upstream_blocked was in neither provider-reason set, so a worker hitting a User-Agent firewall exited 1 and the dispatcher re-spawned it into the same wall until kanban.failure_limit was spent (on base the same 403 classified auth and parked the card after one spawn). A header change heals it, a retry never does: it is terminal.