Fixed: the credential exchange proves which key it is binding to instead of naming one. The space host stopped accepting a named key, and until this landed every cross-server space read answered "missing DPoP header" — a refusal that arrives before membership is ever considered, so it says nothing about the space