The Go bundle raises packages-token-refused in the module's findings state when the forge answers 401 to a write; the watcher mints afresh on that key's event and clears it (lead's ruling on A3n, map-onto-how-the-mesh-is-built: nothing waits on a timer). Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig