Ask whether a device link request has been answered yet

Wait for a human, then release the same identity /claim releases.

The 200 body is constructed from :class:LinkClaimResponse itself, so an approved device link and an NL- claim are the same bytes on the wire and a daemon parses one thing (D-X16-O2).

Ordering is the security of this route. The rate limit is charged first because it is the only control that exists before the caller has said anything. The cadence check comes next and answers slow_down without touching the database — identically for a real code and an invented one, so it tells a fast prober nothing. Only then does the policy layer look the row up, and its own first move is the constant-time comparison against the pinned credential (D-X16-O22): every answer that reveals state sits behind it.