Seen 2026-08-25 on chunky-turnip-23 while quest-head-36afcd streamed rupelmonde-castle-viewer over the mesh. Every hydrabody call to the Sunshine API returned HTTP 401 (Sunshine had an empty credentials file AND the bxl1-test-2 district had no provider credentials in the hydracluster config). Blind hydrabody then saw GPU 98 percent with stream status idle, logged '[gpu-mismatch] detected', and the sunshine-api watchdog killed the streamed experience 20 s into every session: '[stream] cleanup: rupelmonde-castle-viewer (action=kill, reason=watchdog: sunshine-api, pid=0)'. The head saw a graceful errorCode=0 termination.
Fixes needed:
- Treat Sunshine API auth failures (401/403) as UNKNOWN stream status, never as idle. The watchdog must not kill anything while its data source is unauthorized or unreachable. Log loudly instead.
- Surface a persistent health warning (body status / hydracluster) when the Sunshine API is unauthorized, so misconfigured credentials are visible before they eat a session.
- Related config gaps fixed by hand today, worth automating: sunshine.exe had no admin account (credentials file 1 byte; ran 'sunshine.exe --creds sunshine sunshine'); districts bxl1-test-2 and bxl1-test-3 were missing from the providers section of the hydracluster config (added, service restarted); hydranode writes config_cache.yaml only at ITS startup so hydrabody could not pick up the new credentials without a manual cache patch plus hydrabody restart (config refresh should propagate without restarting hydranode).
- Separate noise on the same box: provider auto-update loops every 30 s failing 'downloading provider: HTTP 404' for releases.experiencenet.com/providers/sunshine/latest/sunshine-windows.zip (artifact missing on the release server). Should back off and alert once.
Full session context in hydraheadquest issue #544.