Service token only (dt-api's scheduled refresh). Runs the SAME guards as manual Add documents for the refresh's pinned owner and returns the complete add-documents pipeline request, so an unattended refresh is exactly that run on a timer — never a replay of the build payload.

A tenant problem aborts the whole run: the owner left the org (403), the society is not theirs (404) or is shared with another org (409), the org has no active billing (402), or there is no completed build (422). A source the owner is not connected to is only left out and reported, so the rest still refresh while the digest asks for a reconnect.