Pairing can't live in a headless process
SPAKE2 pairing needs a human to confirm a verification phrase, so it runs in the CLI rather than the headless daemon, which can't guarantee a TTY.
It could not have worked
A race, an ordering, one column holding two things. The shape ruled it out before the code ran.
ferry pair runs the SPAKE2 exchange inside the CLI over a raw TCP socket, not in the daemon. The daemon is headless and can't guarantee a TTY, and the pairing flow requires a human to read and confirm a verification phrase. Both sides exchange identities over the SPAKE2-derived channel, compute the same phrase, each asks its own human, and only if both acks are yes does either side commit the roster entry.
The general shape: a step that structurally requires a human can't live in a process that structurally can't reach one.