An untrusted device now gets a clear rejection instead of a silent failure and endless retries.
What's wrong with this entry?
Remote credential fetch retries once through a new device-attestation path, and an untrusted_device result without the relevant capability now returns a terminal rejection instead of a bare null.
- The rejection carries
reason: "request_rejected"with status 403 and is marked terminal, so callers stop retrying. - OAuth-rejected results are now passed through to the caller rather than swallowed.
- The enabled state of the surrounding path could not be resolved from the build.
{ terminal: !0, reason: "request_rejected", status: 403 }
Strings lifted out of the shipped bundle, so the claim above can be checked against them.