Method RejectPending

internal/identity/store.go:2269–2307

RejectPending transitions a pending_review message to rejected, records the reviewer's reason (empty string allowed), and scrubs body_text / body_html / attachments_json. Ownership checked; missing rows return ErrMessageNotFound. Non-pending rows return ErrNotPendingApproval.

(ctx context.Context, messageID, userID, reason string)

// body_text / body_html / attachments_json. Ownership checked; missing
// rows return ErrMessageNotFound. Non-pending rows return ErrNotPendingApproval.
func (s *Store) RejectPending(ctx context.Context, messageID, userID, reason string) (*Message, error) {
	// Single atomic UPDATE with status guard. We distinguish "not found" from
	// "not pending" with a follow-up existence check only when rows-affected
	// is 0.
	tag, err := s.pool.Exec(ctx,
		`UPDATE messages
		    SET status = $3,
		        rejection_reason = $4,
		        reviewed_at = now(),
		        reviewed_by_user_id = $2,
		        body_text = NULL,
		        body_html = NULL,
		        attachments_json = NULL
		  WHERE id = $1
		    AND status = 'pending_review'
		    AND direction = 'outbound'
		    AND agent_id IN (SELECT id FROM agent_identities WHERE user_id = $2)`,
		messageID, userID, MessageStatusReviewRejected, reason,
	)
	if err != nil {
		return nil, err
	}
	if tag.RowsAffected() == 0 {
		// Figure out why: missing, not owned, or not pending.
		var status string
		err := s.pool.QueryRow(ctx,
			`SELECT m.status
			 FROM messages m
			 JOIN agent_identities a ON a.id = m.agent_id
			 WHERE m.id = $1 AND a.user_id = $2`,
			messageID, userID,
		).Scan(&status)
		if err != nil {
			return nil, ErrMessageNotFound
		}
		return nil, ErrNotPendingApproval
	}
	return s.GetOutboundMessageForUser(ctx, messageID, userID)
}

func (s *Store) ListActivityByAgent(ctx context.Context, agentID string, limit int) ([]Message, error) {
	rows, err := s.pool.Query(ctx,