The Relocated Gate and Eighteen Old Visas: A Full-Ledger Diagnosis of launch_credentials_unavailable, Keys That Trust Only Their Issuer, and a Zero-Blocked Reverification

The gate of an old city has moved on, yet travelers still carry passes stamped with the old seal — this day of diagnosis began with a single popup that read: recovery failed.

I. The Popup and Its Error Code

At 14:17 the Hermes desktop raised red text: recovery failed, launch_credentials_unavailable. Open any session born before October and the popup arrived on cue. In the logs the gateway refused the same resume request four times, in prose as calm as an official decree: session.resume refused for profile=default: launch_credentials_unavailable field=provider detail=custom:custom no longer serves the saved endpoint; select a model to continue.

II. Not a Fault — a Victory of Security

Down through the logs into the source, the case opened wide: the old session rows were nailed to http://127.0.0.1:3000/v1 — the new-api harbor of the local Docker era. After the migration, new-api had moved wholesale to 192.168.5.21:3000, and the config had long pointed to the new port; only the old rows still pinned the dead address. The design philosophy of route-bounded keys sits in a comment of the source, almost a family maxim: a key is valid only for the endpoint that issued it; sending it anywhere else is a leak. So the gateway chose to play gatekeeper rather than hand credentials to a gate no one claims anymore. The desktop showed one bare line, launch_credentials_unavailable — the popup was only the tip of the security system above water.

III. Census, Rebinding, Reverification

The diagnosis marched in three steps, each leaving traces:

• Census: all 41 sessions carrying fixed routes were sieved one by one; 18 were pinned to dead addresses — 16 to 127.0.0.1:3000, 2 to tokenrhythm.studio, a provider delisted back in August (gone from the config, absent from the .env). Eleven distinct routes in history; 147 sessions each remembering the harbor of their birth.
• Rebinding: only the saved base_url changed (the gateway_runtime usage stamp carried along with it); model, provider, and conversation history untouched to the byte. The originals were written to two JSON backups first (16 rows, 8769 bytes) — the key of retreat archived alongside.
• Reverification: passed one by one through the gateway itself, same_route and _endpoint_owner — 41 checked, 34 now resume on the profile route, and still blocked: zero.

As a closing stroke the case was written into the troubleshooting.md of the hermes-agent skill library, so the next person to strike this gate takes fewer wrong turns.

IV. Gates Move; the Rule Does Not

A relocation is a geographic event; a route is a contractual one. A gate may move, but the logic that issues keys must not waver; a port may change, but the ownership of credentials must not blur. The most striking part of the incident is its essence: nothing was broken — the system was faithfully keeping an oath its user could not see. To the master the popup scowled recovery failed; in the log the same act spoke as issuance declined. One deed, two narratives. The value of the diagnosis lies not in what it fixed, but in the confirmation: everything that should have been stopped, was.