OAuth refresh failure caused by a transient network error logs the CLI out permanently (daemon / Remote Control on an always-on Mac)

Environment: Claude Code 2.1.290 (npm global), macOS 26.6, Mac mini (Apple silicon), logged in with claude.ai (Team). Runs claude remote-control --spawn same-dir and claude daemon run under launchd.

What happened

• The Mac was asleep. At 22:02:04 it did a ~45 s DarkWake (network-traffic wake) where DNS was not yet available.
• In that same second the daemon's overdue proactive refresh fired:

[supervisor] auth: proactive refresh starting
[supervisor] auth: proactive refresh failed, signalling re-auth required
[supervisor] auth: headless daemon cannot complete OAuth - run `claude auth login` to refresh
[supervisor] auth: no token found, will re-check keychain every 30s

• From then on claude auth status reported loggedIn: false. New Remote Control sessions failed with Session failed: Process exited with error until a manual claude auth login the next morning.
• The stored refresh token was still valid: restoring a copy of the keychain item taken before the failure logged the CLI back in without a browser.

Expected: a refresh that fails because the network is unreachable (DNS/connect error, no HTTP response) should be retried later, and the stored credentials kept. Only an actual invalid_grant from the token endpoint should drop the login.

Why it matters: on headless always-on machines (Remote Control, daemon) there is no one to re-login, and setup-token cannot be used for Remote Control.