CI / ci (push) Successful in 9m31s
The login route is unauthenticated, so its pending states could grow without limit and every Add scanned them all. Expired states now leave from the front of an add-ordered queue, and Add refuses a new flow with ErrTooManyPending once 10000 are pending; login answers 503. Both flows record the state before setting the cookie. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>