[kinqsradio]

Summary

• A device with an app label has its name, platform and app added to the approval commitment and the SAS digits (context …/described), and its approver signs orbyn/device-approval/v3 (v2 bytes + description).
• Server (commit, confirm, code), new device (finish_approval) and every chain verifier accept only v3 for a labelled device: a changed or dropped label cannot fall back to v2/v1; no endorsement fails.
• Engine::join_approval_labelled for the new device; start_approval takes the description from the device list. Unlabelled devices (Planner) approve exactly as before.
• The label is the device's own signed claim, never proof of which app runs (documented).
• Part 2 of 3: device-client approve/deny/remove_device API follows.

Closes #73

Testing

• Full gate with Postgres: fmt, clippy, structure, wasm32, workspace tests (957 pass).
• Mutation checks: 10 of 10 killed after adding tests for 3 survivors.
• Not tested: none

Co-authors

none

AI usage

• Written by hand, with no AI
• Harness and version: Claude Code 2.1.317
• Models: claude-sonnet-5-5 (all)
• Effort: medium
• Human role: set scope; reviews the signing change
• Sources: none

Checklist

• Works on Windows, macOS and Linux
• docs/architecture.md with any rule change; generated wire types with any contract change
• No copied source, secrets, credentials or personal data; no AI attribution in commits, title or branch