Claim

Public — the agent polls with its claim token. pending is HTTP 200.

Shares SP-15's short-poll semantics and its invariant-I6 contract: a 4xx would be shaped by the mcp refusal middleware into "do not retry", appended to the one response whose entire contract is retry it.

This route serves BOTH kinds, and that is load-bearing rather than incidental. R-8 removed /signup/claim, which was the shared one; claim_status → _live looks a row up by claim-token hash with no kind predicate at any layer, so a signup row resolves here too. Every sibling in this router (claim_status_by_id, waiting_for_email, approve_pairing) DOES filter kind == pairing, which makes "add the same filter here for consistency" the obvious-looking tidy-up — and it would leave the signup half of one state machine with no claim route at all. test_the_claim_route_serves_a_signup_row_too exists to make that change red.

A browser registration's token resolves here too, and mints nothing. Those rows are written key_purpose=unspecified, which issue_claimed_key refuses outright. That is the single guard separating a status-reading token from a key-minting one, so it is asserted end to end rather than assumed.