Refused

The host actively rejected the resume with an AdmitMessage.Reject, carrying its raw message and structured code.

Branch on code, not message: the text is for a human reading a log. A host that predates typed codes (or one whose code this build does not know) surfaces RejectCode.Unknown, and such a refusal is not a claim that the token was permanently rejected — it may well be a window that had not opened yet (the fast-reconnect race), which the joiner retried to its deadline before giving up. When RejectCode.retryable is false the refusal is terminal, and the joiner surfaces it without waiting out the window.

kuilt still cannot type the host's intent beyond the codes it defines — an application-level refusal (auth policy, capacity) rides in message or a consumer-supplied RejectCode of its own.