[teamleaderleo]

Why. A capture's cloud.machines reply showed link_route: "link (native failed: refused(400))". NativeDeviceEnrollmentError.refused is thrown from four places (device revoke, owner ops such as host.enroll/host.network.bind, the signed Native reads, and the host.network.target read), so the reason didn't say which call got the 400.

What.

• refused(Int) becomes refused(Int, step: String). The step is the owner op name, or METHOD /path with device and mesh ids swapped for {device}/{mesh} (via NativeDeviceScope.step). It never holds an id or a token.
• NativeDeviceEnrollmentError now conforms to CustomStringConvertible. Every other case prints exactly what it printed before, and refused prints refused(400) at POST /v1/devices/{device}/signed/tunnel (or ... at host.network.target).
• The two tests that build refused are updated. CloudNativeFirstLauncherTests now checks the literal route string link (native failed: refused(400) at host.network.target).

Risk. None. Only the error's detail changes; nothing branches on the status or the step.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Makes NativeDeviceEnrollmentError.refused carry the step that got the status, so the cloud.machines link route says which call was refused instead of just refused(400).

• refused(Int) becomes refused(Int, step: String); the step is an owner op name or a METHOD /path template with device and mesh ids replaced by {device}/{mesh}.
• NativeDeviceEnrollmentError now conforms to CustomStringConvertible, printing every case exactly as before except refused, which prints e.g. refused(400) at POST /v1/devices/{device}/signed/tunnel or refused(400) at host.network.target.
• Only error detail changes; nothing branches on the status or the step.

^{Written for commit 049281f. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 049281f: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr32525 -f ref=lane/native-refusal-step -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4150738990701 (069f8c0811)
• cmux NEXT nightly 1.0.0-nightly.4150891005901 (2fdcbbae7e)
• cmux NEXT nightly 1.0.0-nightly.4150807093801 (069f8c0811)
• cmux NEXT nightly 1.0.0-nightly.4151067571301 (546cb0bf70)
• cmux NEXT nightly 1.0.0-nightly.4151196080201 (8d6a5624a6)
• cmux NEXT nightly 1.0.0-nightly.4151284660301 (22fd89a839)
• cmux NEXT nightly 1.0.0-nightly.4151418814301 (b899f6b4f0)

[teamleaderleo]

Review (subagent claude-opus-5-5 medium): SHIP at 049281f

Visual verdict: unchanged by this diff

I checked that the only behavioural comparison on this error, CloudNativeRouteHolder's != .signedOut, is unaffected, and that no source code pattern-matches .refused. The step strings are owner op literals (host.enroll, host.network.bind, host.network.target), a fixed DELETE template, or NativeDeviceScope.step. That helper turns dev_/mesh_ segments into {device}/{mesh}, and the tenant and bearer stay out of the path, so no token or tenant gets into the string. The new description prints the other cases the same way the default enum description did. All three test sites are updated, and the route string test now expects refused(400) at host.network.target.

Follow-ups: none

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)/ test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)	View Logs
the short nightly decide gate must use the pooled Linux route with a Blacksmith fallbac k/ the short nightly decide gate must use the pooled Linux route with a Blacksmith fallbac k	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}