**TL;DR:** Stop retrying and re-authenticate first. A deploy is a sequence of API calls sharing one credential, so a token expiring mid-deploy leaves the worker half-published: new script with old bindings, or vice versa. Verify the credential is dead with `wrangler whoami`, get a fresh one, inspect what's live with `wrangler deployments list`, then run one clean full deploy. Retrying with the dead credential just burns rate limit.

```text
auth token expired mid-deploy: agent left worker in half-published failed state
```

## Steps

1. Stop all retries immediately. Run `wrangler whoami`. Expected: an auth error, confirming the credential is dead. No deploy attempts until this passes.
2. Get a fresh credential: create a new API credential with Workers write scope, or re-run the login flow. Run `wrangler whoami` again. Expected: it shows the correct account with no errors.
3. Inspect the live state: `wrangler deployments list`. Expected: you can see which deployment is live and its timestamp, so you know whether it predates the failed run.
4. Run one clean full deploy: `wrangler deploy`. Expected: success. A full deploy replaces the script, bindings, and routes together, which clears the partial state. Don't try to resume by replaying only the failed sub-step.
5. Verify: check the deployments list again and hit the worker's route. Expected: the live version matches the deploy you just pushed, and the worker behaves as the new code intends.
6. Add the guard: the agent checks credential validity with `wrangler whoami` before every deploy, and treats any 401 mid-run as "stop and re-authenticate", never "retry the same call". Expected: this failure mode stops recurring.

## Use this when
- deploy output shows an auth error partway through, after earlier steps succeeded
- the live worker's behavior doesn't match any single known deploy
- bindings or routes look stale while the script looks new (or vice versa)
- "half-published" or "partially deployed" state after a failed run

## Not for this skill when
- the deploy failed on validation before anything published - that's a config error
- the credential was already dead before the deploy started - just re-authenticate, no recovery needed
- the failure is a 429 rate limit with a valid credential - back off instead
- the worker is fine and only the local state is confused - verify before "fixing"

## Variant phrasings
- wrangler deploy died with an authentication error halfway through
- worker left in inconsistent state after expired token during deploy
- deploy partially applied then failed on auth
- half-published worker after credential expiry

## Why it happens
Wrangler's deploy is not one atomic API call - it uploads the script, sets bindings, uploads assets, and updates routes as separate calls. A credential expiring between calls commits whatever already landed and fails the rest. Blind retries with the same dead credential can't converge and each attempt spends rate-limit budget.

## Edge cases
- Secrets rotated between the failed deploy and recovery may belong to the half-state. Verify secrets are the intended values too.
- If another agent deployed concurrently, the deployments list shows which one won. Coordinate before redeploying over it.
- Service credentials with long lifetimes avoid expiry mid-deploy for scheduled agent runs.
- A deploy that failed at the route-update step can leave the new script live on old routes. Step 3 catches this.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2ycA_eC8IVF_aSdfqiCRLw