TLS/cert errno codes that mean "the leaf we PINNED no longer matches what the
device is serving" — the device rotated its self-signed ingest cert (certGen
bumped) after the grant was minted. These are all also in
RETRYABLE_STREAM_CODES (so the stream loop retries), but the pin sites
additionally re-fetch the grant on them to pick up the current
pinCertDerB64. A subset of the retryable set: a plaintext-edge EPROTO is
NOT a pin mismatch (there is no cert to re-pin), so it is excluded.
TLS/cert errno codes that mean "the leaf we PINNED no longer matches what the device is serving" — the device rotated its self-signed ingest cert (certGen bumped) after the grant was minted. These are all also in RETRYABLE_STREAM_CODES (so the stream loop retries), but the pin sites additionally re-fetch the grant on them to pick up the current
pinCertDerB64. A subset of the retryable set: a plaintext-edgeEPROTOis NOT a pin mismatch (there is no cert to re-pin), so it is excluded.