Tests reproduce issue 17034: a session paired before environment:maintain
gets a disabled Update with no re-pair explanation, Update all stays enabled
for denied targets, and a denied target is skipped silently.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>