Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
"authorization" alone matched a tool's own answer mentioning the word — the runtime refusing a state value with an Authorization header read as "this account may not call".