Function pairing_deny_conflict 

pub fn pairing_deny_conflict(
    allowed: &[String],
    channel_type: &str,
    alias: &str,
    identities: &[&str],
    match_fn: impl Fn(&str, &str) -> bool,
) -> Option<String>

The conflict message for a pairing write an ignore would shadow, or None when the write can proceed.

Pairing has to end in an identity the admission matcher accepts. When an explicit deny names the identity, appending a grant persists something the deny immediately shadows: the operator is told the account is bound and it still cannot talk, and grants_anyone keeps offering the same prompt. Every writer of a paired identity asks this first so the ignore stays authoritative and the operator gets told what to edit.

The message names the config location and never the identity: identities are durable personal identifiers and callers log this error.