[kinqsradio]

Summary

• Device-client calls for the two-way approval: start_approval, approval_state, confirm_approval, deny_approval (approver); pending_approval, join_approval, device_digits, finish_approval, deny_joined (new device); remove_device.
• Client API only: every signature, the digits and every check stay in the engine; the client moves messages in order.
• A device with ClientConfig.app joins with the description it signed in with (join_approval_labelled).
• New typed errors: ApprovalExpired, ApprovalNotReady, ApprovalMismatch, LastTrustedDevice; wrong_code maps to InvalidCode.
• Part 3 of 3 of the approval work; docs/device-client.md updated.

Testing

• Full gate with Postgres: fmt, clippy, structure, wasm32, workspace tests (963 pass).
• Real-server tests: full approval via the client, deny from either side, wrong typed digits, relabelled listing refused, wrong approval id refused, removal and the last device, a name with spaces.
• Mutation checks: 10 mutations, all killed.
• Not tested: none

Co-authors

none

AI usage

• Written by hand, with no AI
• Harness and version: Claude Code 2.1.317
• Models: claude-sonnet-5-5 (all)
• Effort: medium
• Human role: set scope and reviews the client API
• Sources: none

Checklist

• Works on Windows, macOS and Linux
• docs/architecture.md with any rule change; generated wire types with any contract change
• No copied source, secrets, credentials or personal data; no AI attribution in commits, title or branch