adapter translation instead.
A Settings row is not dispatch evidence.
Desktop, linked workspaces, profiles, and global prefixes can load a different package graph than the CLI you inspected.
Primary evidence.
Preserve the complete reproduction.
The full runbook includes commands, containment choices, privacy boundaries, and fourteen regression gates.
Read the complete runbook