- Shipped
- August 25, 2026 at 9:05 PM UTC
- Author
- Kamo
- Commit
- 9697068
Reported as being thrown back to the email field with "Your sign-in timed out. Please sign in again." after clicking Continue. The timeout had not happened — that message is the SECOND failure, and it was reporting the damage done by the first. The selection token is spent on the way in, which is what makes it single-use: two requests arriving together must not both mint a session. But it means anything thrown afterwards left the member holding a token that no longer existed. complete() threw, the 500 took the token with it, and every retry answered 401 — which the screen reads as "start over". The trigger was a transient Yugabyte 40001, "schema version mismatch", on the member lookup inside create***Id, during a window of heavy DDL. Retryable, gone by the next attempt, and nothing whatsoever to do with the token. The logs show five sign-ins in four minutes before one happened to miss it. So the token now survives a failure that is not its fault: redeem() hands back a Claim carrying the remaining TTL, and a throw restores it with only the time it had left before answering 503. Single-use is unchanged — it is not restored after a session is minted, nor after a membership refusal, only when nothing happened. The client already treats 401 alone as "start over", so 503 leaves the picker up with the choice still made. The 401 branch also logs now. It was the one path here that said nothing, which is why this left no trace on the service side at all.