Artifact and asset fetches now detect a specific 403 response body indicating that a cloud session's org network access is off, distinct from network access merely being unavailable. This case is reported as a network_off result with a message stating that retrying from here will not help, rather than falling through to the generic relay-unavailable error path.
The artifact tool also now gives distinct explanatory messages when reads or writes fail because the cloud session lacks network access versus because database access isn't available in the current cloud session, so the model can tell the failure kinds apart instead of blindly retrying. Underlying database read/write requests check a network-off gateway policy and return a refused-with-reason response (network_off / whoami_network_off) ahead of other checks when networking is disabled, and the fetch path itself recognizes an exact-match set of two policy-denial strings in the 403 body to trigger this handling.