Answer a pending phase-change request — the other half of the mutual-consent handshake on POST /api/pairings/update_phase. Confirm applies the proposed phase to the pairing; dismiss leaves it where it is and notifies the requester; cancel withdraws the request before it is answered. Ownership is enforced against the request row: only the COUNTERPARTY can confirm or dismiss, only the REQUESTER can cancel — a phase decision is never anonymous, so session_id is required. A replay finds no pending request and changes nothing (409), and neither confirm nor dismiss can be applied twice. An unanswered request expires on its own (default TTL 14 days, CONSENT_REQUEST_TTL_DAYS): it is swept lazily on every read/write path that touches it, so the lock can never outlive its window even if no page is ever opened; the requester is notified that their proposal lapsed, and answering it afterwards returns 409 with reason expired.