Deny Request

No, that was not me. A state of its own, deliberately.

Without it a refusal lands as a timeout, and a person saying no reads to the waiting agent as try again — which is the whole reason denied exists in the state machine. The claim route reports it as terminal.

Bound to the session user's ADDRESS, not to user_id. This route used to be open to any session, and that was the right call while it was the only one available: a pairing row has no user_id until somebody approves it, so requiring ownership would have made the request nobody has approved — the only kind an attacker starts — the one kind nobody can refuse. The address closes that gap without reopening it: an unapproved row is now attributable to the mailbox it names, so the person it was aimed at can refuse it and nobody else can.