When a stale ADO_APM_PAT is present alongside a valid Azure CLI bearer credential, ref resolution (install/phases/resolve.py, marketplace/version_resolver.py) does not retry with bearer after the PAT is rejected. #2150 correctly preserved the bearer scheme; this is the separate, pre-existing retry-fallback capability. Add a tested path that falls back from a rejected stale PAT to bearer without weakening scheme preservation.
Surfaced by the advisory review panel on #2155 and deferred as out-of-scope for that consolidation PR. Filed for tracking by the reliability campaign.
When a stale
ADO_APM_PATis present alongside a valid Azure CLI bearer credential, ref resolution (install/phases/resolve.py,marketplace/version_resolver.py) does not retry with bearer after the PAT is rejected. #2150 correctly preserved the bearer scheme; this is the separate, pre-existing retry-fallback capability. Add a tested path that falls back from a rejected stale PAT to bearer without weakening scheme preservation.Surfaced by the advisory review panel on #2155 and deferred as out-of-scope for that consolidation PR. Filed for tracking by the reliability campaign.